@oh-my-tool/cli 0.3.2 → 0.3.4

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@oh-my-tool/cli",
-  "version": "0.3.2",
+  "version": "0.3.4",
   "type": "module",
   "description": "Oh My Tool CLI - local and enterprise tools for agents",
   "keywords": [
@@ -29,7 +29,7 @@
   "dependencies": {
     "@clack/prompts": "^1.7.0",
     "@modelcontextprotocol/client": "2.0.0",
-    "@oh-my-tool/sdk": "0.3.2",
+    "@oh-my-tool/sdk": "0.3.4",
     "open": "11.0.0"
   },
   "engines": {

package/src/cli/commands/connections.ts

@@ -1,18 +1,15 @@
-import { loadConfig } from "../../config/config";
+import { loadConfig, sanitizeExtensionConnections, validateConfiguredConnections } from "../../config/config";
 import { createPaths } from "../../paths";
 import { prepareHome } from "../../migration";
 import { withRuntime } from "../context";
+import { discoverExtensions } from "../../extension/discovery";
 
 export interface ConnectionSummary {
   extension: string;
   name: string;
-  environment: string;
-  host: string;
-  port: number;
-  database: string;
-  username: string;
-  tls: boolean;
-  secretConfigured: boolean;
+  environment?: string;
+  settings: Record<string, unknown>;
+  secretsConfigured: Record<string, boolean>;
 }
 
 export interface ConnectionListResult {
@@ -43,20 +40,15 @@ async function configuredConnections(): Promise<ConnectionListResult> {
   const paths = createPaths();
   await prepareHome(paths);
   const config = loadConfig(paths.home);
-  const connections = Object.entries(config.extensions)
+  const sanitized = sanitizeExtensionConnections(config);
+  const connections = Object.entries(sanitized)
     .sort(([left], [right]) => left.localeCompare(right))
-    .flatMap(([extension, value]) => Object.entries(value.connections)
+    .flatMap(([extension, value]) => Object.entries(value)
       .sort(([left], [right]) => left.localeCompare(right))
       .map(([name, connection]) => ({
         extension,
         name,
-        environment: connection.environment,
-        host: connection.host,
-        port: connection.port,
-        database: connection.database,
-        username: connection.username,
-        tls: connection.tls,
-        secretConfigured: connection.secret.length > 0,
+        ...connection,
       })));
   return { connections, count: connections.length };
 }
@@ -69,6 +61,7 @@ export async function runConfigCheck(): Promise<ConfigCheckResult> {
   const paths = createPaths();
   await prepareHome(paths);
   const config = loadConfig(paths.home);
+  validateConfiguredConnections(config, discoverExtensions(paths.home));
   return {
     valid: true,
     connectionCount: Object.values(config.extensions).reduce((count, extension) => count + Object.keys(extension.connections).length, 0),
@@ -78,17 +71,32 @@ export async function runConfigCheck(): Promise<ConfigCheckResult> {
 
 export async function runConnectionCheck(): Promise<ConnectionCheckResult> {
   const list = await configuredConnections();
+  const paths = createPaths();
+  const checkTools = new Map(discoverExtensions(paths.home).map((extension) => [extension.id, extension.manifest.connectionCheckTool]));
   return withRuntime(async (runtime) => {
-    const checks: ConnectionCheck[] = [];
-    for (const connection of list.connections) {
+    const checks: ConnectionCheck[] = await boundedMap(list.connections, 4, async (connection) => {
+      const toolId = checkTools.get(connection.extension);
+      if (!toolId) return { extension: connection.extension, name: connection.name, status: "unsupported", code: "CHECK_UNSUPPORTED" };
       const started = Date.now();
-      const result = await runtime.run(`${connection.extension}.ping`, { connection: connection.name });
-      checks.push(result.ok
+      const result = await runtime.run(toolId, { connection: connection.name });
+      return result.ok
         ? { extension: connection.extension, name: connection.name, status: "ok", durationMs: Date.now() - started }
-        : result.error?.code === "TOOL_NOT_FOUND"
-          ? { extension: connection.extension, name: connection.name, status: "unsupported", code: "CHECK_UNSUPPORTED" }
-          : { extension: connection.extension, name: connection.name, status: "error", code: result.error?.code ?? "CHECK_FAILED", durationMs: Date.now() - started });
-    }
+        : { extension: connection.extension, name: connection.name, status: "error", code: result.error.code ?? "CHECK_FAILED", durationMs: Date.now() - started };
+    });
     return { checks, count: checks.length };
   }, { includeMcp: false });
 }
+
+async function boundedMap<T, R>(values: readonly T[], concurrency: number, worker: (value: T) => Promise<R>): Promise<R[]> {
+  const results = new Array<R>(values.length);
+  let next = 0;
+  async function consume(): Promise<void> {
+    while (true) {
+      const index = next++;
+      if (index >= values.length) return;
+      results[index] = await worker(values[index]);
+    }
+  }
+  await Promise.all(Array.from({ length: Math.min(concurrency, values.length) }, () => consume()));
+  return results;
+}

package/src/cli/commands/run.ts

@@ -1,25 +1,19 @@
 import { coerceInput } from "../parseArgs";
 import { withRuntime } from "../context";
-import type { OmtResult } from "../../core/result";
+import type { ExecutionResult } from "../../runtime/result";
 
 export async function runTool(
   toolName: string,
   keyValues: Record<string, string>,
   useStdin: boolean,
-): Promise<OmtResult> {
+): Promise<ExecutionResult> {
   let input: Record<string, unknown>;
   if (useStdin) {
     input = await readStdinJson();
   } else {
     input = coerceInput(keyValues);
   }
-  return withRuntime(async (runtime) => {
-    const result = await runtime.run(toolName, input);
-    if (result.ok) {
-      return { ok: true, tool: toolName, data: result.output, meta: result.meta ?? {} };
-    }
-    return { ok: false, tool: toolName, error: result.error ?? { code: "EXECUTION_FAILED", message: "execution failed" } };
-  }, { targetTool: toolName });
+  return withRuntime((runtime) => runtime.run(toolName, input), { targetTool: toolName });
 }
 
 function readStdinJson(): Promise<Record<string, unknown>> {

package/src/cli/commands/search.ts

@@ -1,8 +1,9 @@
 import { withRuntime } from "../context";
+import type { ToolSearchOptions } from "../../runtime/provider";
 
-export async function runSearch(query: string): Promise<{ tools: Array<Record<string, unknown>> }> {
+export async function runSearch(query: string, options: ToolSearchOptions = {}): Promise<{ tools: Array<Record<string, unknown>>; meta: { unavailableProviders: Array<Record<string, unknown>> } }> {
   return withRuntime(async (runtime) => {
-    const descriptors = await runtime.search(query);
+    const descriptors = await runtime.search(query, options);
     return {
       tools: descriptors.map((descriptor) => ({
         name: descriptor.id,
@@ -11,6 +12,11 @@ export async function runSearch(query: string): Promise<{ tools: Array<Record<st
         risk: descriptor.risk,
         provider: descriptor.provider,
       })),
+      meta: {
+        unavailableProviders: runtime.providerStatuses()
+          .filter((status) => status.status === "unavailable")
+          .map(({ id, kind, status, code, message }) => ({ id, kind, status, ...(code === undefined ? {} : { code }), ...(message === undefined ? {} : { message }) })),
+      },
     };
   });
 }

package/src/cli/context.ts

@@ -1,11 +1,10 @@
 import { createPaths } from "../paths";
 import { prepareHome } from "../migration";
-import { loadConfig, getConnectionConfig, sanitizeExtensionConnections, type McpEnabledServerConfig } from "../config/config";
+import { loadConfig, getConnectionConfig, sanitizeExtensionConnections, validateConfiguredConnections, type McpEnabledServerConfig } from "../config/config";
 import { SecretsManager } from "../secrets/secrets";
 import { applyLimits, validateConnectionInput } from "../policy/policy";
 import { NativeExtensionProvider } from "../runtime/providers/native/provider";
 import { McpProvider } from "../runtime/providers/mcp/provider";
-import { discoverExtensions } from "../extension/discovery";
 import { createToolRuntime } from "../runtime/runtime";
 import type { ToolDescriptor } from "../runtime/provider";
 
@@ -24,13 +23,19 @@ export async function createRuntime(options: RuntimeOptions = {}) {
   const config = loadConfig(paths.home);
   const secrets = new SecretsManager();
   const extensionConnections = sanitizeExtensionConnections(config);
-  const nativeTarget = options.targetTool !== undefined && discoverExtensions(paths.home)
-    .some((extension) => extension.manifest.tools.some((tool) => tool.name === options.targetTool));
+  const nativeProvider = new NativeExtensionProvider(paths);
+  const nativeTargetExtension = options.targetTool === undefined
+    ? undefined
+    : nativeProvider.extensionForTool(options.targetTool);
+  if (nativeTargetExtension !== undefined) {
+    validateConfiguredConnections(config, nativeProvider.installedExtensions(), nativeTargetExtension);
+  }
+  const nativeTarget = nativeTargetExtension !== undefined;
   const mcpProviders = options.includeMcp === false || nativeTarget ? [] : Object.entries(config.mcp.servers)
     .sort(([a], [b]) => a.localeCompare(b))
     .filter((entry): entry is [string, McpEnabledServerConfig] => entry[1].enabled)
     .map(([serverId, server]) => new McpProvider({ serverId, config: server, secrets }));
-  const providers = [new NativeExtensionProvider(paths), ...mcpProviders];
+  const providers = [nativeProvider, ...mcpProviders];
   return createToolRuntime({
     providers,
     policy: {

package/src/cli/index.ts

@@ -121,6 +121,23 @@ function parseAgentIds(raw?: string): AgentId[] | undefined {
   return [...new Set(values as AgentId[])];
 }
 
+function parseSearchOptions(options: Record<string, string>): { limit?: number; provider?: string; source?: string; risk?: "read" | "write" | "admin" } {
+  const limit = options.limit === undefined ? undefined : Number(options.limit);
+  if (limit !== undefined && (!Number.isInteger(limit) || limit < 1)) {
+    throw new RuntimeError("INVALID_ARGUMENT", "search --limit must be a positive integer");
+  }
+  const risk = options.risk;
+  if (risk !== undefined && risk !== "read" && risk !== "write" && risk !== "admin") {
+    throw new RuntimeError("INVALID_ARGUMENT", `unsupported search risk '${risk}'`);
+  }
+  return {
+    ...(limit === undefined ? {} : { limit }),
+    ...(options.provider === undefined ? {} : { provider: options.provider }),
+    ...(options.source === undefined ? {} : { source: options.source }),
+    ...(risk === undefined ? {} : { risk }),
+  };
+}
+
 function printDetected(agents: AgentDetection[]): void {
   console.log("Detected agents:\n");
   for (const agent of agents) console.log(`✓ ${agent.variant ?? agent.displayName}`);
@@ -169,10 +186,10 @@ function printStatus(results: IntegrationResult[]): void {
   const summary = Object.entries(counts).map(([status, n]) => `${n} ${status}`).join("  ·  ");
   console.log(`\nSummary: ${summary}`);
   if (results.some((item) => item.status === "broken")) {
-    console.log("Tip:   run `omt integrate repair` to recreate broken links");
+    console.log("Tip:   run `ohmytool integrate repair` to recreate broken links");
   }
   if (results.some((item) => item.status === "conflict")) {
-    console.log("Tip:   conflict means OMT refuses to touch an unmanaged path; run `omt integrate --force` only if you accept replacing it");
+    console.log("Tip:   conflict means OMT refuses to touch an unmanaged path; run `ohmytool integrate --force` only if you accept replacing it");
   }
 }
 
@@ -207,7 +224,7 @@ export async function main(argv: string[], dependencies: CliDependencies = defau
     const parsed = parseArgs(argv);
     const cmd = parsed.positional[0];
     const allowedFlags = new Set(["help", "version", "json", "stdin", "yes", "dry-run", "force"]);
-    const allowedOptions = new Set(["format", "json", "agents"]);
+    const allowedOptions = new Set(["format", "json", "agents", "limit", "provider", "source", "risk"]);
     const unknownFlag = parsed.flags.find((flag) => !allowedFlags.has(flag));
     const unknownOption = Object.keys(parsed.options).find((option) => !allowedOptions.has(option));
     if (unknownFlag) throw new RuntimeError("INVALID_ARGUMENT", `unknown option '--${unknownFlag}'`);
@@ -215,7 +232,7 @@ export async function main(argv: string[], dependencies: CliDependencies = defau
     switch (cmd) {
       case "search": {
         const q = parsed.positional.slice(1).join(" ");
-        print(await runSearch(q));
+        print(await runSearch(q, parseSearchOptions(parsed.options)));
         return 0;
       }
       case "describe": {
@@ -235,7 +252,7 @@ export async function main(argv: string[], dependencies: CliDependencies = defau
           return 1;
         }
         const result = action === "list" ? await runConnectionList() : await runConnectionCheck();
-        const wrapped = { ok: true as const, tool: `connection.${action}`, data: result, meta: {} };
+        const wrapped = { ok: true as const, toolId: `connection.${action}`, output: result, meta: {} };
         console.log(formatOutput(wrapped, outputFormat(parsed)));
         return 0;
       }
@@ -245,7 +262,7 @@ export async function main(argv: string[], dependencies: CliDependencies = defau
           return 1;
         }
         const result = await runConfigCheck();
-        const wrapped = { ok: true as const, tool: "config.check", data: result, meta: {} };
+        const wrapped = { ok: true as const, toolId: "config.check", output: result, meta: {} };
         console.log(formatOutput(wrapped, outputFormat(parsed)));
         return 0;
       }

package/src/cli/output.ts

@@ -1,24 +1,24 @@
-import type { OmtResult } from "../core/result";
+import type { ExecutionResult } from "../runtime/result";
 
 export type OutputFormat = "text" | "json" | "table" | "csv";
 
-export function formatAiResult(result: OmtResult): string {
-  const lines = [`status: ${result.ok ? "ok" : "error"}`, `tool: ${result.tool}`];
+export function formatAiResult(result: ExecutionResult): string {
+  const lines = [`status: ${result.ok ? "ok" : "error"}`, `tool: ${result.toolId}`];
   if (!result.ok) {
     lines.push("error:");
     appendObject(lines, result.error, 2);
     return lines.join("\n");
   }
 
-  if (isRowsResult(result.data)) {
+  if (isRowsResult(result.output)) {
     lines.push("rows:");
-    for (const row of result.data.rows) lines.push(formatRow(row));
-    lines.push(`row_count: ${result.data.rows.length}`);
-    if (result.data.truncated === true) lines.push("truncated: true");
+    for (const row of result.output.rows) lines.push(formatRow(row));
+    lines.push(`row_count: ${result.output.rows.length}`);
+    if (result.output.truncated === true) lines.push("truncated: true");
     appendMeta(lines, result.meta, new Set(["returnedRows"]), false);
   } else {
     lines.push("data:");
-    appendValue(lines, result.data, 2);
+    appendValue(lines, result.output, 2);
     appendMeta(lines, result.meta);
   }
   return lines.join("\n");
@@ -36,17 +36,17 @@ export function formatJson(value: unknown): string {
   }, 2) ?? "null";
 }
 
-export function formatOutput(result: OmtResult, format: OutputFormat): string {
+export function formatOutput(result: ExecutionResult, format: OutputFormat): string {
   if (format === "json") return formatJson(result);
   if (format === "csv" || format === "table") return formatDelimited(result, format === "csv" ? "," : "\t");
   return formatAiResult(result);
 }
 
-function formatDelimited(result: OmtResult, delimiter: string): string {
+function formatDelimited(result: ExecutionResult, delimiter: string): string {
   if (!result.ok) return formatAiResult(result);
-  const rows = isRowsResult(result.data)
-    ? { columns: result.data.columns, rows: result.data.rows }
-    : findObjectArray(result.data);
+  const rows = isRowsResult(result.output)
+    ? { columns: result.output.columns, rows: result.output.rows }
+    : findObjectArray(result.output);
   if (!rows) return formatAiResult(result);
   return [rows.columns, ...rows.rows].map((row) => row.map((value) => quoteDelimited(value, delimiter)).join(delimiter)).join("\n");
 }

package/src/config/config.ts

@@ -1,15 +1,19 @@
 import { existsSync, readFileSync } from "node:fs";
 import { join } from "node:path";
 import { RuntimeError } from "../runtime/errors";
+import { validateInput, type Schema } from "../runtime/schema";
+import type { InstalledExtension } from "../extension/discovery";
 
 export interface ConnectionConfig {
-  environment: string;
-  host: string;
-  port: number;
-  database: string;
-  username: string;
-  secret: string;
-  tls: boolean;
+  environment?: string;
+  settings: Record<string, unknown>;
+  secrets: Record<string, string>;
+}
+
+export interface SanitizedConnectionConfig {
+  environment?: string;
+  settings: Record<string, unknown>;
+  secretsConfigured: Record<string, boolean>;
 }
 
 export interface McpCommonServerConfig { readonly enabled: true; readonly namespace: string; }
@@ -44,32 +48,36 @@ function parseConnection(extensionId: string, name: string, value: unknown): Con
   const path = `extensions.${extensionId}.connections.${name}`;
   if (value === null || typeof value !== "object" || Array.isArray(value)) invalidConnection(path, "must be a table");
   const raw = value as Record<string, unknown>;
-  const stringField = (key: string, fallback = ""): string => {
-    const entry = raw[key];
-    if (entry === undefined) return fallback;
-    if (typeof entry !== "string") invalidConnection(`${path}.${key}`, "must be a string");
-    return entry;
-  };
-  const host = stringField("host");
-  if (host.trim().length === 0) invalidConnection(`${path}.host`, "must be a non-empty string");
-  const defaultPort = extensionId === "redis" ? 6379 : 3306;
-  const port = raw.port === undefined ? defaultPort : raw.port;
-  if (typeof port !== "number" || !Number.isInteger(port) || port < 1 || port > 65535) {
-    invalidConnection(`${path}.port`, "must be an integer from 1 through 65535");
-  }
-  const tls = raw.tls === undefined ? false : raw.tls;
-  if (typeof tls !== "boolean") invalidConnection(`${path}.tls`, "must be a boolean");
+  const allowed = new Set(["environment", "settings", "secrets"]);
+  for (const key of Object.keys(raw)) if (!allowed.has(key)) invalidConnection(`${path}.${key}`, "unknown connection field");
+  const environment = raw.environment;
+  if (environment !== undefined && typeof environment !== "string") invalidConnection(`${path}.environment`, "must be a string");
+  const settings = parseSettingsMap(raw.settings, `${path}.settings`);
+  const secrets = parseSecretMap(raw.secrets, `${path}.secrets`);
   return {
-    environment: stringField("environment"),
-    host,
-    port,
-    database: stringField("database"),
-    username: stringField("username"),
-    secret: stringField("secret"),
-    tls,
+    ...(environment === undefined ? {} : { environment }),
+    settings,
+    secrets,
   };
 }
 
+function parseSettingsMap(value: unknown, path: string): Record<string, unknown> {
+  if (value === undefined) return {};
+  if (value === null || typeof value !== "object" || Array.isArray(value)) invalidConnection(path, "must be a table");
+  return { ...(value as Record<string, unknown>) };
+}
+
+function parseSecretMap(value: unknown, path: string): Record<string, string> {
+  if (value === undefined) return {};
+  if (value === null || typeof value !== "object" || Array.isArray(value)) invalidConnection(path, "must be a table");
+  const result: Record<string, string> = {};
+  for (const [key, entry] of Object.entries(value as Record<string, unknown>)) {
+    if (typeof entry !== "string" || entry.length === 0) invalidConnection(`${path}.${key}`, "must be a non-empty string");
+    result[key] = entry;
+  }
+  return result;
+}
+
 function parseStringMap(value: unknown, path: string): Record<string, string> {
   if (value === undefined) return {};
   if (value === null || typeof value !== "object" || Array.isArray(value)) invalid(path, "must be a table");
@@ -191,17 +199,34 @@ export function loadConfig(homeDir: string): Config {
 export function getConnectionConfig(cfg: Config, extensionId: string, connection: string): ConnectionConfig | undefined { return cfg.extensions[extensionId]?.connections[connection]; }
 export function listConnections(cfg: Config, extensionId: string): string[] { return Object.keys(cfg.extensions[extensionId]?.connections ?? {}); }
 
-export function sanitizeExtensionConnections(cfg: Config): Record<string, Record<string, Omit<ConnectionConfig, "secret"> & { secretConfigured: boolean }> > {
+export function sanitizeExtensionConnections(cfg: Config): Record<string, Record<string, SanitizedConnectionConfig>> {
   return Object.fromEntries(Object.entries(cfg.extensions).map(([extensionId, extension]) => [
     extensionId,
     Object.fromEntries(Object.entries(extension.connections).map(([name, connection]) => [name, {
-      environment: connection.environment,
-      host: connection.host,
-      port: connection.port,
-      database: connection.database,
-      username: connection.username,
-      tls: connection.tls,
-      secretConfigured: connection.secret.length > 0,
+      ...(connection.environment === undefined ? {} : { environment: connection.environment }),
+      settings: { ...connection.settings },
+      secretsConfigured: Object.fromEntries(Object.keys(connection.secrets).map((key) => [key, true])),
     }])),
   ]));
 }
+
+export function validateConfiguredConnections(
+  cfg: Config,
+  installedExtensions: readonly InstalledExtension[],
+  targetExtensionId?: string,
+): void {
+  const manifests = new Map(installedExtensions.map((extension) => [extension.id, extension.manifest]));
+  for (const [extensionId, extension] of Object.entries(cfg.extensions)) {
+    if (targetExtensionId !== undefined && targetExtensionId !== extensionId) continue;
+    const schema = manifests.get(extensionId)?.connectionSchema;
+    if (schema === undefined) continue;
+    for (const [name, connection] of Object.entries(extension.connections)) {
+      try {
+        validateInput(schema as Schema, connection.settings, { applyDefaults: false });
+      } catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        invalidConnection(`extensions.${extensionId}.connections.${name}.settings`, message);
+      }
+    }
+  }
+}

package/src/extension/loader.ts

@@ -1,6 +1,6 @@
 import { pathToFileURL } from "node:url";
 import type { ExtensionDefinition } from "@oh-my-tool/sdk";
-import { OmtError } from "../core/registry";
+import { RuntimeError as OmtError } from "../runtime/errors";
 import type { InstalledExtension } from "./discovery";
 import { validateHandlers } from "./manifest";
 

package/src/extension/manifest.ts

@@ -35,6 +35,11 @@ export function validateManifest(manifest: ExtensionManifest): void {
   if (!manifest.sdkVersion || typeof manifest.sdkVersion !== "string") {
     throw new ManifestError("manifest must contain a string 'sdkVersion'");
   }
+  if (manifest.connectionSchema !== undefined && (
+    manifest.connectionSchema === null || typeof manifest.connectionSchema !== "object" || Array.isArray(manifest.connectionSchema)
+  )) {
+    throw new ManifestError("manifest 'connectionSchema' must be an object");
+  }
 
   const seen = new Set<string>();
   for (const tool of manifest.tools) {
@@ -53,6 +58,19 @@ export function validateManifest(manifest: ExtensionManifest): void {
       );
     }
   }
+
+  if (manifest.connectionCheckTool !== undefined) {
+    if (typeof manifest.connectionCheckTool !== "string" || manifest.connectionCheckTool.length === 0) {
+      throw new ManifestError("manifest 'connectionCheckTool' must be a non-empty string");
+    }
+    const checkTool = manifest.tools.find((tool) => tool.name === manifest.connectionCheckTool);
+    if (!checkTool || !manifest.connectionCheckTool.startsWith(`${manifest.id}.`)) {
+      throw new ManifestError("manifest 'connectionCheckTool' must name a declared tool prefixed by the extension id");
+    }
+    if ((checkTool.risk ?? "read") !== "read") {
+      throw new ManifestError("manifest 'connectionCheckTool' must be read-only");
+    }
+  }
 }
 
 const FULL_VERSION_RE = /^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?$/;

package/src/integration/manager.ts

@@ -274,17 +274,17 @@ export function createIntegrationManager(options: IntegrationManagerOptions) {
       const recorded = records[agent.id];
       if (!recorded) {
         if (!pathPresent(agent.target)) {
-          return result(agent, "not-installed", "not installed; run `omt integrate` to install");
+          return result(agent, "not-installed", "not installed; run `ohmytool integrate` to install");
         }
         return result(agent, "conflict", "target exists but is not managed by OMT");
       }
       try {
         assertSafeManagedState(agent, recorded, options.omtHome, platform);
       } catch {
-        return result(agent, "conflict", "recorded state is unsafe; run `omt integrate repair`");
+        return result(agent, "conflict", "recorded state is unsafe; run `ohmytool integrate repair`");
       }
       if (!pathPresent(agent.target) || !safeRealpath(agent.target)) {
-        return result(agent, "broken", "link is missing; run `omt integrate repair`");
+        return result(agent, "broken", "link is missing; run `ohmytool integrate repair`");
       }
       if (!isManagedLink(agent.target, recorded.canonical)) {
         return result(agent, "conflict", "target was replaced by unmanaged content");
@@ -292,7 +292,7 @@ export function createIntegrationManager(options: IntegrationManagerOptions) {
       if (recorded.version === options.skillVersion) {
         return result(agent, "current");
       }
-      return result(agent, "update-available", `new version ${options.skillVersion} available; run \`omt integrate\``);
+      return result(agent, "update-available", `new version ${options.skillVersion} available; run \`ohmytool integrate\``);
     });
   }
 

package/src/policy/policy.ts

@@ -81,6 +81,8 @@ export function assertReadOnly(sql: string): void {
 }
 
 const FORBIDDEN_INPUT = new Set([
+  "settings",
+  "secrets",
   "host",
   "username",
   "password",

package/src/runtime/provider.ts

@@ -11,6 +11,22 @@ export interface ToolDescriptor {
   source: { id: string; kind: string; version?: string };
 }
 
+export interface ToolSearchOptions {
+  readonly limit?: number;
+  readonly provider?: string;
+  readonly source?: string;
+  readonly risk?: ToolDescriptor["risk"];
+}
+
+export interface ProviderStatus {
+  readonly id: string;
+  readonly kind: string;
+  readonly status: "available" | "unavailable";
+  readonly code?: string;
+  readonly message?: string;
+  readonly namespace?: string;
+}
+
 export type ToolSearchResult = Omit<ToolDescriptor, "inputSchema">;
 
 export interface ExecutionContext {
@@ -22,6 +38,7 @@ export interface ExecutionContext {
 export interface ToolProvider {
   readonly id: string;
   readonly kind: string;
+  readonly namespace?: string;
   listTools(): Promise<readonly ToolDescriptor[]>;
   execute(toolId: string, input: unknown, context: ExecutionContext): Promise<ToolResult>;
   close?(): Promise<void>;

package/src/runtime/providers/mcp/provider.ts

@@ -17,6 +17,7 @@ export interface McpProviderOptions {
 export class McpProvider implements ToolProvider {
   readonly id: string;
   readonly kind = "mcp";
+  readonly namespace: string;
   private session?: McpSession;
   private descriptors?: readonly ToolDescriptor[];
   private readonly routes = new Map<string, string>();
@@ -24,6 +25,7 @@ export class McpProvider implements ToolProvider {
 
   constructor(private readonly options: McpProviderOptions) {
     this.id = `mcp:${options.serverId}`;
+    this.namespace = options.config.namespace;
   }
 
   async listTools(): Promise<readonly ToolDescriptor[]> {

package/src/runtime/providers/native/provider.ts

@@ -8,7 +8,15 @@ export class NativeExtensionProvider implements ToolProvider {
   readonly id = "native";
   readonly kind = "native";
 
-  constructor(private readonly homeOrPaths: string | Pick<OhMyToolPaths, "home">) {}
+  private readonly discover: (home: string) => InstalledExtension[];
+  private snapshot?: { extensions: InstalledExtension[]; routes: Map<string, InstalledExtension> };
+
+  constructor(
+    private readonly homeOrPaths: string | Pick<OhMyToolPaths, "home">,
+    discover: (home: string) => InstalledExtension[] = discoverExtensions,
+  ) {
+    this.discover = discover;
+  }
 
   private home(): string {
     return typeof this.homeOrPaths === "string" ? this.homeOrPaths : this.homeOrPaths.home;
@@ -16,7 +24,7 @@ export class NativeExtensionProvider implements ToolProvider {
 
   async listTools(): Promise<readonly ToolDescriptor[]> {
     const descriptors: ToolDescriptor[] = [];
-    for (const extension of discoverExtensions(this.home())) {
+    for (const extension of this.getSnapshot().extensions) {
       for (const tool of extension.manifest.tools) {
         descriptors.push({
           id: tool.name,
@@ -40,18 +48,34 @@ export class NativeExtensionProvider implements ToolProvider {
   }
 
   async execute(toolId: string, input: unknown, context: ExecutionContext): Promise<ToolResult> {
-    const extension = this.findExtension(toolId);
+    const extension = this.getSnapshot().routes.get(toolId);
+    if (!extension) throw new Error(`unknown native tool '${toolId}'`);
     const definition = await loadExtension(extension);
     const handler = definition.handlers[toolId];
     if (!handler) throw new Error(`no handler for ${toolId}`);
     return handler({ toolName: toolId, logger: context.logger, config: context.config, secrets: context.secrets }, input);
   }
 
-  private findExtension(toolId: string): InstalledExtension {
-    const extension = discoverExtensions(this.home()).find((candidate) =>
-      candidate.manifest.tools.some((tool) => tool.name === toolId),
-    );
-    if (!extension) throw new Error(`unknown native tool '${toolId}'`);
-    return extension;
+  async hasTool(toolId: string): Promise<boolean> {
+    return this.getSnapshot().routes.has(toolId);
+  }
+
+  installedExtensions(): readonly InstalledExtension[] {
+    return this.getSnapshot().extensions;
+  }
+
+  extensionForTool(toolId: string): string | undefined {
+    return this.getSnapshot().routes.get(toolId)?.manifest.id;
+  }
+
+  private getSnapshot(): { extensions: InstalledExtension[]; routes: Map<string, InstalledExtension> } {
+    if (this.snapshot) return this.snapshot;
+    const extensions = this.discover(this.home());
+    const routes = new Map<string, InstalledExtension>();
+    for (const extension of extensions) {
+      for (const tool of extension.manifest.tools) routes.set(tool.name, extension);
+    }
+    this.snapshot = { extensions, routes };
+    return this.snapshot;
   }
 }

package/src/runtime/result.ts

@@ -3,10 +3,17 @@ export interface ToolResult {
   meta?: Record<string, unknown>;
 }
 
-export interface ExecutionResult {
-  ok: boolean;
+export interface ExecutionOk {
+  ok: true;
   toolId: string;
-  output?: unknown;
-  meta?: Record<string, unknown>;
-  error?: { code: string; message: string; details?: unknown };
+  output: unknown;
+  meta: Record<string, unknown>;
 }
+
+export interface ExecutionError {
+  ok: false;
+  toolId: string;
+  error: { code: string; message: string; details?: unknown };
+}
+
+export type ExecutionResult = ExecutionOk | ExecutionError;

package/src/runtime/runtime.ts

@@ -1,4 +1,4 @@
-import type { ExecutionContext, ToolDescriptor, ToolProvider, ToolSearchResult } from "./provider";
+import type { ExecutionContext, ProviderStatus, ToolDescriptor, ToolProvider, ToolSearchOptions, ToolSearchResult } from "./provider";
 import type { ExecutionResult } from "./result";
 import { executeRuntimeTool, type CreateExecutionContext, type PolicyPreflight } from "./executor";
 import { RuntimeError } from "./errors";
@@ -20,23 +20,30 @@ interface RuntimeState {
 
 export class ToolRuntime {
   private closePromise?: Promise<void>;
+  private readonly discovery = new Map<string, Promise<void>>();
+  private readonly statuses = new Map<string, ProviderStatus>();
+  private readonly closedProviders = new Set<string>();
 
   constructor(private readonly state: RuntimeState, private readonly registeredProviders: readonly ToolProvider[] = []) {}
 
-  search(query: string): Promise<ToolSearchResult[]> {
-    return Promise.resolve(this.state.tools.search(query));
+  async search(query: string, options?: ToolSearchOptions): Promise<ToolSearchResult[]> {
+    await this.discoverAll();
+    return this.state.tools.search(query, options);
   }
 
-  describe(toolId: string): Promise<ToolDescriptor> {
+  async describe(toolId: string): Promise<ToolDescriptor> {
+    await this.discoverForTarget(toolId);
     const descriptor = this.state.tools.get(toolId);
-    if (!descriptor) return Promise.reject(new RuntimeError("TOOL_NOT_FOUND", `unknown tool '${toolId}'`));
-    return Promise.resolve(descriptor);
+    if (!descriptor) throw this.targetError(toolId);
+    return descriptor;
   }
 
   async run(toolId: string, input: unknown): Promise<ExecutionResult> {
+    await this.discoverForTarget(toolId);
     const descriptor = this.state.tools.get(toolId);
     if (!descriptor) {
-      return { ok: false, toolId, error: { code: "TOOL_NOT_FOUND", message: `unknown tool '${toolId}'` } };
+      const error = this.targetError(toolId);
+      return { ok: false, toolId, error: { code: error.code, message: error.message } };
     }
     const provider = this.state.providers.require(descriptor.provider.id);
     return executeRuntimeTool({
@@ -47,32 +54,45 @@ export class ToolRuntime {
     }, (input ?? {}) as Record<string, unknown>);
   }
 
+  providerStatuses(): readonly ProviderStatus[] {
+    return [...this.statuses.values()].sort((a, b) => a.id.localeCompare(b.id));
+  }
+
   close(): Promise<void> {
     if (this.closePromise) return this.closePromise;
     this.closePromise = (async () => {
       const errors: unknown[] = [];
       for (const provider of [...this.registeredProviders].reverse()) {
-        if (!provider.close) continue;
-        try { await provider.close(); } catch (error) { errors.push(error); }
+        try { await this.closeProvider(provider); } catch (error) { errors.push(error); }
       }
       if (errors.length > 0) throw errors[0];
     })();
     return this.closePromise;
   }
-}
 
-async function closeProviders(providers: readonly ToolProvider[]): Promise<void> {
-  await Promise.allSettled([...providers].reverse().map(async (provider) => {
-    if (provider.close) await provider.close();
-  }));
-}
+  private async discoverAll(): Promise<void> {
+    await Promise.all(this.registeredProviders.map((provider) => this.discoverProvider(provider)));
+  }
 
-export async function createToolRuntime(options: ToolRuntimeOptions): Promise<ToolRuntime> {
-  const providers = new ProviderRegistry();
-  const tools = new ToolRegistry();
-  try {
-    for (const provider of options.providers) {
-      providers.register(provider);
+  private async discoverForTarget(toolId: string): Promise<void> {
+    const nativeProviders = this.registeredProviders.filter((provider) => provider.kind === "native");
+    await Promise.all(nativeProviders.map((provider) => this.discoverProvider(provider)));
+    if (this.state.tools.get(toolId)) return;
+    await Promise.all(this.registeredProviders
+      .filter((provider) => provider.kind !== "native")
+      .map((provider) => this.discoverProvider(provider)));
+  }
+
+  private discoverProvider(provider: ToolProvider): Promise<void> {
+    const current = this.discovery.get(provider.id);
+    if (current) return current;
+    const promise = this.discoverProviderOnce(provider);
+    this.discovery.set(provider.id, promise);
+    return promise;
+  }
+
+  private async discoverProviderOnce(provider: ToolProvider): Promise<void> {
+    try {
       const descriptors = await provider.listTools();
       for (const descriptor of descriptors) {
         if (descriptor.provider.id !== provider.id || descriptor.provider.kind !== provider.kind) {
@@ -82,12 +102,46 @@ export async function createToolRuntime(options: ToolRuntimeOptions): Promise<To
           );
         }
       }
-      tools.register(descriptors);
+      this.state.tools.register(descriptors);
+      this.statuses.set(provider.id, {
+        id: provider.id,
+        kind: provider.kind,
+        status: "available",
+        ...("namespace" in provider && typeof provider.namespace === "string" ? { namespace: provider.namespace } : {}),
+      });
+    } catch (error) {
+      if (provider.kind !== "mcp") throw error;
+      const typed = error as { code?: unknown; message?: unknown };
+      this.statuses.set(provider.id, {
+        id: provider.id,
+        kind: provider.kind,
+        status: "unavailable",
+        ...("namespace" in provider && typeof provider.namespace === "string" ? { namespace: provider.namespace } : {}),
+        code: typeof typed.code === "string" ? typed.code : "PROVIDER_UNAVAILABLE",
+        message: typeof typed.message === "string" ? typed.message : "provider discovery failed",
+      });
+      try { await this.closeProvider(provider); } catch { /* preserve discovery status */ }
     }
-  } catch (error) {
-    await closeProviders(options.providers);
-    throw error;
   }
+
+  private targetError(toolId: string): RuntimeError {
+    const unavailable = this.providerStatuses().find((status) =>
+      status.status === "unavailable" && status.namespace !== undefined && toolId.startsWith(`${status.namespace}.`));
+    if (unavailable) return new RuntimeError("PROVIDER_UNAVAILABLE", `provider '${unavailable.id}' is unavailable`);
+    return new RuntimeError("TOOL_NOT_FOUND", `unknown tool '${toolId}'`);
+  }
+
+  private async closeProvider(provider: ToolProvider): Promise<void> {
+    if (!provider.close || this.closedProviders.has(provider.id)) return;
+    this.closedProviders.add(provider.id);
+    await provider.close();
+  }
+}
+
+export async function createToolRuntime(options: ToolRuntimeOptions): Promise<ToolRuntime> {
+  const providers = new ProviderRegistry();
+  const tools = new ToolRegistry();
+  for (const provider of options.providers) providers.register(provider);
   return new ToolRuntime({
     providers,
     tools,

package/src/runtime/tool-registry.ts

@@ -1,9 +1,12 @@
-import type { ToolDescriptor, ToolSearchResult } from "./provider";
+import type { ToolDescriptor, ToolSearchOptions, ToolSearchResult } from "./provider";
 import { RuntimeError } from "./errors";
 
 const NAME_WEIGHT = 3;
 const KEYWORD_WEIGHT = 2;
 const DESCRIPTION_WEIGHT = 1;
+const EXACT_BOOST = 4;
+const PREFIX_BOOST = 2;
+const MAX_SEARCH_RESULTS = 100;
 
 export class ToolRegistry {
   private readonly tools = new Map<string, ToolDescriptor>();
@@ -25,13 +28,17 @@ export class ToolRegistry {
     return this.tools.get(toolId);
   }
 
-  search(query: string): ToolSearchResult[] {
+  search(query: string, options: ToolSearchOptions = {}): ToolSearchResult[] {
     const tokens = query.toLowerCase().split(/\s+/).filter(Boolean);
     if (tokens.length === 0) return [];
     return [...this.tools.values()]
+      .filter((descriptor) => options.provider === undefined || descriptor.provider.id === options.provider)
+      .filter((descriptor) => options.source === undefined || descriptor.source.id === options.source)
+      .filter((descriptor) => options.risk === undefined || descriptor.risk === options.risk)
       .map((descriptor) => ({ descriptor, score: this.score(descriptor, tokens) }))
       .filter((hit) => hit.score > 0)
-      .sort((a, b) => b.score - a.score)
+      .sort((a, b) => b.score - a.score || a.descriptor.id.localeCompare(b.descriptor.id))
+      .slice(0, Math.min(Math.max(Math.trunc(options.limit ?? MAX_SEARCH_RESULTS), 1), MAX_SEARCH_RESULTS))
       .map(({ descriptor }) => {
         const { inputSchema: _inputSchema, ...summary } = descriptor;
         return summary;
@@ -43,12 +50,20 @@ export class ToolRegistry {
     const description = descriptor.description.toLowerCase();
     const keywords = (descriptor.keywords ?? []).map((keyword) => keyword.toLowerCase());
     return tokens.reduce((score, token) => {
-      if (id.includes(token)) return score + NAME_WEIGHT;
-      if (keywords.some((keyword) => keyword.includes(token) || token.includes(keyword))) {
-        return score + KEYWORD_WEIGHT;
-      }
-      if (description.includes(token)) return score + DESCRIPTION_WEIGHT;
+      const idScore = matchWeight(id, token, NAME_WEIGHT);
+      if (idScore > 0) return score + idScore;
+      const keywordScore = Math.max(0, ...keywords.map((keyword) => matchWeight(keyword, token, KEYWORD_WEIGHT)));
+      if (keywordScore > 0) return score + keywordScore;
+      const descriptionScore = matchWeight(description, token, DESCRIPTION_WEIGHT);
+      if (descriptionScore > 0) return score + descriptionScore;
       return score;
     }, 0);
   }
 }
+
+function matchWeight(value: string, token: string, base: number): number {
+  if (value === token) return base + EXACT_BOOST;
+  if (value.startsWith(token)) return base + PREFIX_BOOST;
+  if (value.includes(token) || token.includes(value)) return base;
+  return 0;
+}

package/src/version.ts

@@ -1 +1 @@
-export const VERSION = "0.3.2";
+export const VERSION = "0.3.4";

package/src/core/executor.ts

@@ -1,99 +0,0 @@
-import type { Logger, SecretStore, ToolContext, ToolResult } from "@oh-my-tool/sdk";
-import { ToolError } from "@oh-my-tool/sdk";
-import type { Config } from "../config/config";
-import { getConnectionConfig, sanitizeExtensionConnections } from "../config/config";
-import { resolveTool, OmtError, type Registry } from "./registry";
-import { validateInput, type Schema } from "./schema";
-import { validateConnectionInput, applyLimits, PolicyError } from "../policy/policy";
-import { loadExtension } from "../extension/loader";
-import type { OmtResult } from "./result";
-
-const noopLogger: Logger = {
-  debug: () => {},
-  info: () => {},
-  warn: () => {},
-  error: () => {},
-};
-
-export interface ExecutorDeps {
-  registry: Registry;
-  config: Config;
-  secrets: SecretStore;
-  logger?: Logger;
-}
-
-function hasConnection(schema: Schema | undefined): boolean {
-  return Boolean(schema?.properties && "connection" in schema.properties);
-}
-
-export async function executeTool(
-  deps: ExecutorDeps,
-  toolName: string,
-  rawInput: Record<string, unknown>,
-): Promise<OmtResult> {
-  const started = Date.now();
-  try {
-    const { extension, tool } = resolveTool(deps.registry, toolName);
-    const schema = tool.inputSchema as Schema | undefined;
-
-    const limits = applyLimits(rawInput);
-    const normalized = { ...rawInput, maxRows: limits.maxRows, timeoutMs: limits.timeoutMs };
-
-    const needsConnection = hasConnection(schema) || "connection" in normalized;
-    if (needsConnection) {
-      validateConnectionInput(normalized, deps.config, extension.id);
-    }
-
-    const input = validateInput(schema, normalized);
-
-    const connectionCfg = needsConnection
-      ? getConnectionConfig(deps.config, extension.id, String(input.connection))
-      : undefined;
-
-    const ctx: ToolContext = {
-      toolName,
-      logger: deps.logger ?? noopLogger,
-      config: (connectionCfg ?? { connections: sanitizeExtensionConnections(deps.config)[extension.id] ?? {} }) as Record<string, unknown>,
-      secrets: deps.secrets,
-    };
-
-    const def = await loadExtension(extension);
-    const handler = def.handlers[toolName];
-    if (!handler) {
-      throw new OmtError("HANDLER_MISSING", `no handler for ${toolName}`);
-    }
-
-    const result: ToolResult = await handler(ctx, input);
-    const durationMs = Date.now() - started;
-    return {
-      ok: true,
-      tool: toolName,
-      data: result.data,
-      meta: { durationMs, ...(result.meta ?? {}) },
-    };
-  } catch (e) {
-    const durationMs = Date.now() - started;
-    if (e instanceof PolicyError) {
-      return { ok: false, tool: toolName, error: { code: "POLICY_VIOLATION", message: e.message } };
-    }
-    if (e instanceof ToolError) {
-      return { ok: false, tool: toolName, error: { code: e.code, message: e.message } };
-    }
-    if (e instanceof OmtError) {
-      return { ok: false, tool: toolName, error: { code: e.code, message: e.message } };
-    }
-    if (e && typeof e === "object" && "code" in e && typeof (e as { code?: unknown }).code === "string") {
-      return {
-        ok: false,
-        tool: toolName,
-        error: { code: (e as { code: string }).code, message: e instanceof Error ? e.message : String(e) },
-      };
-    }
-    return {
-      ok: false,
-      tool: toolName,
-      error: { code: "EXECUTION_FAILED", message: e instanceof Error ? e.message : String(e) },
-    };
-  }
-}
-

package/src/core/registry.ts

@@ -1,33 +0,0 @@
-import type { ExtensionManifest } from "@oh-my-tool/sdk";
-import type { InstalledExtension } from "../extension/discovery";
-
-import { RuntimeError as OmtError } from "../runtime/errors";
-export { OmtError };
-
-export interface Registry {
-  byTool: Map<string, { extension: InstalledExtension; tool: ExtensionManifest["tools"][number] }>;
-  byId: Map<string, InstalledExtension>;
-}
-
-export function createRegistry(installed: InstalledExtension[]): Registry {
-  const byTool = new Map();
-  const byId = new Map();
-  for (const ext of installed) {
-    byId.set(ext.id, ext);
-    for (const tool of ext.manifest.tools) {
-      byTool.set(tool.name, { extension: ext, tool });
-    }
-  }
-  return { byTool, byId };
-}
-
-export function resolveTool(
-  reg: Registry,
-  toolName: string,
-): { extension: InstalledExtension; tool: ExtensionManifest["tools"][number] } {
-  const hit = reg.byTool.get(toolName);
-  if (!hit) {
-    throw new OmtError("UNKNOWN_TOOL", `unknown tool '${toolName}'`);
-  }
-  return hit;
-}

package/src/core/result.ts

@@ -1,14 +0,0 @@
-export interface OmtOk {
-  ok: true;
-  tool: string;
-  data: unknown;
-  meta: Record<string, unknown>;
-}
-
-export interface OmtErr {
-  ok: false;
-  tool: string;
-  error: { code: string; message: string; details?: unknown };
-}
-
-export type OmtResult = OmtOk | OmtErr;

package/src/core/schema.ts

@@ -1,2 +0,0 @@
-export { validateInput } from "../runtime/schema";
-export type { Schema } from "../runtime/schema";

package/src/search/search.ts

@@ -1,78 +0,0 @@
-import type { ExtensionManifest } from "@oh-my-tool/sdk";
-
-export interface SearchHit {
-  name: string;
-  description: string;
-  extension: string;
-  risk: string;
-  score: number;
-}
-
-interface Searchable {
-  name: string;
-  description: string;
-  keywords: string[];
-  risk: string;
-  extension: string;
-  extName: string;
-}
-
-const NAME_WEIGHT = 3;
-const KEYWORD_WEIGHT = 2;
-const DESC_WEIGHT = 1;
-
-function toSearchable(ext: ExtensionManifest) {
-  const out: Searchable[] = [];
-  for (const tool of ext.tools) {
-    out.push({
-      name: tool.name.toLowerCase(),
-      description: tool.description.toLowerCase(),
-      keywords: (tool.keywords ?? []).map((k) => k.toLowerCase()),
-      risk: tool.risk ?? "read",
-      extension: ext.id,
-      extName: ext.name.toLowerCase(),
-    });
-  }
-  return out;
-}
-
-function bestWeight(s: Searchable, token: string): number {
-  if (s.name.includes(token)) return NAME_WEIGHT;
-  if (s.extName.includes(token)) return NAME_WEIGHT;
-  if (s.keywords.some((k) => k.includes(token) || token.includes(k))) {
-    return KEYWORD_WEIGHT;
-  }
-  if (s.description.includes(token)) return DESC_WEIGHT;
-  return 0;
-}
-
-export function searchTools(query: string, manifests: ExtensionManifest[]): SearchHit[] {
-  const tokens = query
-    .toLowerCase()
-    .split(/\s+/)
-    .filter((t) => t.length > 0);
-
-  if (tokens.length === 0) return [];
-
-  const hits: SearchHit[] = [];
-  for (const ext of manifests) {
-    for (const s of toSearchable(ext)) {
-      let score = 0;
-      for (const token of tokens) {
-        score += bestWeight(s, token);
-      }
-      if (score > 0) {
-        hits.push({
-          name: s.name,
-          description: s.description,
-          extension: s.extension,
-          risk: s.risk,
-          score,
-        });
-      }
-    }
-  }
-
-  hits.sort((a, b) => b.score - a.score);
-  return hits;
-}