@probelabs/visor 0.1.132 → 0.1.137

package/dist/sdk/{chunk-BOGVSF57.mjs → chunk-J6F5K5EG.mjs}

@@ -28,7 +28,18 @@ import {
 import {
   config_exports,
   init_config
-} from "./chunk-U3BLLEW3.mjs";
+} from "./chunk-KPRFDKQX.mjs";
+import {
+  ScheduleStore,
+  buildScheduleToolContext,
+  getScheduleToolDefinition,
+  handleScheduleAction,
+  init_schedule_parser,
+  init_schedule_store,
+  init_schedule_tool,
+  init_store,
+  isScheduleTool
+} from "./chunk-XKCER23W.mjs";
 import {
   ExecutionJournal,
   checkLoopBudget,
@@ -37,11 +48,11 @@ import {
   init_routing,
   init_snapshot_store,
   snapshot_store_exports
-} from "./chunk-UBDHAGYY.mjs";
+} from "./chunk-UMFEBYCN.mjs";
 import {
   FailureConditionEvaluator,
   init_failure_condition_evaluator
-} from "./chunk-FAKITJ3J.mjs";
+} from "./chunk-YTAGJZHN.mjs";
 import {
   addEvent,
   emitNdjsonFallback,
@@ -52,7 +63,7 @@ import {
   setSpanAttributes,
   trace_helpers_exports,
   withActiveSpan
-} from "./chunk-LMJNI6RM.mjs";
+} from "./chunk-ALB3N4ZQ.mjs";
 import {
   addDiagramBlock,
   init_metrics
@@ -60,7 +71,7 @@ import {
 import {
   createExtendedLiquid,
   init_liquid_extensions
-} from "./chunk-XJQKTK6V.mjs";
+} from "./chunk-ZUEQNCKB.mjs";
 import {
   createPermissionHelpers,
   detectLocalMode,
@@ -69,9 +80,10 @@ import {
 } from "./chunk-25IC7KXZ.mjs";
 import {
   compileAndRun,
+  compileAndRunAsync,
   createSecureSandbox,
   init_sandbox
-} from "./chunk-VF6XIUE4.mjs";
+} from "./chunk-LW3INISN.mjs";
 import {
   MemoryStore,
   init_memory_store,
@@ -116,7 +128,7 @@ async function processDiffWithOutline(diffContent) {
   }
   try {
     const originalProbePath = process.env.PROBE_PATH;
-    const fs11 = __require("fs");
+    const fs10 = __require("fs");
     const possiblePaths = [
       // Relative to current working directory (most common in production)
       path.join(process.cwd(), "node_modules/@probelabs/probe/bin/probe-binary"),
@@ -127,7 +139,7 @@ async function processDiffWithOutline(diffContent) {
     ];
     let probeBinaryPath;
     for (const candidatePath of possiblePaths) {
-      if (fs11.existsSync(candidatePath)) {
+      if (fs10.existsSync(candidatePath)) {
         probeBinaryPath = candidatePath;
         break;
       }
@@ -1210,8 +1222,8 @@ ${schemaString}`);
           }
           if (process.env.VISOR_DEBUG_AI_SESSIONS === "true") {
             try {
-              const fs11 = __require("fs");
-              const path14 = __require("path");
+              const fs10 = __require("fs");
+              const path13 = __require("path");
               const timestamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
               const provider = this.config.provider || "auto";
               const model = this.config.model || "default";
@@ -1325,20 +1337,20 @@ ${"=".repeat(60)}
 `;
               readableVersion += `${"=".repeat(60)}
 `;
-              const debugArtifactsDir = process.env.VISOR_DEBUG_ARTIFACTS || path14.join(process.cwd(), "debug-artifacts");
-              if (!fs11.existsSync(debugArtifactsDir)) {
-                fs11.mkdirSync(debugArtifactsDir, { recursive: true });
+              const debugArtifactsDir = process.env.VISOR_DEBUG_ARTIFACTS || path13.join(process.cwd(), "debug-artifacts");
+              if (!fs10.existsSync(debugArtifactsDir)) {
+                fs10.mkdirSync(debugArtifactsDir, { recursive: true });
               }
-              const debugFile = path14.join(
+              const debugFile = path13.join(
                 debugArtifactsDir,
                 `prompt-${_checkName || "unknown"}-${timestamp}.json`
               );
-              fs11.writeFileSync(debugFile, debugJson, "utf-8");
-              const readableFile = path14.join(
+              fs10.writeFileSync(debugFile, debugJson, "utf-8");
+              const readableFile = path13.join(
                 debugArtifactsDir,
                 `prompt-${_checkName || "unknown"}-${timestamp}.txt`
               );
-              fs11.writeFileSync(readableFile, readableVersion, "utf-8");
+              fs10.writeFileSync(readableFile, readableVersion, "utf-8");
               log(`
 \u{1F4BE} Full debug info saved to:`);
               log(`   JSON: ${debugFile}`);
@@ -1371,8 +1383,8 @@ ${"=".repeat(60)}
           log(`\u{1F4E4} Response length: ${response.length} characters`);
           if (process.env.VISOR_DEBUG_AI_SESSIONS === "true") {
             try {
-              const fs11 = __require("fs");
-              const path14 = __require("path");
+              const fs10 = __require("fs");
+              const path13 = __require("path");
               const timestamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
               const agentAny2 = agent;
               let fullHistory = [];
@@ -1383,8 +1395,8 @@ ${"=".repeat(60)}
               } else if (agentAny2._messages) {
                 fullHistory = agentAny2._messages;
               }
-              const debugArtifactsDir = process.env.VISOR_DEBUG_ARTIFACTS || path14.join(process.cwd(), "debug-artifacts");
-              const sessionBase = path14.join(
+              const debugArtifactsDir = process.env.VISOR_DEBUG_ARTIFACTS || path13.join(process.cwd(), "debug-artifacts");
+              const sessionBase = path13.join(
                 debugArtifactsDir,
                 `session-${_checkName || "unknown"}-${timestamp}`
               );
@@ -1396,7 +1408,7 @@ ${"=".repeat(60)}
                 schema: effectiveSchema,
                 totalMessages: fullHistory.length
               };
-              fs11.writeFileSync(sessionBase + ".json", JSON.stringify(sessionData, null, 2), "utf-8");
+              fs10.writeFileSync(sessionBase + ".json", JSON.stringify(sessionData, null, 2), "utf-8");
               let readable = `=============================================================
 `;
               readable += `COMPLETE AI SESSION HISTORY (AFTER RESPONSE)
@@ -1423,7 +1435,7 @@ ${"=".repeat(60)}
 `;
                 readable += content + "\n";
               });
-              fs11.writeFileSync(sessionBase + ".summary.txt", readable, "utf-8");
+              fs10.writeFileSync(sessionBase + ".summary.txt", readable, "utf-8");
               log(`\u{1F4BE} Complete session history saved:`);
               log(`   - Contains ALL ${fullHistory.length} messages (prompts + responses)`);
             } catch (error) {
@@ -1432,11 +1444,11 @@ ${"=".repeat(60)}
           }
           if (process.env.VISOR_DEBUG_AI_SESSIONS === "true") {
             try {
-              const fs11 = __require("fs");
-              const path14 = __require("path");
+              const fs10 = __require("fs");
+              const path13 = __require("path");
               const timestamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
-              const debugArtifactsDir = process.env.VISOR_DEBUG_ARTIFACTS || path14.join(process.cwd(), "debug-artifacts");
-              const responseFile = path14.join(
+              const debugArtifactsDir = process.env.VISOR_DEBUG_ARTIFACTS || path13.join(process.cwd(), "debug-artifacts");
+              const responseFile = path13.join(
                 debugArtifactsDir,
                 `response-${_checkName || "unknown"}-${timestamp}.txt`
               );
@@ -1469,7 +1481,7 @@ ${"=".repeat(60)}
 `;
               responseContent += `${"=".repeat(60)}
 `;
-              fs11.writeFileSync(responseFile, responseContent, "utf-8");
+              fs10.writeFileSync(responseFile, responseContent, "utf-8");
               log(`\u{1F4BE} Response saved to: ${responseFile}`);
             } catch (error) {
               log(`\u26A0\uFE0F Could not save response file: ${error}`);
@@ -1485,9 +1497,9 @@ ${"=".repeat(60)}
                 await agentAny._telemetryConfig.shutdown();
                 log(`\u{1F4CA} OpenTelemetry trace saved to: ${agentAny._traceFilePath}`);
                 if (process.env.GITHUB_ACTIONS) {
-                  const fs11 = __require("fs");
-                  if (fs11.existsSync(agentAny._traceFilePath)) {
-                    const stats = fs11.statSync(agentAny._traceFilePath);
+                  const fs10 = __require("fs");
+                  if (fs10.existsSync(agentAny._traceFilePath)) {
+                    const stats = fs10.statSync(agentAny._traceFilePath);
                     console.log(
                       `::notice title=AI Trace Saved::${agentAny._traceFilePath} (${stats.size} bytes)`
                     );
@@ -1688,8 +1700,8 @@ ${schemaString}`);
           const model = this.config.model || "default";
           if (process.env.VISOR_DEBUG_AI_SESSIONS === "true") {
             try {
-              const fs11 = __require("fs");
-              const path14 = __require("path");
+              const fs10 = __require("fs");
+              const path13 = __require("path");
               const os = __require("os");
               const timestamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
               const debugData = {
@@ -1763,18 +1775,18 @@ ${"=".repeat(60)}
               readableVersion += `${"=".repeat(60)}
 `;
               const tempDir = os.tmpdir();
-              const promptFile = path14.join(tempDir, `visor-prompt-${timestamp}.txt`);
-              fs11.writeFileSync(promptFile, prompt, "utf-8");
+              const promptFile = path13.join(tempDir, `visor-prompt-${timestamp}.txt`);
+              fs10.writeFileSync(promptFile, prompt, "utf-8");
               log(`
 \u{1F4BE} Prompt saved to: ${promptFile}`);
-              const debugArtifactsDir = process.env.VISOR_DEBUG_ARTIFACTS || path14.join(process.cwd(), "debug-artifacts");
+              const debugArtifactsDir = process.env.VISOR_DEBUG_ARTIFACTS || path13.join(process.cwd(), "debug-artifacts");
               try {
-                const base = path14.join(
+                const base = path13.join(
                   debugArtifactsDir,
                   `prompt-${_checkName || "unknown"}-${timestamp}`
                 );
-                fs11.writeFileSync(base + ".json", debugJson, "utf-8");
-                fs11.writeFileSync(base + ".summary.txt", readableVersion, "utf-8");
+                fs10.writeFileSync(base + ".json", debugJson, "utf-8");
+                fs10.writeFileSync(base + ".summary.txt", readableVersion, "utf-8");
                 log(`
 \u{1F4BE} Full debug info saved to directory: ${debugArtifactsDir}`);
               } catch {
@@ -1819,8 +1831,8 @@ $ ${cliCommand}
           log(`\u{1F4E4} Response length: ${response.length} characters`);
           if (process.env.VISOR_DEBUG_AI_SESSIONS === "true") {
             try {
-              const fs11 = __require("fs");
-              const path14 = __require("path");
+              const fs10 = __require("fs");
+              const path13 = __require("path");
               const timestamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
               const agentAny = agent;
               let fullHistory = [];
@@ -1831,8 +1843,8 @@ $ ${cliCommand}
               } else if (agentAny._messages) {
                 fullHistory = agentAny._messages;
               }
-              const debugArtifactsDir = process.env.VISOR_DEBUG_ARTIFACTS || path14.join(process.cwd(), "debug-artifacts");
-              const sessionBase = path14.join(
+              const debugArtifactsDir = process.env.VISOR_DEBUG_ARTIFACTS || path13.join(process.cwd(), "debug-artifacts");
+              const sessionBase = path13.join(
                 debugArtifactsDir,
                 `session-${_checkName || "unknown"}-${timestamp}`
               );
@@ -1844,7 +1856,7 @@ $ ${cliCommand}
                 schema: effectiveSchema,
                 totalMessages: fullHistory.length
               };
-              fs11.writeFileSync(sessionBase + ".json", JSON.stringify(sessionData, null, 2), "utf-8");
+              fs10.writeFileSync(sessionBase + ".json", JSON.stringify(sessionData, null, 2), "utf-8");
               let readable = `=============================================================
 `;
               readable += `COMPLETE AI SESSION HISTORY (AFTER RESPONSE)
@@ -1871,7 +1883,7 @@ ${"=".repeat(60)}
 `;
                 readable += content + "\n";
               });
-              fs11.writeFileSync(sessionBase + ".summary.txt", readable, "utf-8");
+              fs10.writeFileSync(sessionBase + ".summary.txt", readable, "utf-8");
               log(`\u{1F4BE} Complete session history saved:`);
               log(`   - Contains ALL ${fullHistory.length} messages (prompts + responses)`);
             } catch (error) {
@@ -1880,11 +1892,11 @@ ${"=".repeat(60)}
           }
           if (process.env.VISOR_DEBUG_AI_SESSIONS === "true") {
             try {
-              const fs11 = __require("fs");
-              const path14 = __require("path");
+              const fs10 = __require("fs");
+              const path13 = __require("path");
               const timestamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
-              const debugArtifactsDir = process.env.VISOR_DEBUG_ARTIFACTS || path14.join(process.cwd(), "debug-artifacts");
-              const responseFile = path14.join(
+              const debugArtifactsDir = process.env.VISOR_DEBUG_ARTIFACTS || path13.join(process.cwd(), "debug-artifacts");
+              const responseFile = path13.join(
                 debugArtifactsDir,
                 `response-${_checkName || "unknown"}-${timestamp}.txt`
               );
@@ -1917,7 +1929,7 @@ ${"=".repeat(60)}
 `;
               responseContent += `${"=".repeat(60)}
 `;
-              fs11.writeFileSync(responseFile, responseContent, "utf-8");
+              fs10.writeFileSync(responseFile, responseContent, "utf-8");
               log(`\u{1F4BE} Response saved to: ${responseFile}`);
             } catch (error) {
               log(`\u26A0\uFE0F Could not save response file: ${error}`);
@@ -1935,9 +1947,9 @@ ${"=".repeat(60)}
                 await telemetry.shutdown();
                 log(`\u{1F4CA} OpenTelemetry trace saved to: ${traceFilePath}`);
                 if (process.env.GITHUB_ACTIONS) {
-                  const fs11 = __require("fs");
-                  if (fs11.existsSync(traceFilePath)) {
-                    const stats = fs11.statSync(traceFilePath);
+                  const fs10 = __require("fs");
+                  if (fs10.existsSync(traceFilePath)) {
+                    const stats = fs10.statSync(traceFilePath);
                     console.log(
                       `::notice title=AI Trace Saved::OpenTelemetry trace file size: ${stats.size} bytes`
                     );
@@ -1975,8 +1987,8 @@ ${"=".repeat(60)}
        * Load schema content from schema files or inline definitions
        */
       async loadSchemaContent(schema) {
-        const fs11 = __require("fs").promises;
-        const path14 = __require("path");
+        const fs10 = __require("fs").promises;
+        const path13 = __require("path");
         if (typeof schema === "object" && schema !== null) {
           log("\u{1F4CB} Using inline schema object from configuration");
           return JSON.stringify(schema);
@@ -1989,14 +2001,14 @@ ${"=".repeat(60)}
           }
         } catch {
         }
-        if ((schema.startsWith("./") || schema.includes(".json")) && !path14.isAbsolute(schema)) {
+        if ((schema.startsWith("./") || schema.includes(".json")) && !path13.isAbsolute(schema)) {
           if (schema.includes("..") || schema.includes("\0")) {
             throw new Error("Invalid schema path: path traversal not allowed");
           }
           try {
-            const schemaPath = path14.resolve(process.cwd(), schema);
+            const schemaPath = path13.resolve(process.cwd(), schema);
             log(`\u{1F4CB} Loading custom schema from file: ${schemaPath}`);
-            const schemaContent = await fs11.readFile(schemaPath, "utf-8");
+            const schemaContent = await fs10.readFile(schemaPath, "utf-8");
             return schemaContent.trim();
           } catch (error) {
             throw new Error(
@@ -2010,22 +2022,22 @@ ${"=".repeat(60)}
         }
         const candidatePaths = [
           // GitHub Action bundle location
-          path14.join(__dirname, "output", sanitizedSchemaName, "schema.json"),
+          path13.join(__dirname, "output", sanitizedSchemaName, "schema.json"),
           // Historical fallback when src/output was inadvertently bundled as output1/
-          path14.join(__dirname, "output1", sanitizedSchemaName, "schema.json"),
+          path13.join(__dirname, "output1", sanitizedSchemaName, "schema.json"),
           // Local dev (repo root)
-          path14.join(process.cwd(), "output", sanitizedSchemaName, "schema.json")
+          path13.join(process.cwd(), "output", sanitizedSchemaName, "schema.json")
         ];
         for (const schemaPath of candidatePaths) {
           try {
-            const schemaContent = await fs11.readFile(schemaPath, "utf-8");
+            const schemaContent = await fs10.readFile(schemaPath, "utf-8");
             return schemaContent.trim();
           } catch {
           }
         }
-        const distPath = path14.join(__dirname, "output", sanitizedSchemaName, "schema.json");
-        const distAltPath = path14.join(__dirname, "output1", sanitizedSchemaName, "schema.json");
-        const cwdPath = path14.join(process.cwd(), "output", sanitizedSchemaName, "schema.json");
+        const distPath = path13.join(__dirname, "output", sanitizedSchemaName, "schema.json");
+        const distAltPath = path13.join(__dirname, "output1", sanitizedSchemaName, "schema.json");
+        const cwdPath = path13.join(process.cwd(), "output", sanitizedSchemaName, "schema.json");
         throw new Error(
           `Failed to load schema '${sanitizedSchemaName}'. Tried: ${distPath}, ${distAltPath}, and ${cwdPath}. Ensure build copies 'output/' into dist (build:cli), or provide a custom schema file/path.`
         );
@@ -2787,6 +2799,758 @@ var init_state_capture = __esm({
   }
 });
 
+// src/providers/api-tool-executor.ts
+import fs2 from "fs/promises";
+import path3 from "path";
+import YAML from "js-yaml";
+import SwaggerParser from "@apidevtools/swagger-parser";
+import deepmerge from "deepmerge";
+import { JSONPath } from "jsonpath-plus";
+import { minimatch } from "minimatch";
+function isHttpUrl(value) {
+  return value.startsWith("http://") || value.startsWith("https://");
+}
+function toStringArray(value) {
+  if (!value) return [];
+  if (Array.isArray(value)) {
+    return value.map((item) => String(item).trim()).filter(Boolean);
+  }
+  return value.split(",").map((item) => item.trim()).filter(Boolean);
+}
+function isPlainObject(value) {
+  return Boolean(value && typeof value === "object" && !Array.isArray(value));
+}
+function toOverlaySourceArray(value) {
+  if (!value) return [];
+  if (typeof value === "string" || isPlainObject(value)) {
+    return [value];
+  }
+  if (Array.isArray(value)) {
+    return value.filter((item) => typeof item === "string" || isPlainObject(item));
+  }
+  return [];
+}
+function resolvePathOrUrl(candidate, baseDir) {
+  if (isHttpUrl(candidate)) return candidate;
+  if (path3.isAbsolute(candidate)) return candidate;
+  if (isHttpUrl(baseDir)) {
+    return new URL(candidate, baseDir).toString();
+  }
+  return path3.resolve(baseDir, candidate);
+}
+async function readTextFromPathOrUrl(location) {
+  if (isHttpUrl(location)) {
+    const res = await fetch(location);
+    if (!res.ok) {
+      throw new Error(`Failed to fetch ${location}: ${res.status} ${res.statusText}`);
+    }
+    return await res.text();
+  }
+  return await fs2.readFile(location, "utf8");
+}
+function parseJsonOrYaml(raw, location) {
+  const ext = path3.extname(location).toLowerCase();
+  if (ext === ".yaml" || ext === ".yml") {
+    return YAML.load(raw);
+  }
+  try {
+    return JSON.parse(raw);
+  } catch {
+    return YAML.load(raw);
+  }
+}
+function parseOverlayTargetPath(pathValue) {
+  if (!Array.isArray(pathValue) || pathValue.length === 0) return "$";
+  return pathValue.map((segment, index) => {
+    if (index === 0) return "$";
+    if (typeof segment === "number") return `[${segment}]`;
+    if (/^[A-Za-z_][\w$]*$/.test(segment)) return `.${segment}`;
+    return `['${segment.replace(/'/g, "\\'")}']`;
+  }).join("");
+}
+function applyOverlayActions(target, overlay) {
+  const cloned = JSON.parse(JSON.stringify(target));
+  if (!overlay || typeof overlay !== "object") return cloned;
+  const actions = Array.isArray(overlay.actions) ? overlay.actions : [];
+  if (actions.length === 0) {
+    return deepmerge(cloned, overlay, {
+      arrayMerge: (dst, src) => dst.concat(src)
+    });
+  }
+  for (const action of actions) {
+    const targetExpr = action?.target;
+    if (!targetExpr || typeof targetExpr !== "string") continue;
+    let matches = [];
+    try {
+      matches = JSONPath({
+        path: targetExpr,
+        json: cloned,
+        resultType: "all"
+      });
+    } catch (error) {
+      logger.warn(`[ApiToolExecutor] Invalid overlay target "${targetExpr}": ${error}`);
+      continue;
+    }
+    if (matches.length === 0) {
+      continue;
+    }
+    for (const match of matches) {
+      if (!match || typeof match !== "object") continue;
+      const parent = match.parent;
+      const key = match.parentProperty;
+      if (parent === void 0 || key === void 0) {
+        const jsonPath = parseOverlayTargetPath(
+          match.path || []
+        );
+        logger.debug(`[ApiToolExecutor] Overlay target has no writable parent: ${jsonPath}`);
+        continue;
+      }
+      if (action.remove === true) {
+        if (Array.isArray(parent)) {
+          parent.splice(Number(key), 1);
+        } else if (parent && typeof parent === "object") {
+          delete parent[key];
+        }
+        continue;
+      }
+      if (action.update === void 0) {
+        continue;
+      }
+      const current = match.value;
+      if (Array.isArray(current)) {
+        current.push(action.update);
+      } else if (current && typeof current === "object") {
+        const merged = deepmerge(current, action.update, {
+          arrayMerge: (dst, src) => dst.concat(src)
+        });
+        if (Array.isArray(parent)) {
+          parent[Number(key)] = merged;
+        } else {
+          parent[key] = merged;
+        }
+      } else if (Array.isArray(parent)) {
+        parent[Number(key)] = action.update;
+      } else {
+        parent[key] = action.update;
+      }
+    }
+  }
+  return cloned;
+}
+function isRefObject(value) {
+  return Boolean(value && typeof value === "object" && "$ref" in value);
+}
+function isSchemaObject(value) {
+  return Boolean(
+    value && typeof value === "object" && !Array.isArray(value) && !isRefObject(value)
+  );
+}
+function getSchemaFromContent(content) {
+  if (!content || typeof content !== "object") return void 0;
+  const entries = Object.values(content);
+  const withSchema = entries.find((entry) => entry && typeof entry === "object" && entry.schema);
+  return withSchema?.schema;
+}
+function mapOpenApiTypeToJsonType(schema) {
+  if (!schema || !schema.type) return { type: "string" };
+  const openApiType = String(schema.type);
+  const nullable = schema.nullable === true;
+  switch (openApiType) {
+    case "integer":
+    case "number":
+    case "boolean":
+    case "string":
+    case "array":
+    case "object":
+      return { type: openApiType, format: schema.format, nullable };
+    default:
+      return { type: "string", format: schema.format, nullable };
+  }
+}
+function openApiSchemaToJsonSchema(schema) {
+  if (!schema) {
+    return { type: "string" };
+  }
+  const mapped = mapOpenApiTypeToJsonType(schema);
+  const result = {
+    type: mapped.nullable ? [mapped.type, "null"] : mapped.type
+  };
+  if (mapped.format) result.format = mapped.format;
+  if (schema.description !== void 0) result.description = schema.description;
+  if (schema.default !== void 0) result.default = schema.default;
+  if (schema.enum !== void 0) result.enum = schema.enum;
+  if (schema.example !== void 0) result.example = schema.example;
+  if (schema.minimum !== void 0) result.minimum = schema.minimum;
+  if (schema.maximum !== void 0) result.maximum = schema.maximum;
+  if (schema.minLength !== void 0) result.minLength = schema.minLength;
+  if (schema.maxLength !== void 0) result.maxLength = schema.maxLength;
+  if (schema.pattern !== void 0) result.pattern = schema.pattern;
+  if (schema.multipleOf !== void 0) result.multipleOf = schema.multipleOf;
+  if (schema.minItems !== void 0) result.minItems = schema.minItems;
+  if (schema.maxItems !== void 0) result.maxItems = schema.maxItems;
+  if (schema.uniqueItems !== void 0) result.uniqueItems = schema.uniqueItems;
+  if (schema.type === "object" && schema.properties && typeof schema.properties === "object") {
+    const props = {};
+    for (const [propName, propSchema] of Object.entries(schema.properties)) {
+      if (isSchemaObject(propSchema)) {
+        props[propName] = openApiSchemaToJsonSchema(propSchema);
+      }
+    }
+    result.properties = props;
+    if (Array.isArray(schema.required) && schema.required.length > 0) {
+      result.required = schema.required;
+    }
+    if (schema.additionalProperties === true || schema.additionalProperties === false) {
+      result.additionalProperties = schema.additionalProperties;
+    } else if (isSchemaObject(schema.additionalProperties)) {
+      result.additionalProperties = openApiSchemaToJsonSchema(schema.additionalProperties);
+    }
+  }
+  if (schema.type === "array" && isSchemaObject(schema.items)) {
+    result.items = openApiSchemaToJsonSchema(schema.items);
+  }
+  for (const [key, value] of Object.entries(schema)) {
+    if (key.startsWith("x-")) {
+      result[key] = value;
+    }
+  }
+  return result;
+}
+function shouldIncludeOperation(operationId, pathValue, method, whitelist, blacklist) {
+  const methodPath = `${method.toUpperCase()}:${pathValue}`;
+  const opKey = operationId || methodPath;
+  if (whitelist.length > 0) {
+    return whitelist.some((pattern) => minimatch(opKey, pattern) || minimatch(methodPath, pattern));
+  }
+  if (blacklist.length > 0) {
+    return !blacklist.some((pattern) => minimatch(opKey, pattern) || minimatch(methodPath, pattern));
+  }
+  return true;
+}
+function getApiToolConfig(tool) {
+  return {
+    customHeaders: tool.headers || {},
+    disableXMcp: Boolean(tool.disableXMcp ?? tool.disable_x_mcp ?? false),
+    apiKey: tool.apiKey ?? tool.api_key,
+    securitySchemeName: tool.securitySchemeName ?? tool.security_scheme_name,
+    securityCredentials: tool.securityCredentials || tool.security_credentials || {},
+    requestTimeoutMs: tool.requestTimeoutMs ?? tool.request_timeout_ms ?? tool.timeout ?? 3e4
+  };
+}
+function buildOutputSchema(operation) {
+  const responses = operation.responses;
+  if (!responses || typeof responses !== "object") return void 0;
+  const successCode = Object.keys(responses).find((code) => code.startsWith("2"));
+  if (!successCode) return void 0;
+  const response = responses[successCode];
+  if (!response || typeof response !== "object" || isRefObject(response)) return void 0;
+  const jsonSchema = response.content?.["application/json"]?.schema || getSchemaFromContent(response.content);
+  if (!isSchemaObject(jsonSchema)) return void 0;
+  const mapped = openApiSchemaToJsonSchema(jsonSchema);
+  if (response.description && typeof response.description === "string") {
+    mapped.description = response.description;
+  }
+  return mapped;
+}
+function getToolName(operationId, operation, pathItem, tool) {
+  let toolName = operationId;
+  const opExtension = operation["x-mcp"];
+  const pathExtension = pathItem["x-mcp"];
+  if (opExtension && typeof opExtension === "object" && typeof opExtension.name === "string") {
+    toolName = opExtension.name;
+  } else if (pathExtension && typeof pathExtension === "object" && typeof pathExtension.name === "string") {
+    toolName = pathExtension.name;
+  }
+  const prefix = tool.namePrefix || tool.name_prefix;
+  if (prefix) {
+    return `${prefix}${toolName}`;
+  }
+  return toolName;
+}
+function getToolDescription(operation, pathItem) {
+  const opExtension = operation["x-mcp"];
+  const pathExtension = pathItem["x-mcp"];
+  if (opExtension && typeof opExtension === "object" && typeof opExtension.description === "string") {
+    return opExtension.description;
+  }
+  if (pathExtension && typeof pathExtension === "object" && typeof pathExtension.description === "string") {
+    return pathExtension.description;
+  }
+  return typeof operation.description === "string" && operation.description || typeof operation.summary === "string" && operation.summary || typeof pathItem.summary === "string" && pathItem.summary || "No description available.";
+}
+function isApiToolDefinition(tool) {
+  return Boolean(tool && tool.type === "api");
+}
+async function loadOpenApiDocument(tool) {
+  if (!tool.spec) {
+    throw new Error(`API tool '${tool.name}' is missing required field: spec`);
+  }
+  const configuredBaseDir = tool.__baseDir;
+  const baseDir = (() => {
+    if (tool.cwd) {
+      if (path3.isAbsolute(tool.cwd) || isHttpUrl(tool.cwd)) {
+        return tool.cwd;
+      }
+      if (configuredBaseDir) {
+        return resolvePathOrUrl(tool.cwd, configuredBaseDir);
+      }
+      return path3.resolve(tool.cwd);
+    }
+    return configuredBaseDir || process.cwd();
+  })();
+  const dereferenceWithContext = async (source, spec) => {
+    try {
+      return await SwaggerParser.dereference(spec);
+    } catch (error) {
+      const errorMessage = error instanceof Error ? error.message : String(error);
+      throw new Error(
+        `Failed to dereference OpenAPI spec for API tool '${tool.name}' from ${source}: ${errorMessage}`
+      );
+    }
+  };
+  let openapi;
+  if (typeof tool.spec === "string") {
+    const specLocation = resolvePathOrUrl(tool.spec, baseDir);
+    if (isHttpUrl(specLocation)) {
+      const raw = await readTextFromPathOrUrl(specLocation);
+      const parsed = parseJsonOrYaml(raw, specLocation);
+      openapi = await dereferenceWithContext(specLocation, parsed);
+    } else {
+      openapi = await dereferenceWithContext(specLocation, specLocation);
+    }
+  } else if (isPlainObject(tool.spec)) {
+    openapi = await dereferenceWithContext("inline spec", JSON.parse(JSON.stringify(tool.spec)));
+  } else {
+    throw new Error(
+      `API tool '${tool.name}' has invalid spec field (expected string path/URL or object)`
+    );
+  }
+  const overlays = toOverlaySourceArray(tool.overlays);
+  let working = openapi;
+  for (const overlaySource of overlays) {
+    let overlay = overlaySource;
+    if (typeof overlaySource === "string") {
+      const resolved = resolvePathOrUrl(overlaySource, baseDir);
+      const raw = await readTextFromPathOrUrl(resolved);
+      overlay = parseJsonOrYaml(raw, resolved);
+    }
+    working = applyOverlayActions(working, overlay);
+  }
+  return working;
+}
+function mapOpenApiToTools(openapi, tool) {
+  const paths = openapi?.paths;
+  if (!paths || typeof paths !== "object") {
+    return [];
+  }
+  const targetUrl = tool.targetUrl || tool.target_url;
+  const baseServerUrl = String(targetUrl || openapi?.servers?.[0]?.url || "").replace(/\/$/, "");
+  if (!baseServerUrl) {
+    throw new Error(
+      `API tool '${tool.name}' cannot determine target API URL. Set targetUrl/target_url or provide OpenAPI servers[].`
+    );
+  }
+  const whitelist = toStringArray(tool.whitelist);
+  const blacklist = toStringArray(tool.blacklist);
+  const globalSecurity = Array.isArray(openapi?.security) ? openapi.security : null;
+  const securitySchemes = openapi?.components?.securitySchemes;
+  const mapped = [];
+  const apiToolConfig = getApiToolConfig(tool);
+  for (const [pathValue, pathItemRaw] of Object.entries(paths)) {
+    const pathItem = pathItemRaw;
+    if (!pathItem || typeof pathItem !== "object") continue;
+    for (const [method, operationRaw] of Object.entries(pathItem)) {
+      if (!HTTP_METHODS.has(method.toLowerCase())) continue;
+      const operation = operationRaw;
+      if (!operation || typeof operation !== "object") continue;
+      const operationId = typeof operation.operationId === "string" ? String(operation.operationId) : void 0;
+      if (!operationId) {
+        logger.debug(
+          `[ApiToolExecutor] Skipping ${method.toUpperCase()} ${pathValue} (missing operationId)`
+        );
+        continue;
+      }
+      if (!shouldIncludeOperation(operationId, pathValue, method, whitelist, blacklist)) {
+        continue;
+      }
+      const toolName = getToolName(operationId, operation, pathItem, tool);
+      const toolDescription = getToolDescription(operation, pathItem);
+      const inputSchema = {
+        type: "object",
+        properties: {}
+      };
+      const requiredNames = /* @__PURE__ */ new Set();
+      const allParameters = [
+        ...Array.isArray(pathItem.parameters) ? pathItem.parameters : [],
+        ...Array.isArray(operation.parameters) ? operation.parameters : []
+      ].filter((param) => param && typeof param === "object" && !isRefObject(param));
+      for (const param of allParameters) {
+        const paramObj = param;
+        const paramName = typeof paramObj.name === "string" ? paramObj.name : "";
+        if (!paramName) continue;
+        if (!isSchemaObject(paramObj.schema)) continue;
+        const schema = openApiSchemaToJsonSchema(paramObj.schema);
+        if (typeof paramObj.description === "string") {
+          schema.description = paramObj.description;
+        }
+        schema["x-parameter-location"] = paramObj.in || "query";
+        if (paramObj.example !== void 0) schema.example = paramObj.example;
+        if (paramObj.deprecated === true) schema.deprecated = true;
+        inputSchema.properties[paramName] = schema;
+        if (paramObj.required === true) requiredNames.add(paramName);
+      }
+      const requestBody = !isRefObject(operation.requestBody) ? operation.requestBody : void 0;
+      if (requestBody && typeof requestBody === "object") {
+        const reqSchema = requestBody.content?.["application/json"]?.schema || getSchemaFromContent(requestBody.content);
+        if (isSchemaObject(reqSchema)) {
+          const bodySchema = openApiSchemaToJsonSchema(reqSchema);
+          if (typeof requestBody.description === "string") {
+            bodySchema.description = requestBody.description;
+          }
+          const contentTypes = Object.keys(requestBody.content || {});
+          if (contentTypes.length > 0) {
+            bodySchema["x-content-types"] = contentTypes;
+          }
+          inputSchema.properties.requestBody = bodySchema;
+          if (requestBody.required === true) {
+            requiredNames.add("requestBody");
+          }
+        }
+      }
+      if (requiredNames.size > 0) {
+        inputSchema.required = Array.from(requiredNames);
+      }
+      const securityRequirements = Array.isArray(operation.security) ? operation.security : globalSecurity;
+      mapped.push({
+        sourceToolName: tool.name,
+        mcpToolDefinition: {
+          name: toolName,
+          description: toolDescription,
+          inputSchema,
+          outputSchema: buildOutputSchema(operation)
+        },
+        apiCallDetails: {
+          method: method.toUpperCase(),
+          pathTemplate: pathValue,
+          serverUrl: baseServerUrl,
+          parameters: allParameters,
+          requestBody,
+          securityRequirements,
+          securitySchemes,
+          apiToolConfig
+        }
+      });
+    }
+  }
+  return mapped;
+}
+function validateParameterValue(value, paramDef) {
+  const schema = paramDef.schema;
+  if (!schema || typeof schema !== "object") return null;
+  const schemaType = schema.type;
+  if (schemaType === "integer") {
+    if (typeof value !== "number" || !Number.isInteger(value)) {
+      return "must be an integer";
+    }
+  } else if (schemaType === "number") {
+    if (typeof value !== "number") {
+      return `expected number, got ${typeof value}`;
+    }
+  } else if (schemaType === "boolean") {
+    if (typeof value !== "boolean") {
+      return `expected boolean, got ${typeof value}`;
+    }
+  } else if (schemaType === "string") {
+    if (typeof value !== "string") {
+      return `expected string, got ${typeof value}`;
+    }
+  } else if (schemaType === "array") {
+    if (!Array.isArray(value)) {
+      return `expected array, got ${typeof value}`;
+    }
+  } else if (schemaType === "object") {
+    if (!value || typeof value !== "object" || Array.isArray(value)) {
+      return `expected object, got ${Array.isArray(value) ? "array" : typeof value}`;
+    }
+  }
+  if (schema.minimum !== void 0 && typeof value === "number" && value < schema.minimum) {
+    return `must be >= ${schema.minimum}`;
+  }
+  if (schema.maximum !== void 0 && typeof value === "number" && value > schema.maximum) {
+    return `must be <= ${schema.maximum}`;
+  }
+  if (schema.minLength !== void 0 && typeof value === "string" && value.length < schema.minLength) {
+    return `length must be >= ${schema.minLength}`;
+  }
+  if (schema.maxLength !== void 0 && typeof value === "string" && value.length > schema.maxLength) {
+    return `length must be <= ${schema.maxLength}`;
+  }
+  if (Array.isArray(schema.enum) && !schema.enum.includes(value)) {
+    return `must be one of: ${schema.enum.join(", ")}`;
+  }
+  return null;
+}
+function applySecurityToRequest(details, headers, queryParams) {
+  const requirements = details.securityRequirements;
+  if (!requirements || requirements.length === 0) {
+    return;
+  }
+  const schemes = details.securitySchemes || {};
+  const cfg = details.apiToolConfig;
+  const tryResolveCredential = (schemeName) => {
+    if (cfg.securityCredentials[schemeName]) {
+      return cfg.securityCredentials[schemeName];
+    }
+    if (cfg.securitySchemeName && cfg.securitySchemeName !== schemeName) {
+      return void 0;
+    }
+    return cfg.apiKey;
+  };
+  for (const requirement of requirements) {
+    const schemeNames = Object.keys(requirement);
+    if (schemeNames.length === 0) return;
+    const tempHeaders = { ...headers };
+    const tempQuery = new URLSearchParams(queryParams);
+    let satisfied = true;
+    for (const schemeName of schemeNames) {
+      const scheme = schemes[schemeName];
+      if (!scheme || typeof scheme !== "object") {
+        satisfied = false;
+        break;
+      }
+      const credential = tryResolveCredential(schemeName);
+      if (!credential) {
+        satisfied = false;
+        break;
+      }
+      switch (scheme.type) {
+        case "apiKey":
+          if (scheme.in === "header") {
+            tempHeaders[String(scheme.name)] = credential;
+          } else if (scheme.in === "query") {
+            tempQuery.set(String(scheme.name), credential);
+          } else if (scheme.in === "cookie") {
+            const cookieName = String(scheme.name);
+            const existing = tempHeaders["Cookie"];
+            tempHeaders["Cookie"] = existing ? `${existing}; ${cookieName}=${credential}` : `${cookieName}=${credential}`;
+          } else {
+            satisfied = false;
+          }
+          break;
+        case "http":
+          if (typeof scheme.scheme !== "string") {
+            satisfied = false;
+            break;
+          }
+          if (scheme.scheme.toLowerCase() === "bearer") {
+            tempHeaders["Authorization"] = `Bearer ${credential}`;
+          } else if (scheme.scheme.toLowerCase() === "basic") {
+            tempHeaders["Authorization"] = `Basic ${Buffer.from(credential).toString("base64")}`;
+          } else {
+            satisfied = false;
+          }
+          break;
+        case "oauth2":
+        case "openIdConnect":
+          tempHeaders["Authorization"] = `Bearer ${credential}`;
+          break;
+        default:
+          satisfied = false;
+      }
+      if (!satisfied) {
+        break;
+      }
+    }
+    if (satisfied) {
+      Object.assign(headers, tempHeaders);
+      queryParams.forEach((_value, key) => queryParams.delete(key));
+      tempQuery.forEach((value, key) => queryParams.append(key, value));
+      return;
+    }
+  }
+}
+function responseBodyToString(body) {
+  if (typeof body === "string") return body;
+  try {
+    return JSON.stringify(body);
+  } catch {
+    return String(body);
+  }
+}
+async function executeMappedApiTool(mappedTool, args) {
+  const { apiCallDetails } = mappedTool;
+  const { method, pathTemplate, serverUrl, parameters, requestBody, apiToolConfig } = apiCallDetails;
+  const urlPath = pathTemplate.replace(/{([^}]+)}/g, (_token, rawName) => {
+    const value = args[rawName];
+    if (value === void 0 || value === null) {
+      return `{${rawName}}`;
+    }
+    return encodeURIComponent(String(value));
+  });
+  if (urlPath.includes("{") || urlPath.includes("}")) {
+    throw new Error(`Missing required path parameters for ${method} ${pathTemplate}`);
+  }
+  let endpoint;
+  try {
+    endpoint = new URL(`${serverUrl}${urlPath}`);
+  } catch (error) {
+    const errorMessage = error instanceof Error ? error.message : String(error);
+    throw new Error(
+      `Failed to construct endpoint URL for API tool '${mappedTool.sourceToolName}' operation '${mappedTool.mcpToolDefinition.name}' (${method} ${pathTemplate}) with serverUrl '${serverUrl}': ${errorMessage}`
+    );
+  }
+  const queryParams = new URLSearchParams(endpoint.search);
+  const headers = { ...apiToolConfig.customHeaders };
+  let requestBodyValue;
+  for (const param of parameters) {
+    const name = String(param.name || "");
+    if (!name) continue;
+    const value = args[name];
+    if (value === void 0 || value === null) {
+      if (param.required) {
+        throw new Error(`Missing required parameter: ${name}`);
+      }
+      continue;
+    }
+    const validationError = validateParameterValue(value, param);
+    if (validationError) {
+      throw new Error(`Parameter '${name}' ${validationError}`);
+    }
+    switch (param.in) {
+      case "query":
+        if (Array.isArray(value)) {
+          for (const item of value) {
+            queryParams.append(name, String(item));
+          }
+        } else {
+          queryParams.set(name, String(value));
+        }
+        break;
+      case "header":
+        headers[name] = String(value);
+        break;
+      case "path":
+        break;
+      case "cookie": {
+        const existing = headers["Cookie"];
+        headers["Cookie"] = existing ? `${existing}; ${name}=${String(value)}` : `${name}=${String(value)}`;
+        break;
+      }
+      default:
+        break;
+    }
+  }
+  if (requestBody && requestBody.required && args.requestBody === void 0) {
+    throw new Error("Missing required requestBody parameter");
+  }
+  if (args.requestBody !== void 0) {
+    requestBodyValue = args.requestBody;
+    if (!headers["Content-Type"]) {
+      headers["Content-Type"] = "application/json";
+    }
+  }
+  if (!apiToolConfig.disableXMcp) {
+    headers["X-MCP"] = "1";
+  }
+  applySecurityToRequest(apiCallDetails, headers, queryParams);
+  endpoint.search = queryParams.toString();
+  const controller = new AbortController();
+  const timeout = setTimeout(() => controller.abort(), apiToolConfig.requestTimeoutMs);
+  try {
+    const response = await fetch(endpoint.toString(), {
+      method,
+      headers,
+      body: requestBodyValue === void 0 ? void 0 : headers["Content-Type"]?.includes("application/json") ? JSON.stringify(requestBodyValue) : String(requestBodyValue),
+      signal: controller.signal
+    });
+    const raw = await response.text();
+    let body = raw;
+    const contentType = response.headers.get("content-type") || "";
+    if (contentType.includes("json") && raw.trim().length > 0) {
+      try {
+        body = JSON.parse(raw);
+      } catch {
+        body = raw;
+      }
+    } else if (raw.trim().length > 0) {
+      try {
+        body = JSON.parse(raw);
+      } catch {
+        body = raw;
+      }
+    } else {
+      body = null;
+    }
+    if (response.ok) {
+      return body;
+    }
+    throw new Error(`API Error ${response.status}: ${responseBodyToString(body)}`);
+  } catch (error) {
+    if (error instanceof Error && error.name === "AbortError") {
+      throw new Error(`API request timed out after ${apiToolConfig.requestTimeoutMs}ms`);
+    }
+    throw error;
+  } finally {
+    clearTimeout(timeout);
+  }
+}
+var HTTP_METHODS, ApiToolRegistry;
+var init_api_tool_executor = __esm({
+  "src/providers/api-tool-executor.ts"() {
+    "use strict";
+    init_logger();
+    HTTP_METHODS = /* @__PURE__ */ new Set(["get", "put", "post", "delete", "options", "head", "patch", "trace"]);
+    ApiToolRegistry = class {
+      bundleCache = /* @__PURE__ */ new Map();
+      operationCache = /* @__PURE__ */ new Map();
+      registerMappedTools(sourceToolName, mappedTools) {
+        this.bundleCache.set(sourceToolName, mappedTools);
+        for (const mapped of mappedTools) {
+          const existing = this.operationCache.get(mapped.mcpToolDefinition.name);
+          if (existing && existing.sourceToolName !== sourceToolName) {
+            logger.warn(
+              `[ApiToolExecutor] Tool name collision: '${mapped.mcpToolDefinition.name}' from '${sourceToolName}' overrides '${existing.sourceToolName}'. Use namePrefix to avoid collisions.`
+            );
+          }
+          this.operationCache.set(mapped.mcpToolDefinition.name, mapped);
+        }
+      }
+      async ensureBundle(sourceToolName, tool) {
+        const cached = this.bundleCache.get(sourceToolName);
+        if (cached) return cached;
+        if (!isApiToolDefinition(tool)) {
+          return [];
+        }
+        const openapi = await loadOpenApiDocument(tool);
+        const mapped = mapOpenApiToTools(openapi, tool);
+        this.registerMappedTools(sourceToolName, mapped);
+        return mapped;
+      }
+      async ensureAll(toolMap) {
+        for (const [sourceToolName, tool] of toolMap.entries()) {
+          if (!isApiToolDefinition(tool)) continue;
+          await this.ensureBundle(sourceToolName, tool);
+        }
+      }
+      async listMappedTools(toolMap) {
+        await this.ensureAll(toolMap);
+        return Array.from(this.operationCache.values());
+      }
+      async getMappedTool(toolName, toolMap) {
+        const cached = this.operationCache.get(toolName);
+        if (cached) return cached;
+        for (const [sourceToolName, tool] of toolMap.entries()) {
+          if (!isApiToolDefinition(tool)) continue;
+          await this.ensureBundle(sourceToolName, tool);
+          const resolved = this.operationCache.get(toolName);
+          if (resolved) return resolved;
+        }
+        return void 0;
+      }
+    };
+  }
+});
+
 // src/providers/custom-tool-executor.ts
 import Ajv from "ajv";
 var CustomToolExecutor;
@@ -2797,11 +3561,13 @@ var init_custom_tool_executor = __esm({
     init_sandbox();
     init_logger();
     init_command_executor();
+    init_api_tool_executor();
     CustomToolExecutor = class {
       liquid;
       sandbox;
       tools;
       ajv;
+      apiToolRegistry;
       constructor(tools) {
         this.liquid = createExtendedLiquid({
           cache: false,
@@ -2809,7 +3575,8 @@ var init_custom_tool_executor = __esm({
           strictVariables: false
         });
         this.tools = new Map(Object.entries(tools || {}));
-        this.ajv = new Ajv({ allErrors: true, verbose: true });
+        this.ajv = new Ajv({ allErrors: true, verbose: true, strict: false });
+        this.apiToolRegistry = new ApiToolRegistry();
       }
       /**
        * Register a custom tool
@@ -2818,6 +3585,13 @@ var init_custom_tool_executor = __esm({
         if (!tool.name) {
           throw new Error("Tool must have a name");
         }
+        if (isApiToolDefinition(tool)) {
+          if (!tool.spec) {
+            throw new Error(`API tool '${tool.name}' must define 'spec'`);
+          }
+        } else if (!tool.exec) {
+          throw new Error(`Tool '${tool.name}' must define 'exec' (or set type: 'api')`);
+        }
         this.tools.set(tool.name, tool);
       }
       /**
@@ -2860,12 +3634,45 @@ var init_custom_tool_executor = __esm({
           throw new Error(`Input validation failed for tool '${tool.name}': ${errors}`);
         }
       }
+      /**
+       * Validate input against a JSON schema object
+       */
+      validateInputSchema(toolName, schema, input) {
+        if (!schema) {
+          return;
+        }
+        const validate = this.ajv.compile(schema);
+        const valid = validate(input);
+        if (!valid) {
+          const errors = validate.errors?.map((err) => {
+            if (err.instancePath) {
+              return `${err.instancePath}: ${err.message}`;
+            }
+            return err.message;
+          }).join(", ");
+          throw new Error(`Input validation failed for tool '${toolName}': ${errors}`);
+        }
+      }
       /**
        * Execute a custom tool
        */
       async execute(toolName, args, context2) {
         const tool = this.tools.get(toolName);
+        if (tool && isApiToolDefinition(tool)) {
+          throw new Error(
+            `Tool '${toolName}' is an API bundle. Call one of its generated operations instead.`
+          );
+        }
         if (!tool) {
+          const apiMappedTool = await this.apiToolRegistry.getMappedTool(toolName, this.tools);
+          if (apiMappedTool) {
+            this.validateInputSchema(
+              toolName,
+              apiMappedTool.mcpToolDefinition.inputSchema,
+              args
+            );
+            return await executeMappedApiTool(apiMappedTool, args);
+          }
           throw new Error(`Tool not found: ${toolName}`);
         }
         this.validateInput(tool, args);
@@ -2874,6 +3681,9 @@ var init_custom_tool_executor = __esm({
           args,
           input: args
         };
+        if (!tool.exec) {
+          throw new Error(`Tool '${toolName}' is missing exec command`);
+        }
         const command = await this.liquid.parseAndRender(tool.exec, templateContext);
         let stdin;
         if (tool.stdin) {
@@ -2933,6 +3743,50 @@ var init_custom_tool_executor = __esm({
         }
         return output;
       }
+      /**
+       * Check if a tool exists (direct or API-generated)
+       */
+      async hasTool(toolName) {
+        if (this.tools.has(toolName)) {
+          const tool = this.tools.get(toolName);
+          return !isApiToolDefinition(tool);
+        }
+        const apiMappedTool = await this.apiToolRegistry.getMappedTool(toolName, this.tools);
+        return Boolean(apiMappedTool);
+      }
+      /**
+       * Get all available tool names, including API-generated operations
+       */
+      async getToolNames() {
+        const names = [];
+        for (const tool of this.tools.values()) {
+          if (!isApiToolDefinition(tool)) {
+            names.push(tool.name);
+          }
+        }
+        const apiTools = await this.apiToolRegistry.listMappedTools(this.tools);
+        for (const mapped of apiTools) {
+          names.push(mapped.mcpToolDefinition.name);
+        }
+        return names;
+      }
+      /**
+       * List MCP-compatible tool definitions including API-generated operations
+       */
+      async listMcpTools() {
+        const directTools = this.getTools().filter((tool) => !isApiToolDefinition(tool)).map((tool) => ({
+          name: tool.name,
+          description: tool.description,
+          inputSchema: tool.inputSchema
+        }));
+        const apiTools = await this.apiToolRegistry.listMappedTools(this.tools);
+        const mappedApiTools = apiTools.map((tool) => ({
+          name: tool.mcpToolDefinition.name,
+          description: tool.mcpToolDefinition.description,
+          inputSchema: tool.mcpToolDefinition.inputSchema
+        }));
+        return [...directTools, ...mappedApiTools];
+      }
       /**
        * Apply JavaScript transform to output
        */
@@ -2960,7 +3814,7 @@ var init_custom_tool_executor = __esm({
        * Convert custom tools to MCP tool format
        */
       toMcpTools() {
-        return Array.from(this.tools.values()).map((tool) => ({
+        return Array.from(this.tools.values()).filter((tool) => !isApiToolDefinition(tool)).map((tool) => ({
           name: tool.name,
           description: tool.description,
           inputSchema: tool.inputSchema,
@@ -3068,7 +3922,7 @@ async function executeWorkflowAsTool(workflowId, args, context2, argsOverrides)
     ...args,
     ...argsOverrides
   };
-  const { WorkflowCheckProvider: WorkflowCheckProvider2 } = await import("./workflow-check-provider-BMVJ6X7N.mjs");
+  const { WorkflowCheckProvider: WorkflowCheckProvider2 } = await import("./workflow-check-provider-7SR7ZWSV.mjs");
   const provider = new WorkflowCheckProvider2();
   const checkConfig = {
     type: "workflow",
@@ -3136,1476 +3990,6 @@ var init_workflow_tool_executor = __esm({
   }
 });
 
-// src/scheduler/store/sqlite-store.ts
-import path3 from "path";
-import fs2 from "fs";
-import { v4 as uuidv4 } from "uuid";
-function toDbRow(schedule) {
-  return {
-    id: schedule.id,
-    creator_id: schedule.creatorId,
-    creator_context: schedule.creatorContext ?? null,
-    creator_name: schedule.creatorName ?? null,
-    timezone: schedule.timezone,
-    schedule_expr: schedule.schedule,
-    run_at: schedule.runAt ?? null,
-    is_recurring: schedule.isRecurring ? 1 : 0,
-    original_expression: schedule.originalExpression,
-    workflow: schedule.workflow ?? null,
-    workflow_inputs: schedule.workflowInputs ? JSON.stringify(schedule.workflowInputs) : null,
-    output_context: schedule.outputContext ? JSON.stringify(schedule.outputContext) : null,
-    status: schedule.status,
-    created_at: schedule.createdAt,
-    last_run_at: schedule.lastRunAt ?? null,
-    next_run_at: schedule.nextRunAt ?? null,
-    run_count: schedule.runCount,
-    failure_count: schedule.failureCount,
-    last_error: schedule.lastError ?? null,
-    previous_response: schedule.previousResponse ?? null
-  };
-}
-function safeJsonParse(value) {
-  if (!value) return void 0;
-  try {
-    return JSON.parse(value);
-  } catch {
-    return void 0;
-  }
-}
-function fromDbRow(row) {
-  return {
-    id: row.id,
-    creatorId: row.creator_id,
-    creatorContext: row.creator_context ?? void 0,
-    creatorName: row.creator_name ?? void 0,
-    timezone: row.timezone,
-    schedule: row.schedule_expr,
-    runAt: row.run_at ?? void 0,
-    isRecurring: row.is_recurring === 1,
-    originalExpression: row.original_expression,
-    workflow: row.workflow ?? void 0,
-    workflowInputs: safeJsonParse(row.workflow_inputs),
-    outputContext: safeJsonParse(row.output_context),
-    status: row.status,
-    createdAt: row.created_at,
-    lastRunAt: row.last_run_at ?? void 0,
-    nextRunAt: row.next_run_at ?? void 0,
-    runCount: row.run_count,
-    failureCount: row.failure_count,
-    lastError: row.last_error ?? void 0,
-    previousResponse: row.previous_response ?? void 0
-  };
-}
-var SqliteStoreBackend;
-var init_sqlite_store = __esm({
-  "src/scheduler/store/sqlite-store.ts"() {
-    "use strict";
-    init_logger();
-    SqliteStoreBackend = class {
-      db = null;
-      dbPath;
-      // In-memory locks (single-node only; SQLite doesn't support distributed locking)
-      locks = /* @__PURE__ */ new Map();
-      constructor(filename) {
-        this.dbPath = filename || ".visor/schedules.db";
-      }
-      async initialize() {
-        const resolvedPath = path3.resolve(process.cwd(), this.dbPath);
-        const dir = path3.dirname(resolvedPath);
-        fs2.mkdirSync(dir, { recursive: true });
-        const { createRequire } = __require("module");
-        const runtimeRequire = createRequire(__filename);
-        let Database;
-        try {
-          Database = runtimeRequire("better-sqlite3");
-        } catch (err) {
-          const code = err?.code;
-          if (code === "MODULE_NOT_FOUND" || code === "ERR_MODULE_NOT_FOUND") {
-            throw new Error(
-              "better-sqlite3 is required for SQLite schedule storage. Install it with: npm install better-sqlite3"
-            );
-          }
-          throw err;
-        }
-        this.db = new Database(resolvedPath);
-        this.db.pragma("journal_mode = WAL");
-        this.migrateSchema();
-        logger.info(`[SqliteStore] Initialized at ${this.dbPath}`);
-      }
-      async shutdown() {
-        if (this.db) {
-          this.db.close();
-          this.db = null;
-        }
-        this.locks.clear();
-      }
-      // --- Schema Migration ---
-      migrateSchema() {
-        const db = this.getDb();
-        db.exec(`
-      CREATE TABLE IF NOT EXISTS schedules (
-        id              VARCHAR(36)  PRIMARY KEY,
-        creator_id      VARCHAR(255) NOT NULL,
-        creator_context VARCHAR(255),
-        creator_name    VARCHAR(255),
-        timezone        VARCHAR(64)  NOT NULL DEFAULT 'UTC',
-        schedule_expr   VARCHAR(255),
-        run_at          BIGINT,
-        is_recurring    BOOLEAN      NOT NULL,
-        original_expression TEXT,
-        workflow        VARCHAR(255),
-        workflow_inputs TEXT,
-        output_context  TEXT,
-        status          VARCHAR(20)  NOT NULL,
-        created_at      BIGINT       NOT NULL,
-        last_run_at     BIGINT,
-        next_run_at     BIGINT,
-        run_count       INTEGER      NOT NULL DEFAULT 0,
-        failure_count   INTEGER      NOT NULL DEFAULT 0,
-        last_error      TEXT,
-        previous_response TEXT,
-        claimed_by      VARCHAR(255),
-        claimed_at      BIGINT,
-        lock_token      VARCHAR(36)
-      );
-
-      CREATE INDEX IF NOT EXISTS idx_schedules_creator_id
-        ON schedules(creator_id);
-
-      CREATE INDEX IF NOT EXISTS idx_schedules_status
-        ON schedules(status);
-
-      CREATE INDEX IF NOT EXISTS idx_schedules_status_next_run
-        ON schedules(status, next_run_at);
-
-      CREATE TABLE IF NOT EXISTS scheduler_locks (
-        lock_id     VARCHAR(255) PRIMARY KEY,
-        node_id     VARCHAR(255) NOT NULL,
-        lock_token  VARCHAR(36)  NOT NULL,
-        acquired_at BIGINT       NOT NULL,
-        expires_at  BIGINT       NOT NULL
-      );
-    `);
-      }
-      // --- Helpers ---
-      getDb() {
-        if (!this.db) {
-          throw new Error("[SqliteStore] Database not initialized. Call initialize() first.");
-        }
-        return this.db;
-      }
-      // --- CRUD ---
-      async create(schedule) {
-        const db = this.getDb();
-        const newSchedule = {
-          ...schedule,
-          id: uuidv4(),
-          createdAt: Date.now(),
-          runCount: 0,
-          failureCount: 0,
-          status: "active"
-        };
-        const row = toDbRow(newSchedule);
-        db.prepare(
-          `
-      INSERT INTO schedules (
-        id, creator_id, creator_context, creator_name, timezone,
-        schedule_expr, run_at, is_recurring, original_expression,
-        workflow, workflow_inputs, output_context,
-        status, created_at, last_run_at, next_run_at,
-        run_count, failure_count, last_error, previous_response
-      ) VALUES (
-        ?, ?, ?, ?, ?,
-        ?, ?, ?, ?,
-        ?, ?, ?,
-        ?, ?, ?, ?,
-        ?, ?, ?, ?
-      )
-    `
-        ).run(
-          row.id,
-          row.creator_id,
-          row.creator_context,
-          row.creator_name,
-          row.timezone,
-          row.schedule_expr,
-          row.run_at,
-          row.is_recurring,
-          row.original_expression,
-          row.workflow,
-          row.workflow_inputs,
-          row.output_context,
-          row.status,
-          row.created_at,
-          row.last_run_at,
-          row.next_run_at,
-          row.run_count,
-          row.failure_count,
-          row.last_error,
-          row.previous_response
-        );
-        logger.info(
-          `[SqliteStore] Created schedule ${newSchedule.id} for user ${newSchedule.creatorId}`
-        );
-        return newSchedule;
-      }
-      async importSchedule(schedule) {
-        const db = this.getDb();
-        const row = toDbRow(schedule);
-        db.prepare(
-          `
-      INSERT OR IGNORE INTO schedules (
-        id, creator_id, creator_context, creator_name, timezone,
-        schedule_expr, run_at, is_recurring, original_expression,
-        workflow, workflow_inputs, output_context,
-        status, created_at, last_run_at, next_run_at,
-        run_count, failure_count, last_error, previous_response
-      ) VALUES (
-        ?, ?, ?, ?, ?,
-        ?, ?, ?, ?,
-        ?, ?, ?,
-        ?, ?, ?, ?,
-        ?, ?, ?, ?
-      )
-    `
-        ).run(
-          row.id,
-          row.creator_id,
-          row.creator_context,
-          row.creator_name,
-          row.timezone,
-          row.schedule_expr,
-          row.run_at,
-          row.is_recurring,
-          row.original_expression,
-          row.workflow,
-          row.workflow_inputs,
-          row.output_context,
-          row.status,
-          row.created_at,
-          row.last_run_at,
-          row.next_run_at,
-          row.run_count,
-          row.failure_count,
-          row.last_error,
-          row.previous_response
-        );
-      }
-      async get(id) {
-        const db = this.getDb();
-        const row = db.prepare("SELECT * FROM schedules WHERE id = ?").get(id);
-        return row ? fromDbRow(row) : void 0;
-      }
-      async update(id, patch) {
-        const db = this.getDb();
-        const existing = db.prepare("SELECT * FROM schedules WHERE id = ?").get(id);
-        if (!existing) return void 0;
-        const current = fromDbRow(existing);
-        const updated = { ...current, ...patch, id: current.id };
-        const row = toDbRow(updated);
-        db.prepare(
-          `
-      UPDATE schedules SET
-        creator_id = ?, creator_context = ?, creator_name = ?, timezone = ?,
-        schedule_expr = ?, run_at = ?, is_recurring = ?, original_expression = ?,
-        workflow = ?, workflow_inputs = ?, output_context = ?,
-        status = ?, last_run_at = ?, next_run_at = ?,
-        run_count = ?, failure_count = ?, last_error = ?, previous_response = ?
-      WHERE id = ?
-    `
-        ).run(
-          row.creator_id,
-          row.creator_context,
-          row.creator_name,
-          row.timezone,
-          row.schedule_expr,
-          row.run_at,
-          row.is_recurring,
-          row.original_expression,
-          row.workflow,
-          row.workflow_inputs,
-          row.output_context,
-          row.status,
-          row.last_run_at,
-          row.next_run_at,
-          row.run_count,
-          row.failure_count,
-          row.last_error,
-          row.previous_response,
-          row.id
-        );
-        return updated;
-      }
-      async delete(id) {
-        const db = this.getDb();
-        const result = db.prepare("DELETE FROM schedules WHERE id = ?").run(id);
-        if (result.changes > 0) {
-          logger.info(`[SqliteStore] Deleted schedule ${id}`);
-          return true;
-        }
-        return false;
-      }
-      // --- Queries ---
-      async getByCreator(creatorId) {
-        const db = this.getDb();
-        const rows = db.prepare("SELECT * FROM schedules WHERE creator_id = ?").all(creatorId);
-        return rows.map(fromDbRow);
-      }
-      async getActiveSchedules() {
-        const db = this.getDb();
-        const rows = db.prepare("SELECT * FROM schedules WHERE status = 'active'").all();
-        return rows.map(fromDbRow);
-      }
-      async getDueSchedules(now) {
-        const ts = now ?? Date.now();
-        const db = this.getDb();
-        const rows = db.prepare(
-          `SELECT * FROM schedules
-         WHERE status = 'active'
-         AND (
-           (is_recurring = 0 AND run_at IS NOT NULL AND run_at <= ?)
-           OR
-           (is_recurring = 1 AND next_run_at IS NOT NULL AND next_run_at <= ?)
-         )`
-        ).all(ts, ts);
-        return rows.map(fromDbRow);
-      }
-      async findByWorkflow(creatorId, workflowName) {
-        const db = this.getDb();
-        const escaped = workflowName.toLowerCase().replace(/[%_\\]/g, "\\$&");
-        const pattern = `%${escaped}%`;
-        const rows = db.prepare(
-          `SELECT * FROM schedules
-         WHERE creator_id = ? AND status = 'active'
-         AND LOWER(workflow) LIKE ? ESCAPE '\\'`
-        ).all(creatorId, pattern);
-        return rows.map(fromDbRow);
-      }
-      async getAll() {
-        const db = this.getDb();
-        const rows = db.prepare("SELECT * FROM schedules").all();
-        return rows.map(fromDbRow);
-      }
-      async getStats() {
-        const db = this.getDb();
-        const row = db.prepare(
-          `SELECT
-          COUNT(*) as total,
-          SUM(CASE WHEN status = 'active' THEN 1 ELSE 0 END) as active,
-          SUM(CASE WHEN status = 'paused' THEN 1 ELSE 0 END) as paused,
-          SUM(CASE WHEN status = 'completed' THEN 1 ELSE 0 END) as completed,
-          SUM(CASE WHEN status = 'failed' THEN 1 ELSE 0 END) as failed,
-          SUM(CASE WHEN is_recurring = 1 THEN 1 ELSE 0 END) as recurring,
-          SUM(CASE WHEN is_recurring = 0 THEN 1 ELSE 0 END) as one_time
-        FROM schedules`
-        ).get();
-        return {
-          total: row.total,
-          active: row.active,
-          paused: row.paused,
-          completed: row.completed,
-          failed: row.failed,
-          recurring: row.recurring,
-          oneTime: row.one_time
-        };
-      }
-      async validateLimits(creatorId, isRecurring, limits) {
-        const db = this.getDb();
-        if (limits.maxGlobal) {
-          const row = db.prepare("SELECT COUNT(*) as cnt FROM schedules").get();
-          if (row.cnt >= limits.maxGlobal) {
-            throw new Error(`Global schedule limit reached (${limits.maxGlobal})`);
-          }
-        }
-        if (limits.maxPerUser) {
-          const row = db.prepare("SELECT COUNT(*) as cnt FROM schedules WHERE creator_id = ?").get(creatorId);
-          if (row.cnt >= limits.maxPerUser) {
-            throw new Error(`You have reached the maximum number of schedules (${limits.maxPerUser})`);
-          }
-        }
-        if (isRecurring && limits.maxRecurringPerUser) {
-          const row = db.prepare("SELECT COUNT(*) as cnt FROM schedules WHERE creator_id = ? AND is_recurring = 1").get(creatorId);
-          if (row.cnt >= limits.maxRecurringPerUser) {
-            throw new Error(
-              `You have reached the maximum number of recurring schedules (${limits.maxRecurringPerUser})`
-            );
-          }
-        }
-      }
-      // --- HA Locking (in-memory for SQLite — single-node only) ---
-      async tryAcquireLock(scheduleId, nodeId, ttlSeconds) {
-        const now = Date.now();
-        const existing = this.locks.get(scheduleId);
-        if (existing && existing.expiresAt > now) {
-          if (existing.nodeId === nodeId) {
-            return existing.token;
-          }
-          return null;
-        }
-        const token = uuidv4();
-        this.locks.set(scheduleId, {
-          nodeId,
-          token,
-          expiresAt: now + ttlSeconds * 1e3
-        });
-        return token;
-      }
-      async releaseLock(scheduleId, lockToken) {
-        const existing = this.locks.get(scheduleId);
-        if (existing && existing.token === lockToken) {
-          this.locks.delete(scheduleId);
-        }
-      }
-      async renewLock(scheduleId, lockToken, ttlSeconds) {
-        const existing = this.locks.get(scheduleId);
-        if (!existing || existing.token !== lockToken) {
-          return false;
-        }
-        existing.expiresAt = Date.now() + ttlSeconds * 1e3;
-        return true;
-      }
-      async flush() {
-      }
-    };
-  }
-});
-
-// src/scheduler/store/index.ts
-async function createStoreBackend(storageConfig, haConfig) {
-  const driver = storageConfig?.driver || "sqlite";
-  switch (driver) {
-    case "sqlite": {
-      const conn = storageConfig?.connection;
-      return new SqliteStoreBackend(conn?.filename);
-    }
-    case "postgresql":
-    case "mysql":
-    case "mssql": {
-      try {
-        const loaderPath = "../../enterprise/loader";
-        const { loadEnterpriseStoreBackend } = await import(loaderPath);
-        return await loadEnterpriseStoreBackend(driver, storageConfig, haConfig);
-      } catch (err) {
-        const msg = err instanceof Error ? err.message : String(err);
-        logger.error(`[StoreFactory] Failed to load enterprise ${driver} backend: ${msg}`);
-        throw new Error(
-          `The ${driver} schedule storage driver requires a Visor Enterprise license. Install the enterprise package or use driver: 'sqlite' (default). Original error: ${msg}`
-        );
-      }
-    }
-    default:
-      throw new Error(`Unknown schedule storage driver: ${driver}`);
-  }
-}
-var init_store = __esm({
-  "src/scheduler/store/index.ts"() {
-    "use strict";
-    init_logger();
-    init_sqlite_store();
-  }
-});
-
-// src/scheduler/store/json-migrator.ts
-import fs3 from "fs/promises";
-import path4 from "path";
-async function migrateJsonToBackend(jsonPath, backend) {
-  const resolvedPath = path4.resolve(process.cwd(), jsonPath);
-  let content;
-  try {
-    content = await fs3.readFile(resolvedPath, "utf-8");
-  } catch (err) {
-    if (err.code === "ENOENT") {
-      return 0;
-    }
-    throw err;
-  }
-  let data;
-  try {
-    data = JSON.parse(content);
-  } catch {
-    logger.warn(`[JsonMigrator] Failed to parse ${jsonPath}, skipping migration`);
-    return 0;
-  }
-  const schedules = data.schedules;
-  if (!Array.isArray(schedules) || schedules.length === 0) {
-    logger.debug("[JsonMigrator] No schedules to migrate");
-    await renameToMigrated(resolvedPath);
-    return 0;
-  }
-  let migrated = 0;
-  for (const schedule of schedules) {
-    if (!schedule.id) {
-      logger.warn("[JsonMigrator] Skipping schedule without ID");
-      continue;
-    }
-    const existing = await backend.get(schedule.id);
-    if (existing) {
-      logger.debug(`[JsonMigrator] Schedule ${schedule.id} already exists, skipping`);
-      continue;
-    }
-    try {
-      await backend.importSchedule(schedule);
-      migrated++;
-    } catch (err) {
-      logger.warn(
-        `[JsonMigrator] Failed to migrate schedule ${schedule.id}: ${err instanceof Error ? err.message : err}`
-      );
-    }
-  }
-  await renameToMigrated(resolvedPath);
-  logger.info(`[JsonMigrator] Migrated ${migrated}/${schedules.length} schedules from ${jsonPath}`);
-  return migrated;
-}
-async function renameToMigrated(resolvedPath) {
-  const migratedPath = `${resolvedPath}.migrated`;
-  try {
-    await fs3.rename(resolvedPath, migratedPath);
-    logger.info(`[JsonMigrator] Backed up ${resolvedPath} \u2192 ${migratedPath}`);
-  } catch (err) {
-    logger.warn(
-      `[JsonMigrator] Failed to rename ${resolvedPath}: ${err instanceof Error ? err.message : err}`
-    );
-  }
-}
-var init_json_migrator = __esm({
-  "src/scheduler/store/json-migrator.ts"() {
-    "use strict";
-    init_logger();
-  }
-});
-
-// src/scheduler/schedule-store.ts
-var ScheduleStore;
-var init_schedule_store = __esm({
-  "src/scheduler/schedule-store.ts"() {
-    "use strict";
-    init_logger();
-    init_store();
-    init_json_migrator();
-    ScheduleStore = class _ScheduleStore {
-      static instance;
-      backend = null;
-      initialized = false;
-      limits;
-      config;
-      externalBackend = null;
-      constructor(config, limits, backend) {
-        this.config = config || {};
-        this.limits = {
-          maxPerUser: limits?.maxPerUser ?? 25,
-          maxRecurringPerUser: limits?.maxRecurringPerUser ?? 10,
-          maxGlobal: limits?.maxGlobal ?? 1e3
-        };
-        if (backend) {
-          this.externalBackend = backend;
-        }
-      }
-      /**
-       * Get singleton instance
-       *
-       * Note: Config and limits are only applied on first call. Subsequent calls
-       * with different parameters will log a warning and return the existing instance.
-       * Use createIsolated() for testing with different configurations.
-       */
-      static getInstance(config, limits) {
-        if (!_ScheduleStore.instance) {
-          _ScheduleStore.instance = new _ScheduleStore(config, limits);
-        } else if (config || limits) {
-          logger.warn(
-            "[ScheduleStore] getInstance() called with config/limits but instance already exists. Parameters ignored. Use createIsolated() for testing or resetInstance() first."
-          );
-        }
-        return _ScheduleStore.instance;
-      }
-      /**
-       * Create a new isolated instance (for testing)
-       */
-      static createIsolated(config, limits, backend) {
-        return new _ScheduleStore(config, limits, backend);
-      }
-      /**
-       * Reset singleton instance (for testing)
-       */
-      static resetInstance() {
-        if (_ScheduleStore.instance) {
-          if (_ScheduleStore.instance.backend) {
-            _ScheduleStore.instance.backend.shutdown().catch(() => {
-            });
-          }
-        }
-        _ScheduleStore.instance = void 0;
-      }
-      /**
-       * Initialize the store - creates backend and runs migrations
-       */
-      async initialize() {
-        if (this.initialized) {
-          return;
-        }
-        if (this.externalBackend) {
-          this.backend = this.externalBackend;
-        } else {
-          this.backend = await createStoreBackend(this.config.storage, this.config.ha);
-        }
-        await this.backend.initialize();
-        const jsonPath = this.config.path || ".visor/schedules.json";
-        try {
-          await migrateJsonToBackend(jsonPath, this.backend);
-        } catch (err) {
-          logger.warn(
-            `[ScheduleStore] JSON migration failed (non-fatal): ${err instanceof Error ? err.message : err}`
-          );
-        }
-        this.initialized = true;
-      }
-      /**
-       * Create a new schedule (async, persists immediately)
-       */
-      async createAsync(schedule) {
-        const backend = this.getBackend();
-        await backend.validateLimits(schedule.creatorId, schedule.isRecurring, this.limits);
-        return backend.create(schedule);
-      }
-      /**
-       * Get a schedule by ID
-       */
-      async getAsync(id) {
-        return this.getBackend().get(id);
-      }
-      /**
-       * Update a schedule
-       */
-      async updateAsync(id, patch) {
-        return this.getBackend().update(id, patch);
-      }
-      /**
-       * Delete a schedule
-       */
-      async deleteAsync(id) {
-        return this.getBackend().delete(id);
-      }
-      /**
-       * Get all schedules for a specific creator
-       */
-      async getByCreatorAsync(creatorId) {
-        return this.getBackend().getByCreator(creatorId);
-      }
-      /**
-       * Get all active schedules
-       */
-      async getActiveSchedulesAsync() {
-        return this.getBackend().getActiveSchedules();
-      }
-      /**
-       * Get all schedules due for execution
-       * @param now Current timestamp in milliseconds
-       */
-      async getDueSchedulesAsync(now = Date.now()) {
-        return this.getBackend().getDueSchedules(now);
-      }
-      /**
-       * Find schedules by workflow name
-       */
-      async findByWorkflowAsync(creatorId, workflowName) {
-        return this.getBackend().findByWorkflow(creatorId, workflowName);
-      }
-      /**
-       * Get schedule count statistics
-       */
-      async getStatsAsync() {
-        return this.getBackend().getStats();
-      }
-      /**
-       * Force immediate save (useful for shutdown)
-       */
-      async flush() {
-        if (this.backend) {
-          await this.backend.flush();
-        }
-      }
-      /**
-       * Check if initialized
-       */
-      isInitialized() {
-        return this.initialized;
-      }
-      /**
-       * Check if there are unsaved changes
-       */
-      hasPendingChanges() {
-        return false;
-      }
-      /**
-       * Get all schedules
-       */
-      async getAllAsync() {
-        return this.getBackend().getAll();
-      }
-      /**
-       * Get the underlying backend (for HA lock operations)
-       */
-      getBackend() {
-        if (!this.backend) {
-          throw new Error("[ScheduleStore] Not initialized. Call initialize() first.");
-        }
-        return this.backend;
-      }
-      /**
-       * Shut down the backend cleanly
-       */
-      async shutdown() {
-        if (this.backend) {
-          await this.backend.shutdown();
-          this.backend = null;
-        }
-        this.initialized = false;
-      }
-    };
-  }
-});
-
-// src/scheduler/schedule-parser.ts
-function getNextRunTime(cronExpression, _timezone = "UTC") {
-  const parts = cronExpression.split(" ");
-  if (parts.length !== 5) {
-    throw new Error(`Invalid cron expression: ${cronExpression}`);
-  }
-  const [minute, hour, dayOfMonth, month, dayOfWeek] = parts;
-  const now = /* @__PURE__ */ new Date();
-  const next = new Date(now);
-  next.setSeconds(0, 0);
-  next.setMinutes(next.getMinutes() + 1);
-  const maxAttempts = 365 * 24 * 60;
-  for (let i = 0; i < maxAttempts; i++) {
-    if (matchesCronPart(next.getMinutes(), minute) && matchesCronPart(next.getHours(), hour) && matchesCronPart(next.getDate(), dayOfMonth) && matchesCronPart(next.getMonth() + 1, month) && matchesCronPart(next.getDay(), dayOfWeek)) {
-      return next;
-    }
-    next.setMinutes(next.getMinutes() + 1);
-  }
-  const fallback = new Date(now);
-  fallback.setDate(fallback.getDate() + 1);
-  fallback.setHours(parseInt(hour, 10) || 9);
-  fallback.setMinutes(parseInt(minute, 10) || 0);
-  fallback.setSeconds(0, 0);
-  return fallback;
-}
-function matchesCronPart(value, cronPart) {
-  if (cronPart === "*") return true;
-  if (cronPart.startsWith("*/")) {
-    const step = parseInt(cronPart.slice(2), 10);
-    return value % step === 0;
-  }
-  if (cronPart.includes("-")) {
-    const [start, end] = cronPart.split("-").map((n) => parseInt(n, 10));
-    return value >= start && value <= end;
-  }
-  if (cronPart.includes(",")) {
-    return cronPart.split(",").map((n) => parseInt(n, 10)).includes(value);
-  }
-  return parseInt(cronPart, 10) === value;
-}
-function isValidCronExpression(expr) {
-  if (!expr || typeof expr !== "string") return false;
-  const parts = expr.trim().split(/\s+/);
-  if (parts.length !== 5) return false;
-  const ranges = [
-    [0, 59],
-    // minute
-    [0, 23],
-    // hour
-    [1, 31],
-    // day of month
-    [1, 12],
-    // month
-    [0, 7]
-    // day of week (0 and 7 are Sunday)
-  ];
-  return parts.every((part, i) => {
-    if (part === "*") return true;
-    if (part.startsWith("*/")) {
-      const step = parseInt(part.slice(2), 10);
-      return !isNaN(step) && step > 0;
-    }
-    if (part.includes("-")) {
-      const [start, end] = part.split("-").map((n) => parseInt(n, 10));
-      return !isNaN(start) && !isNaN(end) && start >= ranges[i][0] && end <= ranges[i][1];
-    }
-    if (part.includes(",")) {
-      return part.split(",").every((n) => {
-        const val2 = parseInt(n, 10);
-        return !isNaN(val2) && val2 >= ranges[i][0] && val2 <= ranges[i][1];
-      });
-    }
-    const val = parseInt(part, 10);
-    return !isNaN(val) && val >= ranges[i][0] && val <= ranges[i][1];
-  });
-}
-var init_schedule_parser = __esm({
-  "src/scheduler/schedule-parser.ts"() {
-    "use strict";
-  }
-});
-
-// src/scheduler/schedule-tool.ts
-function matchGlobPattern(pattern, value) {
-  const regexPattern = pattern.replace(/[.+^${}()|[\]\\]/g, "\\$&").replace(/\*/g, ".*").replace(/\?/g, ".");
-  return new RegExp(`^${regexPattern}$`).test(value);
-}
-function isWorkflowAllowedByPatterns(workflow, allowedPatterns, deniedPatterns) {
-  if (deniedPatterns && deniedPatterns.length > 0) {
-    for (const pattern of deniedPatterns) {
-      if (matchGlobPattern(pattern, workflow)) {
-        return {
-          allowed: false,
-          reason: `Workflow "${workflow}" matches denied pattern "${pattern}"`
-        };
-      }
-    }
-  }
-  if (allowedPatterns && allowedPatterns.length > 0) {
-    for (const pattern of allowedPatterns) {
-      if (matchGlobPattern(pattern, workflow)) {
-        return { allowed: true };
-      }
-    }
-    return {
-      allowed: false,
-      reason: `Workflow "${workflow}" does not match any allowed patterns: ${allowedPatterns.join(", ")}`
-    };
-  }
-  return { allowed: true };
-}
-function checkSchedulePermissions(context2, workflow, requestedScheduleType) {
-  const permissions = context2.permissions;
-  const scheduleType = requestedScheduleType || context2.scheduleType || "personal";
-  if (context2.allowedScheduleType && scheduleType !== context2.allowedScheduleType) {
-    const contextNames = {
-      personal: "a direct message (DM)",
-      channel: "a channel",
-      dm: "a group DM"
-    };
-    const targetNames = {
-      personal: "personal",
-      channel: "channel",
-      dm: "group"
-    };
-    return {
-      allowed: false,
-      reason: `From ${contextNames[context2.allowedScheduleType]}, you can only create ${targetNames[context2.allowedScheduleType]} schedules. To create a ${targetNames[scheduleType]} schedule, please use the appropriate context.`
-    };
-  }
-  if (!permissions) {
-    return { allowed: true };
-  }
-  switch (scheduleType) {
-    case "personal":
-      if (permissions.allowPersonal === false) {
-        return {
-          allowed: false,
-          reason: "Personal schedules are not allowed in this configuration"
-        };
-      }
-      break;
-    case "channel":
-      if (permissions.allowChannel === false) {
-        return {
-          allowed: false,
-          reason: "Channel schedules are not allowed in this configuration"
-        };
-      }
-      break;
-    case "dm":
-      if (permissions.allowDm === false) {
-        return {
-          allowed: false,
-          reason: "DM schedules are not allowed in this configuration"
-        };
-      }
-      break;
-  }
-  return isWorkflowAllowedByPatterns(
-    workflow,
-    permissions.allowedWorkflows,
-    permissions.deniedWorkflows
-  );
-}
-function formatSchedule(schedule) {
-  const time = schedule.isRecurring ? schedule.originalExpression : new Date(schedule.runAt).toLocaleString();
-  const status = schedule.status !== "active" ? ` (${schedule.status})` : "";
-  const displayName = schedule.workflow || schedule.workflowInputs?.text || "scheduled message";
-  const truncatedName = displayName.length > 30 ? displayName.substring(0, 27) + "..." : displayName;
-  const output = schedule.outputContext?.type || "none";
-  return `\`${schedule.id.substring(0, 8)}\` - "${truncatedName}" - ${time} (\u2192 ${output})${status}`;
-}
-function formatCreateConfirmation(schedule) {
-  const outputDesc = schedule.outputContext?.type ? `${schedule.outputContext.type}${schedule.outputContext.target ? `:${schedule.outputContext.target}` : ""}` : "none";
-  const displayName = schedule.workflow || schedule.workflowInputs?.text || "scheduled message";
-  if (schedule.isRecurring) {
-    const nextRun = schedule.nextRunAt ? new Date(schedule.nextRunAt).toLocaleString("en-US", {
-      weekday: "long",
-      month: "short",
-      day: "numeric",
-      hour: "numeric",
-      minute: "2-digit"
-    }) : "calculating...";
-    return `**Schedule created!**
-
-**${schedule.workflow ? "Workflow" : "Reminder"}**: ${displayName}
-**When**: ${schedule.originalExpression}
-**Output**: ${outputDesc}
-**Next run**: ${nextRun}
-
-ID: \`${schedule.id.substring(0, 8)}\``;
-  } else {
-    const when = new Date(schedule.runAt).toLocaleString("en-US", {
-      weekday: "long",
-      month: "short",
-      day: "numeric",
-      hour: "numeric",
-      minute: "2-digit"
-    });
-    return `**Schedule created!**
-
-**${schedule.workflow ? "Workflow" : "Reminder"}**: ${displayName}
-**When**: ${when}
-**Output**: ${outputDesc}
-
-ID: \`${schedule.id.substring(0, 8)}\``;
-  }
-}
-function formatScheduleList(schedules) {
-  if (schedules.length === 0) {
-    return `You don't have any active schedules.
-
-To create one: "remind me every Monday at 9am to check PRs" or "schedule %daily-report every Monday at 9am"`;
-  }
-  const lines = schedules.map((s, i) => `${i + 1}. ${formatSchedule(s)}`);
-  return `**Your active schedules:**
-
-${lines.join("\n")}
-
-To cancel: "cancel schedule <id>"
-To pause: "pause schedule <id>"`;
-}
-async function handleScheduleAction(args, context2) {
-  const store = ScheduleStore.getInstance();
-  if (!store.isInitialized()) {
-    await store.initialize();
-  }
-  switch (args.action) {
-    case "create":
-      return handleCreate(args, context2, store);
-    case "list":
-      return handleList(context2, store);
-    case "cancel":
-      return handleCancel(args, context2, store);
-    case "pause":
-      return handlePauseResume(args, context2, store, "paused");
-    case "resume":
-      return handlePauseResume(args, context2, store, "active");
-    default:
-      return {
-        success: false,
-        message: `Unknown action: ${args.action}`,
-        error: `Supported actions: create, list, cancel, pause, resume`
-      };
-  }
-}
-async function handleCreate(args, context2, store) {
-  if (!args.reminder_text && !args.workflow) {
-    return {
-      success: false,
-      message: "Missing reminder content",
-      error: "Please specify either reminder_text (what to say) or workflow (what to run)"
-    };
-  }
-  if (!args.cron && !args.run_at) {
-    return {
-      success: false,
-      message: "Missing schedule timing",
-      error: 'Please specify either cron (for recurring, e.g., "* * * * *") or run_at (ISO timestamp for one-time)'
-    };
-  }
-  if (args.cron && !isValidCronExpression(args.cron)) {
-    return {
-      success: false,
-      message: "Invalid cron expression",
-      error: `"${args.cron}" is not a valid cron expression. Format: "minute hour day-of-month month day-of-week"`
-    };
-  }
-  let runAtTimestamp;
-  if (args.run_at) {
-    const parsed = new Date(args.run_at);
-    if (isNaN(parsed.getTime())) {
-      return {
-        success: false,
-        message: "Invalid run_at timestamp",
-        error: `"${args.run_at}" is not a valid ISO 8601 timestamp`
-      };
-    }
-    if (parsed.getTime() <= Date.now()) {
-      return {
-        success: false,
-        message: "run_at must be in the future",
-        error: "Cannot schedule a reminder in the past"
-      };
-    }
-    runAtTimestamp = parsed.getTime();
-  }
-  if (args.target_type && !args.target_id) {
-    return {
-      success: false,
-      message: "Missing target_id",
-      error: `target_type "${args.target_type}" requires a target_id (channel ID, user ID, or thread_ts)`
-    };
-  }
-  let scheduleType = "personal";
-  if (args.target_type === "channel") {
-    scheduleType = "channel";
-  } else if (args.target_type === "user") {
-    scheduleType = "dm";
-  }
-  const workflowName = args.workflow || "reminder";
-  const permissionCheck = checkSchedulePermissions(context2, workflowName, scheduleType);
-  if (!permissionCheck.allowed) {
-    logger.warn(
-      `[ScheduleTool] Permission denied for user ${context2.userId}: ${permissionCheck.reason}`
-    );
-    return {
-      success: false,
-      message: "Permission denied",
-      error: permissionCheck.reason || "You do not have permission to create this schedule"
-    };
-  }
-  if (args.workflow && context2.availableWorkflows && !context2.availableWorkflows.includes(args.workflow)) {
-    return {
-      success: false,
-      message: `Workflow "${args.workflow}" not found`,
-      error: `Available workflows: ${context2.availableWorkflows.slice(0, 5).join(", ")}${context2.availableWorkflows.length > 5 ? "..." : ""}`
-    };
-  }
-  try {
-    const timezone = context2.timezone || "UTC";
-    const isRecurring = args.is_recurring === true || !!args.cron;
-    let outputContext;
-    if (args.target_type && args.target_id) {
-      outputContext = {
-        type: "slack",
-        // Currently only Slack supported
-        target: args.target_id,
-        // Channel ID (C... or D...)
-        threadId: args.thread_ts,
-        // Thread timestamp for replies
-        metadata: {
-          targetType: args.target_type,
-          reminderText: args.reminder_text
-        }
-      };
-    }
-    let nextRunAt;
-    if (isRecurring && args.cron) {
-      nextRunAt = getNextRunTime(args.cron, timezone).getTime();
-    } else if (runAtTimestamp) {
-      nextRunAt = runAtTimestamp;
-    }
-    const schedule = await store.createAsync({
-      creatorId: context2.userId,
-      creatorContext: context2.contextType,
-      creatorName: context2.userName,
-      timezone,
-      schedule: args.cron || "",
-      runAt: runAtTimestamp,
-      isRecurring,
-      originalExpression: args.original_expression || args.cron || args.run_at || "",
-      workflow: args.workflow,
-      // Only set if explicitly provided
-      workflowInputs: args.workflow_inputs || (args.reminder_text ? { text: args.reminder_text } : void 0),
-      outputContext,
-      nextRunAt
-    });
-    const displayText = args.reminder_text || args.workflow || "scheduled task";
-    logger.info(
-      `[ScheduleTool] Created schedule ${schedule.id} for user ${context2.userId}: "${displayText}"`
-    );
-    return {
-      success: true,
-      message: formatCreateConfirmation(schedule),
-      schedule
-    };
-  } catch (error) {
-    const errorMsg = error instanceof Error ? error.message : "Unknown error";
-    logger.warn(`[ScheduleTool] Failed to create schedule: ${errorMsg}`);
-    return {
-      success: false,
-      message: `Failed to create schedule: ${errorMsg}`,
-      error: errorMsg
-    };
-  }
-}
-async function handleList(context2, store) {
-  const allUserSchedules = await store.getByCreatorAsync(context2.userId);
-  const schedules = allUserSchedules.filter((s) => s.status !== "completed");
-  let filteredSchedules = schedules;
-  if (context2.allowedScheduleType) {
-    filteredSchedules = schedules.filter((s) => {
-      const scheduleOutputType = s.outputContext?.type;
-      if (!scheduleOutputType || scheduleOutputType === "none") {
-        return context2.allowedScheduleType === "personal";
-      }
-      if (scheduleOutputType === "slack") {
-        const target = s.outputContext?.target || "";
-        if (target.startsWith("#") || target.match(/^C[A-Z0-9]+$/)) {
-          return context2.allowedScheduleType === "channel";
-        }
-        if (target.startsWith("@") || target.match(/^U[A-Z0-9]+$/)) {
-          return context2.allowedScheduleType === "dm";
-        }
-      }
-      return context2.allowedScheduleType === "personal";
-    });
-  }
-  return {
-    success: true,
-    message: formatScheduleList(filteredSchedules),
-    schedules: filteredSchedules
-  };
-}
-async function handleCancel(args, context2, store) {
-  let schedule;
-  if (args.schedule_id) {
-    const userSchedules = await store.getByCreatorAsync(context2.userId);
-    schedule = userSchedules.find((s) => s.id === args.schedule_id);
-    if (!schedule) {
-      schedule = userSchedules.find((s) => s.id.startsWith(args.schedule_id));
-    }
-  }
-  if (!schedule) {
-    return {
-      success: false,
-      message: "Schedule not found",
-      error: `Could not find schedule with ID "${args.schedule_id}" in your schedules. Use "list my schedules" to see your schedules.`
-    };
-  }
-  if (schedule.creatorId !== context2.userId) {
-    logger.warn(
-      `[ScheduleTool] Attempted cross-user schedule cancellation: ${context2.userId} tried to cancel ${schedule.id} owned by ${schedule.creatorId}`
-    );
-    return {
-      success: false,
-      message: "Not your schedule",
-      error: "You can only cancel your own schedules."
-    };
-  }
-  await store.deleteAsync(schedule.id);
-  logger.info(`[ScheduleTool] Cancelled schedule ${schedule.id} for user ${context2.userId}`);
-  return {
-    success: true,
-    message: `**Schedule cancelled!**
-
-Was: "${schedule.workflow}" scheduled for ${schedule.originalExpression}`
-  };
-}
-async function handlePauseResume(args, context2, store, newStatus) {
-  if (!args.schedule_id) {
-    return {
-      success: false,
-      message: "Missing schedule ID",
-      error: "Please specify which schedule to pause/resume."
-    };
-  }
-  const userSchedules = await store.getByCreatorAsync(context2.userId);
-  let schedule = userSchedules.find((s) => s.id === args.schedule_id);
-  if (!schedule) {
-    schedule = userSchedules.find((s) => s.id.startsWith(args.schedule_id));
-  }
-  if (!schedule) {
-    return {
-      success: false,
-      message: "Schedule not found",
-      error: `Could not find schedule with ID "${args.schedule_id}" in your schedules.`
-    };
-  }
-  if (schedule.creatorId !== context2.userId) {
-    logger.warn(
-      `[ScheduleTool] Attempted cross-user schedule modification: ${context2.userId} tried to modify ${schedule.id} owned by ${schedule.creatorId}`
-    );
-    return {
-      success: false,
-      message: "Not your schedule",
-      error: "You can only modify your own schedules."
-    };
-  }
-  const updated = await store.updateAsync(schedule.id, { status: newStatus });
-  const action = newStatus === "paused" ? "paused" : "resumed";
-  logger.info(`[ScheduleTool] ${action} schedule ${schedule.id} for user ${context2.userId}`);
-  return {
-    success: true,
-    message: `**Schedule ${action}!**
-
-"${schedule.workflow}" - ${schedule.originalExpression}`,
-    schedule: updated
-  };
-}
-function getScheduleToolDefinition() {
-  return {
-    name: "schedule",
-    description: `Schedule, list, and manage reminders or workflow executions.
-
-YOU (the AI) must extract and structure all scheduling parameters. Do NOT pass natural language time expressions - convert them to cron or ISO timestamps.
-
-CRITICAL WORKFLOW RULE:
-- To schedule a WORKFLOW, the user MUST use a '%' prefix (e.g., "schedule %my-workflow daily").
-- If the '%' prefix is present, extract the word following it as the 'workflow' parameter (without the '%').
-- If the '%' prefix is NOT present, the request is a simple text reminder. The ENTIRE user request (excluding the schedule expression) MUST be placed in the 'reminder_text' parameter.
-- DO NOT guess or infer a workflow name from a user's request without the '%' prefix.
-
-ACTIONS:
-- create: Schedule a new reminder or workflow
-- list: Show user's active schedules
-- cancel: Remove a schedule by ID
-- pause/resume: Temporarily disable/enable a schedule
-
-FOR CREATE ACTION - Extract these from user's request:
-1. WHAT:
-   - If user says "schedule %some-workflow ...", populate 'workflow' with "some-workflow".
-   - Otherwise, populate 'reminder_text' with the user's full request text.
-2. WHERE: Use the CURRENT channel from context
-   - target_id: The channel ID from context (C... for channels, D... for DMs)
-   - target_type: "channel" for public/private channels, "dm" for direct messages
-   - ONLY use target_type="thread" with thread_ts if user is INSIDE a thread
-   - When NOT in a thread, reminders post as NEW messages (not thread replies)
-3. WHEN: Either cron (for recurring) OR run_at (ISO 8601 for one-time)
-   - Recurring: Generate cron expression (minute hour day-of-month month day-of-week)
-   - One-time: Generate ISO 8601 timestamp
-
-CRON EXAMPLES:
-- "every minute" \u2192 cron: "* * * * *"
-- "every hour" \u2192 cron: "0 * * * *"
-- "every day at 9am" \u2192 cron: "0 9 * * *"
-- "every Monday at 9am" \u2192 cron: "0 9 * * 1"
-- "weekdays at 8:30am" \u2192 cron: "30 8 * * 1-5"
-- "every 5 minutes" \u2192 cron: "*/5 * * * *"
-
-ONE-TIME EXAMPLES:
-- "in 2 hours" \u2192 run_at: "<ISO timestamp 2 hours from now>"
-- "tomorrow at 3pm" \u2192 run_at: "2026-02-08T15:00:00Z"
-
-USAGE EXAMPLES:
-
-User in DM: "remind me to check builds every day at 9am"
-\u2192 {
-    "action": "create",
-    "reminder_text": "check builds",
-    "is_recurring": true,
-    "cron": "0 9 * * *",
-    "target_type": "dm",
-    "target_id": "<DM channel ID from context, e.g., D09SZABNLG3>",
-    "original_expression": "every day at 9am"
-  }
-
-User in #security channel: "schedule %security-scan every Monday at 10am"
-\u2192 {
-    "action": "create",
-    "workflow": "security-scan",
-    "is_recurring": true,
-    "cron": "0 10 * * 1",
-    "target_type": "channel",
-    "target_id": "<channel ID from context, e.g., C05ABC123>",
-    "original_expression": "every Monday at 10am"
-  }
-
-User in #security channel: "run security-scan every Monday at 10am" (NO % prefix!)
-\u2192 {
-    "action": "create",
-    "reminder_text": "run security-scan every Monday at 10am",
-    "is_recurring": true,
-    "cron": "0 10 * * 1",
-    "target_type": "channel",
-    "target_id": "<channel ID from context, e.g., C05ABC123>",
-    "original_expression": "every Monday at 10am"
-  }
-
-User in DM: "remind me in 2 hours to review the PR"
-\u2192 {
-    "action": "create",
-    "reminder_text": "review the PR",
-    "is_recurring": false,
-    "run_at": "2026-02-07T18:00:00Z",
-    "target_type": "dm",
-    "target_id": "<DM channel ID from context>",
-    "original_expression": "in 2 hours"
-  }
-
-User inside a thread: "remind me about this tomorrow"
-\u2192 {
-    "action": "create",
-    "reminder_text": "Check this thread",
-    "is_recurring": false,
-    "run_at": "2026-02-08T09:00:00Z",
-    "target_type": "thread",
-    "target_id": "<channel ID>",
-    "thread_ts": "<thread_ts from context>",
-    "original_expression": "tomorrow"
-  }
-
-User: "list my schedules"
-\u2192 { "action": "list" }
-
-User: "cancel schedule abc123"
-\u2192 { "action": "cancel", "schedule_id": "abc123" }`,
-    inputSchema: {
-      type: "object",
-      properties: {
-        action: {
-          type: "string",
-          enum: ["create", "list", "cancel", "pause", "resume"],
-          description: "What to do: create new, list existing, cancel/pause/resume by ID"
-        },
-        // WHAT to do
-        reminder_text: {
-          type: "string",
-          description: "For create: the message/reminder text to send when triggered"
-        },
-        workflow: {
-          type: "string",
-          description: 'For create: workflow ID to run. ONLY populate this if the user used the % prefix (e.g., "%my-workflow"). Extract the name without the % symbol. If no % prefix, use reminder_text instead.'
-        },
-        workflow_inputs: {
-          type: "object",
-          description: "For create: optional inputs to pass to the workflow"
-        },
-        // WHERE to send
-        target_type: {
-          type: "string",
-          enum: ["channel", "dm", "thread", "user"],
-          description: "For create: where to send output. channel=public/private channel, dm=DM to self (current DM channel), user=DM to specific user, thread=reply in current thread"
-        },
-        target_id: {
-          type: "string",
-          description: "For create: Slack channel ID. Channels start with C, DMs start with D. Always use the channel ID from the current context."
-        },
-        thread_ts: {
-          type: "string",
-          description: "For create with target_type=thread: the thread timestamp to reply to. Get this from the current thread context."
-        },
-        // WHEN to run
-        is_recurring: {
-          type: "boolean",
-          description: "For create: true for recurring schedules (cron), false for one-time (run_at)"
-        },
-        cron: {
-          type: "string",
-          description: 'For create recurring: cron expression (minute hour day-of-month month day-of-week). Examples: "0 9 * * *" (daily 9am), "* * * * *" (every minute), "0 9 * * 1" (Mondays 9am)'
-        },
-        run_at: {
-          type: "string",
-          description: 'For create one-time: ISO 8601 timestamp when to run (e.g., "2026-02-07T15:00:00Z")'
-        },
-        original_expression: {
-          type: "string",
-          description: "For create: the original natural language expression from user (for display only)"
-        },
-        // For cancel/pause/resume
-        schedule_id: {
-          type: "string",
-          description: "For cancel/pause/resume: the schedule ID to act on (first 8 chars is enough)"
-        }
-      },
-      required: ["action"]
-    },
-    exec: ""
-    // Not used - this tool has a custom handler
-  };
-}
-function isScheduleTool(toolName) {
-  return toolName === "schedule";
-}
-function determineScheduleType(contextType, outputType, outputTarget) {
-  if (outputType === "slack" && outputTarget) {
-    if (outputTarget.startsWith("#") || outputTarget.match(/^C[A-Z0-9]+$/)) {
-      return "channel";
-    }
-    if (outputTarget.startsWith("@") || outputTarget.match(/^U[A-Z0-9]+$/)) {
-      return "dm";
-    }
-  }
-  if (contextType === "cli" || contextType.startsWith("github:")) {
-    return "personal";
-  }
-  return "personal";
-}
-function slackChannelTypeToScheduleType(channelType) {
-  switch (channelType) {
-    case "channel":
-      return "channel";
-    case "group":
-      return "dm";
-    // Group DMs map to 'dm' schedule type
-    case "dm":
-    default:
-      return "personal";
-  }
-}
-function buildScheduleToolContext(sources, availableWorkflows, permissions, outputInfo) {
-  if (sources.slackContext) {
-    const contextType = `slack:${sources.slackContext.userId}`;
-    const scheduleType = determineScheduleType(
-      contextType,
-      outputInfo?.outputType,
-      outputInfo?.outputTarget
-    );
-    let allowedScheduleType;
-    if (sources.slackContext.channelType) {
-      allowedScheduleType = slackChannelTypeToScheduleType(sources.slackContext.channelType);
-    }
-    let finalScheduleType = scheduleType;
-    if (!outputInfo?.outputType && sources.slackContext.channelType) {
-      finalScheduleType = slackChannelTypeToScheduleType(sources.slackContext.channelType);
-    }
-    return {
-      userId: sources.slackContext.userId,
-      userName: sources.slackContext.userName,
-      contextType,
-      timezone: sources.slackContext.timezone,
-      availableWorkflows,
-      scheduleType: finalScheduleType,
-      permissions,
-      allowedScheduleType
-    };
-  }
-  if (sources.githubContext) {
-    return {
-      userId: sources.githubContext.login,
-      contextType: `github:${sources.githubContext.login}`,
-      timezone: "UTC",
-      // GitHub doesn't provide timezone
-      availableWorkflows,
-      scheduleType: "personal",
-      permissions,
-      allowedScheduleType: "personal"
-      // GitHub context only allows personal schedules
-    };
-  }
-  return {
-    userId: sources.cliContext?.userId || process.env.USER || "cli-user",
-    contextType: "cli",
-    timezone: Intl.DateTimeFormat().resolvedOptions().timeZone || "UTC",
-    availableWorkflows,
-    scheduleType: "personal",
-    permissions,
-    allowedScheduleType: "personal"
-    // CLI context only allows personal schedules
-  };
-}
-var init_schedule_tool = __esm({
-  "src/scheduler/schedule-tool.ts"() {
-    "use strict";
-    init_schedule_store();
-    init_schedule_parser();
-    init_logger();
-  }
-});
-
 // src/state-machine/states/init.ts
 async function handleInit(context2, state, transition) {
   if (context2.debug) {
@@ -5389,8 +4773,8 @@ var init_wave_planning = __esm({
 });
 
 // src/utils/mermaid-telemetry.ts
-import * as fs4 from "fs";
-import * as path5 from "path";
+import * as fs3 from "fs";
+import * as path4 from "path";
 function emitMermaidFromMarkdown(checkName, markdown, origin) {
   if (!markdown || typeof markdown !== "string") return 0;
   let m;
@@ -5403,16 +4787,16 @@ function emitMermaidFromMarkdown(checkName, markdown, origin) {
         addEvent("diagram.block", { check: checkName, origin, code });
         addDiagramBlock(origin);
         if (process.env.VISOR_TRACE_REPORT === "true") {
-          const outDir = process.env.VISOR_TRACE_DIR || path5.join(process.cwd(), "output", "traces");
+          const outDir = process.env.VISOR_TRACE_DIR || path4.join(process.cwd(), "output", "traces");
           try {
-            if (!fs4.existsSync(outDir)) fs4.mkdirSync(outDir, { recursive: true });
+            if (!fs3.existsSync(outDir)) fs3.mkdirSync(outDir, { recursive: true });
             const ts = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
-            const jsonPath = path5.join(outDir, `${ts}.trace.json`);
-            const htmlPath = path5.join(outDir, `${ts}.report.html`);
+            const jsonPath = path4.join(outDir, `${ts}.trace.json`);
+            const htmlPath = path4.join(outDir, `${ts}.report.html`);
             let data = { spans: [] };
-            if (fs4.existsSync(jsonPath)) {
+            if (fs3.existsSync(jsonPath)) {
               try {
-                data = JSON.parse(fs4.readFileSync(jsonPath, "utf8"));
+                data = JSON.parse(fs3.readFileSync(jsonPath, "utf8"));
               } catch {
                 data = { spans: [] };
               }
@@ -5420,9 +4804,9 @@ function emitMermaidFromMarkdown(checkName, markdown, origin) {
             data.spans.push({
               events: [{ name: "diagram.block", attrs: { check: checkName, origin, code } }]
             });
-            fs4.writeFileSync(jsonPath, JSON.stringify(data, null, 2), "utf8");
-            if (!fs4.existsSync(htmlPath)) {
-              fs4.writeFileSync(
+            fs3.writeFileSync(jsonPath, JSON.stringify(data, null, 2), "utf8");
+            if (!fs3.existsSync(htmlPath)) {
+              fs3.writeFileSync(
                 htmlPath,
                 '<!doctype html><html><head><meta charset="utf-8"/><title>Visor Trace Report</title></head><body><h2>Visor Trace Report</h2></body></html>',
                 "utf8"
@@ -6078,9 +5462,9 @@ var init_dependency_gating = __esm({
 // src/state-machine/dispatch/template-renderer.ts
 async function renderTemplateContent(checkId, checkConfig, reviewSummary) {
   try {
-    const { createExtendedLiquid: createExtendedLiquid2 } = await import("./liquid-extensions-YDIIH33Q.mjs");
-    const fs11 = await import("fs/promises");
-    const path14 = await import("path");
+    const { createExtendedLiquid: createExtendedLiquid2 } = await import("./liquid-extensions-PLBOMRLI.mjs");
+    const fs10 = await import("fs/promises");
+    const path13 = await import("path");
     const schemaRaw = checkConfig.schema || "plain";
     const schema = typeof schemaRaw === "string" ? schemaRaw : "code-review";
     let templateContent;
@@ -6088,24 +5472,24 @@ async function renderTemplateContent(checkId, checkConfig, reviewSummary) {
       templateContent = String(checkConfig.template.content);
     } else if (checkConfig.template && checkConfig.template.file) {
       const file = String(checkConfig.template.file);
-      const resolved = path14.resolve(process.cwd(), file);
-      templateContent = await fs11.readFile(resolved, "utf-8");
+      const resolved = path13.resolve(process.cwd(), file);
+      templateContent = await fs10.readFile(resolved, "utf-8");
     } else if (schema && schema !== "plain") {
       const sanitized = String(schema).replace(/[^a-zA-Z0-9-]/g, "");
       if (sanitized) {
         const candidatePaths = [
-          path14.join(__dirname, "output", sanitized, "template.liquid"),
+          path13.join(__dirname, "output", sanitized, "template.liquid"),
           // bundled: dist/output/
-          path14.join(__dirname, "..", "..", "output", sanitized, "template.liquid"),
+          path13.join(__dirname, "..", "..", "output", sanitized, "template.liquid"),
           // source: output/
-          path14.join(process.cwd(), "output", sanitized, "template.liquid"),
+          path13.join(process.cwd(), "output", sanitized, "template.liquid"),
           // fallback: cwd/output/
-          path14.join(process.cwd(), "dist", "output", sanitized, "template.liquid")
+          path13.join(process.cwd(), "dist", "output", sanitized, "template.liquid")
           // fallback: cwd/dist/output/
         ];
         for (const p of candidatePaths) {
           try {
-            templateContent = await fs11.readFile(p, "utf-8");
+            templateContent = await fs10.readFile(p, "utf-8");
             if (templateContent) break;
           } catch {
           }
@@ -7394,6 +6778,7 @@ async function executeSingleCheck(checkId, context2, state, emitEvent, transitio
       ...checkConfig,
       eventContext: context2.prInfo?.eventContext || {},
       __outputHistory: outputHistory,
+      __globalTools: context2.config.tools || {},
       // Propagate workflow inputs for template access via {{ inputs.* }}
       workflowInputs,
       ai: {
@@ -8790,7 +8175,7 @@ async function executeCheckWithForEachItems2(checkId, forEachParent, forEachItem
           }
         }
         try {
-          const { evaluateTransitions } = await import("./routing-MVDVJDYJ.mjs");
+          const { evaluateTransitions } = await import("./routing-HR6N43RQ.mjs");
           const transTarget = await evaluateTransitions(
             onFinish.transitions,
             forEachParent,
@@ -8850,7 +8235,7 @@ async function executeCheckWithForEachItems2(checkId, forEachParent, forEachItem
             `[LevelDispatch] Error evaluating on_finish transitions for ${forEachParent}: ${e instanceof Error ? e.message : String(e)}`
           );
         }
-        const { evaluateGoto: evaluateGoto2 } = await import("./routing-MVDVJDYJ.mjs");
+        const { evaluateGoto: evaluateGoto2 } = await import("./routing-HR6N43RQ.mjs");
         if (context2.debug) {
           logger.info(
             `[LevelDispatch] Evaluating on_finish.goto_js for forEach parent: ${forEachParent}`
@@ -10102,9 +9487,9 @@ function updateStats2(results, state, isForEachIteration = false) {
 }
 async function renderTemplateContent2(checkId, checkConfig, reviewSummary) {
   try {
-    const { createExtendedLiquid: createExtendedLiquid2 } = await import("./liquid-extensions-YDIIH33Q.mjs");
-    const fs11 = await import("fs/promises");
-    const path14 = await import("path");
+    const { createExtendedLiquid: createExtendedLiquid2 } = await import("./liquid-extensions-PLBOMRLI.mjs");
+    const fs10 = await import("fs/promises");
+    const path13 = await import("path");
     const schemaRaw = checkConfig.schema || "plain";
     const schema = typeof schemaRaw === "string" && !schemaRaw.includes("{{") && !schemaRaw.includes("{%") ? schemaRaw : typeof schemaRaw === "object" ? "code-review" : "plain";
     let templateContent;
@@ -10113,27 +9498,27 @@ async function renderTemplateContent2(checkId, checkConfig, reviewSummary) {
       logger.debug(`[LevelDispatch] Using inline template for ${checkId}`);
     } else if (checkConfig.template && checkConfig.template.file) {
       const file = String(checkConfig.template.file);
-      const resolved = path14.resolve(process.cwd(), file);
-      templateContent = await fs11.readFile(resolved, "utf-8");
+      const resolved = path13.resolve(process.cwd(), file);
+      templateContent = await fs10.readFile(resolved, "utf-8");
       logger.debug(`[LevelDispatch] Using template file for ${checkId}: ${resolved}`);
     } else if (schema && schema !== "plain") {
       const sanitized = String(schema).replace(/[^a-zA-Z0-9-]/g, "");
       if (sanitized) {
         const candidatePaths = [
-          path14.join(__dirname, "output", sanitized, "template.liquid"),
+          path13.join(__dirname, "output", sanitized, "template.liquid"),
           // bundled: dist/output/
-          path14.join(__dirname, "..", "..", "output", sanitized, "template.liquid"),
+          path13.join(__dirname, "..", "..", "output", sanitized, "template.liquid"),
           // source (from state-machine/states)
-          path14.join(__dirname, "..", "..", "..", "output", sanitized, "template.liquid"),
+          path13.join(__dirname, "..", "..", "..", "output", sanitized, "template.liquid"),
           // source (alternate)
-          path14.join(process.cwd(), "output", sanitized, "template.liquid"),
+          path13.join(process.cwd(), "output", sanitized, "template.liquid"),
           // fallback: cwd/output/
-          path14.join(process.cwd(), "dist", "output", sanitized, "template.liquid")
+          path13.join(process.cwd(), "dist", "output", sanitized, "template.liquid")
           // fallback: cwd/dist/output/
         ];
         for (const p of candidatePaths) {
           try {
-            templateContent = await fs11.readFile(p, "utf-8");
+            templateContent = await fs10.readFile(p, "utf-8");
             if (templateContent) {
               logger.debug(`[LevelDispatch] Using schema template for ${checkId}: ${p}`);
               break;
@@ -11375,7 +10760,7 @@ var init_sandbox_manager = __esm({
 
 // src/utils/workspace-manager.ts
 import * as fsp from "fs/promises";
-import * as path6 from "path";
+import * as path5 from "path";
 function shellEscape(str) {
   return "'" + str.replace(/'/g, "'\\''") + "'";
 }
@@ -11419,7 +10804,7 @@ var init_workspace_manager = __esm({
         };
         this.basePath = this.config.basePath;
         const workspaceDirName = sanitizePathComponent(this.config.name || this.sessionId);
-        this.workspacePath = path6.join(this.basePath, workspaceDirName);
+        this.workspacePath = path5.join(this.basePath, workspaceDirName);
       }
       /**
        * Get or create a WorkspaceManager instance for a session
@@ -11514,7 +10899,7 @@ var init_workspace_manager = __esm({
           configuredMainProjectName || this.extractProjectName(this.originalPath)
         );
         this.usedNames.add(mainProjectName);
-        const mainProjectPath = path6.join(this.workspacePath, mainProjectName);
+        const mainProjectPath = path5.join(this.workspacePath, mainProjectName);
         const isGitRepo = await this.isGitRepository(this.originalPath);
         if (isGitRepo) {
           await this.createMainProjectWorktree(mainProjectPath);
@@ -11555,7 +10940,7 @@ var init_workspace_manager = __esm({
         let projectName = sanitizePathComponent(description || this.extractRepoName(repository));
         projectName = this.getUniqueName(projectName);
         this.usedNames.add(projectName);
-        const workspacePath = path6.join(this.workspacePath, projectName);
+        const workspacePath = path5.join(this.workspacePath, projectName);
         await fsp.rm(workspacePath, { recursive: true, force: true });
         try {
           await fsp.symlink(worktreePath, workspacePath);
@@ -11694,7 +11079,7 @@ var init_workspace_manager = __esm({
        * Extract project name from path
        */
       extractProjectName(dirPath) {
-        return path6.basename(dirPath);
+        return path5.basename(dirPath);
       }
       /**
        * Extract repository name from owner/repo format
@@ -11925,8 +11310,8 @@ var init_summary = __esm({
 });
 
 // src/state-machine-execution-engine.ts
-import * as path7 from "path";
-import * as fs5 from "fs";
+import * as path6 from "path";
+import * as fs4 from "fs";
 function serializeRunState(state) {
   return {
     ...state,
@@ -12023,7 +11408,7 @@ var init_state_machine_execution_engine = __esm({
           try {
             const map = options?.webhookContext?.webhookData;
             if (map) {
-              const { CheckProviderRegistry: CheckProviderRegistry2 } = await import("./check-provider-registry-RRUZHGJI.mjs");
+              const { CheckProviderRegistry: CheckProviderRegistry2 } = await import("./check-provider-registry-SA2WHPLO.mjs");
               const reg = CheckProviderRegistry2.getInstance();
               const p = reg.getProvider("http_input");
               if (p && typeof p.setWebhookContext === "function") p.setWebhookContext(map);
@@ -12136,7 +11521,7 @@ var init_state_machine_execution_engine = __esm({
           logger.info("[StateMachine] Using state machine engine");
         }
         if (!config) {
-          const { ConfigManager } = await import("./config-FMIIATKX.mjs");
+          const { ConfigManager } = await import("./config-3UIU4TMP.mjs");
           const configManager = new ConfigManager();
           config = await configManager.getDefaultConfig();
           logger.debug("[StateMachine] Using default configuration (no config provided)");
@@ -12145,6 +11530,15 @@ var init_state_machine_execution_engine = __esm({
           ...config,
           tag_filter: tagFilter
         } : config;
+        try {
+          const { CheckProviderRegistry: CheckProviderRegistry2 } = await import("./check-provider-registry-SA2WHPLO.mjs");
+          const registry = CheckProviderRegistry2.getInstance();
+          registry.setCustomTools(configWithTagFilter.tools || {});
+        } catch (error) {
+          logger.warn(
+            `[StateMachine] Failed to register custom tools: ${error instanceof Error ? error.message : String(error)}`
+          );
+        }
         const context2 = this.buildEngineContext(
           configWithTagFilter,
           prInfo,
@@ -12201,7 +11595,7 @@ var init_state_machine_execution_engine = __esm({
           try {
             const webhookData = this.executionContext?.webhookContext?.webhookData;
             if (webhookData instanceof Map) {
-              const { extractSlackContext: extractSlackContext2 } = await import("./schedule-tool-handler-7DNEGDZC.mjs");
+              const { extractSlackContext: extractSlackContext2 } = await import("./schedule-tool-handler-Y2UABBXN.mjs");
               const slackCtx = extractSlackContext2(webhookData);
               if (slackCtx) {
                 const payload = Array.from(webhookData.values())[0];
@@ -12230,7 +11624,7 @@ var init_state_machine_execution_engine = __esm({
         if (Array.isArray(configWithTagFilter.frontends) && configWithTagFilter.frontends.length > 0) {
           try {
             const { EventBus } = await import("./event-bus-5K3Y2FCS.mjs");
-            const { FrontendsHost } = await import("./host-S3LSWESP.mjs");
+            const { FrontendsHost } = await import("./host-LOQWBHWT.mjs");
             const bus = new EventBus();
             context2.eventBus = bus;
             frontendsHost = new FrontendsHost(bus, logger);
@@ -12331,9 +11725,9 @@ var init_state_machine_execution_engine = __esm({
                   }
                   const checkId = String(ev?.checkId || "unknown");
                   const threadKey = ev?.threadKey || (channel && threadTs ? `${channel}:${threadTs}` : "session");
-                  const baseDir = process.env.VISOR_SNAPSHOT_DIR || path7.resolve(process.cwd(), ".visor", "snapshots");
-                  fs5.mkdirSync(baseDir, { recursive: true });
-                  const filePath = path7.join(baseDir, `${threadKey}-${checkId}.json`);
+                  const baseDir = process.env.VISOR_SNAPSHOT_DIR || path6.resolve(process.cwd(), ".visor", "snapshots");
+                  fs4.mkdirSync(baseDir, { recursive: true });
+                  const filePath = path6.join(baseDir, `${threadKey}-${checkId}.json`);
                   await this.saveSnapshotToFile(filePath);
                   logger.info(`[Snapshot] Saved run snapshot: ${filePath}`);
                   try {
@@ -12474,7 +11868,7 @@ var init_state_machine_execution_engine = __esm({
        * Does not include secrets. Intended for debugging and future resume support.
        */
       async saveSnapshotToFile(filePath) {
-        const fs11 = await import("fs/promises");
+        const fs10 = await import("fs/promises");
         const ctx = this._lastContext;
         const runner = this._lastRunner;
         if (!ctx || !runner) {
@@ -12494,14 +11888,14 @@ var init_state_machine_execution_engine = __esm({
           journal: entries,
           requestedChecks: ctx.requestedChecks || []
         };
-        await fs11.writeFile(filePath, JSON.stringify(payload, null, 2), "utf8");
+        await fs10.writeFile(filePath, JSON.stringify(payload, null, 2), "utf8");
       }
       /**
        * Load a snapshot JSON from file and return it. Resume support can build on this.
        */
       async loadSnapshotFromFile(filePath) {
-        const fs11 = await import("fs/promises");
-        const raw = await fs11.readFile(filePath, "utf8");
+        const fs10 = await import("fs/promises");
+        const raw = await fs10.readFile(filePath, "utf8");
         return JSON.parse(raw);
       }
       /**
@@ -12580,9 +11974,9 @@ var init_state_machine_execution_engine = __esm({
        * @returns Array of failure condition evaluation results
        */
       async evaluateFailureConditions(checkName, reviewSummary, config, previousOutputs, authorAssociation) {
-        const { FailureConditionEvaluator: FailureConditionEvaluator2 } = await import("./failure-condition-evaluator-MUUAK7MN.mjs");
+        const { FailureConditionEvaluator: FailureConditionEvaluator2 } = await import("./failure-condition-evaluator-3B3G5NYW.mjs");
         const evaluator = new FailureConditionEvaluator2();
-        const { addEvent: addEvent3 } = await import("./trace-helpers-KSPGA24B.mjs");
+        const { addEvent: addEvent3 } = await import("./trace-helpers-IGMH7ZPP.mjs");
         const { addFailIfTriggered } = await import("./metrics-I6A7IHG4.mjs");
         const checkConfig = config.checks?.[checkName];
         if (!checkConfig) {
@@ -13466,7 +12860,23 @@ var init_mcp_custom_sse_server = __esm({
        * Handle tools/list MCP request
        */
       async handleToolsList(id) {
-        const allTools = Array.from(this.tools.values());
+        const normalizeInputSchema = (schema) => {
+          if (schema && schema.type === "object") {
+            return schema;
+          }
+          return {
+            type: "object",
+            properties: {},
+            required: []
+          };
+        };
+        const regularTools = await this.toolExecutor.listMcpTools();
+        const workflowTools = Array.from(this.tools.values()).filter(isWorkflowTool).map((tool) => ({
+          name: tool.name,
+          description: tool.description || `Execute ${tool.name}`,
+          inputSchema: normalizeInputSchema(tool.inputSchema)
+        }));
+        const allTools = [...regularTools, ...workflowTools];
         if (this.debug) {
           logger.debug(
             `[CustomToolsSSEServer:${this.sessionId}] Listing ${allTools.length} tools: ${allTools.map((t) => t.name).join(", ")}`
@@ -13479,11 +12889,7 @@ var init_mcp_custom_sse_server = __esm({
             tools: allTools.map((tool) => ({
               name: tool.name,
               description: tool.description || `Execute ${tool.name}`,
-              inputSchema: tool.inputSchema || {
-                type: "object",
-                properties: {},
-                required: []
-              }
+              inputSchema: normalizeInputSchema(tool.inputSchema)
             }))
           }
         };
@@ -13673,9 +13079,46 @@ var init_mcp_custom_sse_server = __esm({
   }
 });
 
+// src/utils/tool-resolver.ts
+function resolveTools(toolItems, globalTools, logPrefix = "[ToolResolver]") {
+  const tools = /* @__PURE__ */ new Map();
+  for (const item of toolItems) {
+    const workflowTool = resolveWorkflowToolFromItem(item);
+    if (workflowTool) {
+      logger.debug(`${logPrefix} Loaded workflow '${workflowTool.name}' as tool`);
+      tools.set(workflowTool.name, workflowTool);
+      continue;
+    }
+    if (typeof item === "string") {
+      if (globalTools && globalTools[item]) {
+        const tool = globalTools[item];
+        tool.name = tool.name || item;
+        tools.set(item, tool);
+        continue;
+      }
+      logger.warn(`${logPrefix} Tool '${item}' not found in global tools or workflow registry`);
+    } else if (isWorkflowToolReference(item)) {
+      logger.warn(`${logPrefix} Workflow '${item.workflow}' referenced but not found in registry`);
+    }
+  }
+  if (tools.size === 0 && toolItems.length > 0 && !globalTools) {
+    logger.warn(
+      `${logPrefix} Tools specified but no global tools found in configuration and no workflows matched`
+    );
+  }
+  return tools;
+}
+var init_tool_resolver = __esm({
+  "src/utils/tool-resolver.ts"() {
+    "use strict";
+    init_workflow_tool_executor();
+    init_logger();
+  }
+});
+
 // src/providers/ai-check-provider.ts
-import fs6 from "fs/promises";
-import path8 from "path";
+import fs5 from "fs/promises";
+import path7 from "path";
 var AICheckProvider;
 var init_ai_check_provider = __esm({
   "src/providers/ai-check-provider.ts"() {
@@ -13690,6 +13133,7 @@ var init_ai_check_provider = __esm({
     init_mcp_custom_sse_server();
     init_logger();
     init_workflow_tool_executor();
+    init_tool_resolver();
     init_sandbox();
     init_schedule_tool();
     init_schedule_tool_handler();
@@ -13848,7 +13292,7 @@ var init_ai_check_provider = __esm({
         const hasFileExtension = /\.[a-zA-Z0-9]{1,10}$/i.test(str);
         const hasPathSeparators = /[\/\\]/.test(str);
         const isRelativePath = /^\.{1,2}\//.test(str);
-        const isAbsolutePath = path8.isAbsolute(str);
+        const isAbsolutePath = path7.isAbsolute(str);
         const hasTypicalFileChars = /^[a-zA-Z0-9._\-\/\\:~]+$/.test(str);
         if (!(hasFileExtension || isRelativePath || isAbsolutePath || hasPathSeparators)) {
           return false;
@@ -13858,14 +13302,14 @@ var init_ai_check_provider = __esm({
         }
         try {
           let resolvedPath;
-          if (path8.isAbsolute(str)) {
-            resolvedPath = path8.normalize(str);
+          if (path7.isAbsolute(str)) {
+            resolvedPath = path7.normalize(str);
           } else {
-            resolvedPath = path8.resolve(process.cwd(), str);
+            resolvedPath = path7.resolve(process.cwd(), str);
           }
-          const fs11 = __require("fs").promises;
+          const fs10 = __require("fs").promises;
           try {
-            const stat = await fs11.stat(resolvedPath);
+            const stat = await fs10.stat(resolvedPath);
             return stat.isFile();
           } catch {
             return hasFileExtension && (isRelativePath || isAbsolutePath || hasPathSeparators);
@@ -13882,14 +13326,14 @@ var init_ai_check_provider = __esm({
           throw new Error("Prompt file must have .liquid extension");
         }
         let resolvedPath;
-        if (path8.isAbsolute(promptPath)) {
+        if (path7.isAbsolute(promptPath)) {
           resolvedPath = promptPath;
         } else {
-          resolvedPath = path8.resolve(process.cwd(), promptPath);
+          resolvedPath = path7.resolve(process.cwd(), promptPath);
         }
-        if (!path8.isAbsolute(promptPath)) {
-          const normalizedPath = path8.normalize(resolvedPath);
-          const currentDir = path8.resolve(process.cwd());
+        if (!path7.isAbsolute(promptPath)) {
+          const normalizedPath = path7.normalize(resolvedPath);
+          const currentDir = path7.resolve(process.cwd());
           if (!normalizedPath.startsWith(currentDir)) {
             throw new Error("Invalid prompt file path: path traversal detected");
           }
@@ -13898,7 +13342,7 @@ var init_ai_check_provider = __esm({
           throw new Error("Invalid prompt file path: path traversal detected");
         }
         try {
-          const promptContent = await fs6.readFile(resolvedPath, "utf-8");
+          const promptContent = await fs5.readFile(resolvedPath, "utf-8");
           return promptContent;
         } catch (error) {
           throw new Error(
@@ -15301,37 +14745,8 @@ ${processedPrompt}` : processedPrompt;
        * Supports both traditional custom tools and workflow-as-tool references
        */
       loadCustomTools(toolItems, config) {
-        const tools = /* @__PURE__ */ new Map();
         const globalTools = config.__globalTools;
-        for (const item of toolItems) {
-          const workflowTool = resolveWorkflowToolFromItem(item);
-          if (workflowTool) {
-            logger.debug(`[AICheckProvider] Loaded workflow '${workflowTool.name}' as custom tool`);
-            tools.set(workflowTool.name, workflowTool);
-            continue;
-          }
-          if (typeof item === "string") {
-            if (globalTools && globalTools[item]) {
-              const tool = globalTools[item];
-              tool.name = tool.name || item;
-              tools.set(item, tool);
-              continue;
-            }
-            logger.warn(
-              `[AICheckProvider] Custom tool '${item}' not found in global tools or workflow registry`
-            );
-          } else if (isWorkflowToolReference(item)) {
-            logger.warn(
-              `[AICheckProvider] Workflow '${item.workflow}' referenced but not found in registry`
-            );
-          }
-        }
-        if (tools.size === 0 && toolItems.length > 0 && !globalTools) {
-          logger.warn(
-            `[AICheckProvider] ai_custom_tools specified but no global tools found in configuration and no workflows matched`
-          );
-        }
-        return tools;
+        return resolveTools(toolItems, globalTools, "[AICheckProvider]");
       }
       /**
        * Intersect config-level allowedTools with policy-level allowedTools.
@@ -15881,8 +15296,8 @@ var init_template_context = __esm({
 });
 
 // src/providers/http-client-provider.ts
-import * as fs7 from "fs";
-import * as path9 from "path";
+import * as fs6 from "fs";
+import * as path8 from "path";
 var HttpClientProvider;
 var init_http_client_provider = __esm({
   "src/providers/http-client-provider.ts"() {
@@ -15987,14 +15402,14 @@ var init_http_client_provider = __esm({
             const parentContext = context2?._parentContext;
             const workingDirectory = parentContext?.workingDirectory;
             const workspaceEnabled = parentContext?.workspace?.isEnabled?.();
-            if (workspaceEnabled && workingDirectory && !path9.isAbsolute(resolvedOutputFile)) {
-              resolvedOutputFile = path9.join(workingDirectory, resolvedOutputFile);
+            if (workspaceEnabled && workingDirectory && !path8.isAbsolute(resolvedOutputFile)) {
+              resolvedOutputFile = path8.join(workingDirectory, resolvedOutputFile);
               logger.debug(
                 `[http_client] Resolved relative output_file to workspace: ${resolvedOutputFile}`
               );
             }
-            if (skipIfExists && fs7.existsSync(resolvedOutputFile)) {
-              const stats = fs7.statSync(resolvedOutputFile);
+            if (skipIfExists && fs6.existsSync(resolvedOutputFile)) {
+              const stats = fs6.statSync(resolvedOutputFile);
               logger.verbose(`[http_client] File cached: ${resolvedOutputFile} (${stats.size} bytes)`);
               return {
                 issues: [],
@@ -16205,13 +15620,13 @@ var init_http_client_provider = __esm({
               ]
             };
           }
-          const parentDir = path9.dirname(outputFile);
-          if (parentDir && !fs7.existsSync(parentDir)) {
-            fs7.mkdirSync(parentDir, { recursive: true });
+          const parentDir = path8.dirname(outputFile);
+          if (parentDir && !fs6.existsSync(parentDir)) {
+            fs6.mkdirSync(parentDir, { recursive: true });
           }
           const arrayBuffer = await response.arrayBuffer();
           const buffer = Buffer.from(arrayBuffer);
-          fs7.writeFileSync(outputFile, buffer);
+          fs6.writeFileSync(outputFile, buffer);
           const contentType = response.headers.get("content-type") || "application/octet-stream";
           logger.verbose(`[http_client] Downloaded: ${outputFile} (${buffer.length} bytes)`);
           return {
@@ -16967,8 +16382,8 @@ var init_claude_code_types = __esm({
 });
 
 // src/providers/claude-code-check-provider.ts
-import fs8 from "fs/promises";
-import path10 from "path";
+import fs7 from "fs/promises";
+import path9 from "path";
 function isClaudeCodeConstructor(value) {
   return typeof value === "function";
 }
@@ -17127,7 +16542,7 @@ var init_claude_code_check_provider = __esm({
         const hasFileExtension = /\.[a-zA-Z0-9]{1,10}$/i.test(str);
         const hasPathSeparators = /[\/\\]/.test(str);
         const isRelativePath = /^\.{1,2}\//.test(str);
-        const isAbsolutePath = path10.isAbsolute(str);
+        const isAbsolutePath = path9.isAbsolute(str);
         const hasTypicalFileChars = /^[a-zA-Z0-9._\-\/\\:~]+$/.test(str);
         if (!(hasFileExtension || isRelativePath || isAbsolutePath || hasPathSeparators)) {
           return false;
@@ -17137,13 +16552,13 @@ var init_claude_code_check_provider = __esm({
         }
         try {
           let resolvedPath;
-          if (path10.isAbsolute(str)) {
-            resolvedPath = path10.normalize(str);
+          if (path9.isAbsolute(str)) {
+            resolvedPath = path9.normalize(str);
           } else {
-            resolvedPath = path10.resolve(process.cwd(), str);
+            resolvedPath = path9.resolve(process.cwd(), str);
           }
           try {
-            const stat = await fs8.stat(resolvedPath);
+            const stat = await fs7.stat(resolvedPath);
             return stat.isFile();
           } catch {
             return hasFileExtension && (isRelativePath || isAbsolutePath || hasPathSeparators);
@@ -17160,14 +16575,14 @@ var init_claude_code_check_provider = __esm({
           throw new Error("Prompt file must have .liquid extension");
         }
         let resolvedPath;
-        if (path10.isAbsolute(promptPath)) {
+        if (path9.isAbsolute(promptPath)) {
           resolvedPath = promptPath;
         } else {
-          resolvedPath = path10.resolve(process.cwd(), promptPath);
+          resolvedPath = path9.resolve(process.cwd(), promptPath);
         }
-        if (!path10.isAbsolute(promptPath)) {
-          const normalizedPath = path10.normalize(resolvedPath);
-          const currentDir = path10.resolve(process.cwd());
+        if (!path9.isAbsolute(promptPath)) {
+          const normalizedPath = path9.normalize(resolvedPath);
+          const currentDir = path9.resolve(process.cwd());
           if (!normalizedPath.startsWith(currentDir)) {
             throw new Error("Invalid prompt file path: path traversal detected");
           }
@@ -17176,7 +16591,7 @@ var init_claude_code_check_provider = __esm({
           throw new Error("Invalid prompt file path: path traversal detected");
         }
         try {
-          const promptContent = await fs8.readFile(resolvedPath, "utf-8");
+          const promptContent = await fs7.readFile(resolvedPath, "utf-8");
           return promptContent;
         } catch (error) {
           throw new Error(
@@ -17528,6 +16943,7 @@ var init_command_check_provider = __esm({
     init_sandbox();
     init_liquid_extensions();
     init_logger();
+    init_env_resolver();
     init_command_executor();
     init_author_permissions();
     init_lazy_otel();
@@ -17729,7 +17145,7 @@ var init_command_check_provider = __esm({
           if (config.env) {
             for (const [key, value] of Object.entries(config.env)) {
               if (value !== void 0 && value !== null) {
-                scriptEnv[key] = String(value);
+                scriptEnv[key] = String(EnvironmentResolver.resolveValue(value));
               }
             }
           }
@@ -19745,14 +19161,14 @@ var require_util = __commonJS({
         }
         const port = url.port != null ? url.port : url.protocol === "https:" ? 443 : 80;
         let origin = url.origin != null ? url.origin : `${url.protocol}//${url.hostname}:${port}`;
-        let path14 = url.path != null ? url.path : `${url.pathname || ""}${url.search || ""}`;
+        let path13 = url.path != null ? url.path : `${url.pathname || ""}${url.search || ""}`;
         if (origin.endsWith("/")) {
           origin = origin.substring(0, origin.length - 1);
         }
-        if (path14 && !path14.startsWith("/")) {
-          path14 = `/${path14}`;
+        if (path13 && !path13.startsWith("/")) {
+          path13 = `/${path13}`;
         }
-        url = new URL(origin + path14);
+        url = new URL(origin + path13);
       }
       return url;
     }
@@ -21366,20 +20782,20 @@ var require_parseParams = __commonJS({
 var require_basename = __commonJS({
   "node_modules/@fastify/busboy/lib/utils/basename.js"(exports, module) {
     "use strict";
-    module.exports = function basename2(path14) {
-      if (typeof path14 !== "string") {
+    module.exports = function basename2(path13) {
+      if (typeof path13 !== "string") {
         return "";
       }
-      for (var i = path14.length - 1; i >= 0; --i) {
-        switch (path14.charCodeAt(i)) {
+      for (var i = path13.length - 1; i >= 0; --i) {
+        switch (path13.charCodeAt(i)) {
           case 47:
           // '/'
           case 92:
-            path14 = path14.slice(i + 1);
-            return path14 === ".." || path14 === "." ? "" : path14;
+            path13 = path13.slice(i + 1);
+            return path13 === ".." || path13 === "." ? "" : path13;
         }
       }
-      return path14 === ".." || path14 === "." ? "" : path14;
+      return path13 === ".." || path13 === "." ? "" : path13;
     };
   }
 });
@@ -24410,7 +23826,7 @@ var require_request = __commonJS({
     }
     var Request = class _Request {
       constructor(origin, {
-        path: path14,
+        path: path13,
         method,
         body,
         headers,
@@ -24424,11 +23840,11 @@ var require_request = __commonJS({
         throwOnError,
         expectContinue
       }, handler) {
-        if (typeof path14 !== "string") {
+        if (typeof path13 !== "string") {
           throw new InvalidArgumentError("path must be a string");
-        } else if (path14[0] !== "/" && !(path14.startsWith("http://") || path14.startsWith("https://")) && method !== "CONNECT") {
+        } else if (path13[0] !== "/" && !(path13.startsWith("http://") || path13.startsWith("https://")) && method !== "CONNECT") {
           throw new InvalidArgumentError("path must be an absolute URL or start with a slash");
-        } else if (invalidPathRegex.exec(path14) !== null) {
+        } else if (invalidPathRegex.exec(path13) !== null) {
           throw new InvalidArgumentError("invalid request path");
         }
         if (typeof method !== "string") {
@@ -24491,7 +23907,7 @@ var require_request = __commonJS({
         this.completed = false;
         this.aborted = false;
         this.upgrade = upgrade || null;
-        this.path = query ? util.buildURL(path14, query) : path14;
+        this.path = query ? util.buildURL(path13, query) : path13;
         this.origin = origin;
         this.idempotent = idempotent == null ? method === "HEAD" || method === "GET" : idempotent;
         this.blocking = blocking == null ? false : blocking;
@@ -25499,9 +24915,9 @@ var require_RedirectHandler = __commonJS({
           return this.handler.onHeaders(statusCode, headers, resume, statusText);
         }
         const { origin, pathname, search } = util.parseURL(new URL(this.location, this.opts.origin && new URL(this.opts.path, this.opts.origin)));
-        const path14 = search ? `${pathname}${search}` : pathname;
+        const path13 = search ? `${pathname}${search}` : pathname;
         this.opts.headers = cleanRequestHeaders(this.opts.headers, statusCode === 303, this.opts.origin !== origin);
-        this.opts.path = path14;
+        this.opts.path = path13;
         this.opts.origin = origin;
         this.opts.maxRedirections = 0;
         this.opts.query = null;
@@ -26743,7 +26159,7 @@ var require_client = __commonJS({
         writeH2(client, client[kHTTP2Session], request);
         return;
       }
-      const { body, method, path: path14, host, upgrade, headers, blocking, reset } = request;
+      const { body, method, path: path13, host, upgrade, headers, blocking, reset } = request;
       const expectsPayload = method === "PUT" || method === "POST" || method === "PATCH";
       if (body && typeof body.read === "function") {
         body.read(0);
@@ -26793,7 +26209,7 @@ var require_client = __commonJS({
       if (blocking) {
         socket[kBlocking] = true;
       }
-      let header = `${method} ${path14} HTTP/1.1\r
+      let header = `${method} ${path13} HTTP/1.1\r
 `;
       if (typeof host === "string") {
         header += `host: ${host}\r
@@ -26856,7 +26272,7 @@ upgrade: ${upgrade}\r
       return true;
     }
     function writeH2(client, session, request) {
-      const { body, method, path: path14, host, upgrade, expectContinue, signal, headers: reqHeaders } = request;
+      const { body, method, path: path13, host, upgrade, expectContinue, signal, headers: reqHeaders } = request;
       let headers;
       if (typeof reqHeaders === "string") headers = Request[kHTTP2CopyHeaders](reqHeaders.trim());
       else headers = reqHeaders;
@@ -26899,7 +26315,7 @@ upgrade: ${upgrade}\r
         });
         return true;
       }
-      headers[HTTP2_HEADER_PATH] = path14;
+      headers[HTTP2_HEADER_PATH] = path13;
       headers[HTTP2_HEADER_SCHEME] = "https";
       const expectsPayload = method === "PUT" || method === "POST" || method === "PATCH";
       if (body && typeof body.read === "function") {
@@ -29142,20 +28558,20 @@ var require_mock_utils = __commonJS({
       }
       return true;
     }
-    function safeUrl(path14) {
-      if (typeof path14 !== "string") {
-        return path14;
+    function safeUrl(path13) {
+      if (typeof path13 !== "string") {
+        return path13;
       }
-      const pathSegments = path14.split("?");
+      const pathSegments = path13.split("?");
       if (pathSegments.length !== 2) {
-        return path14;
+        return path13;
       }
       const qp = new URLSearchParams(pathSegments.pop());
       qp.sort();
       return [...pathSegments, qp.toString()].join("?");
     }
-    function matchKey(mockDispatch2, { path: path14, method, body, headers }) {
-      const pathMatch = matchValue(mockDispatch2.path, path14);
+    function matchKey(mockDispatch2, { path: path13, method, body, headers }) {
+      const pathMatch = matchValue(mockDispatch2.path, path13);
       const methodMatch = matchValue(mockDispatch2.method, method);
       const bodyMatch = typeof mockDispatch2.body !== "undefined" ? matchValue(mockDispatch2.body, body) : true;
       const headersMatch = matchHeaders(mockDispatch2, headers);
@@ -29173,7 +28589,7 @@ var require_mock_utils = __commonJS({
     function getMockDispatch(mockDispatches, key) {
       const basePath = key.query ? buildURL(key.path, key.query) : key.path;
       const resolvedPath = typeof basePath === "string" ? safeUrl(basePath) : basePath;
-      let matchedMockDispatches = mockDispatches.filter(({ consumed }) => !consumed).filter(({ path: path14 }) => matchValue(safeUrl(path14), resolvedPath));
+      let matchedMockDispatches = mockDispatches.filter(({ consumed }) => !consumed).filter(({ path: path13 }) => matchValue(safeUrl(path13), resolvedPath));
       if (matchedMockDispatches.length === 0) {
         throw new MockNotMatchedError(`Mock dispatch not matched for path '${resolvedPath}'`);
       }
@@ -29210,9 +28626,9 @@ var require_mock_utils = __commonJS({
       }
     }
     function buildKey(opts) {
-      const { path: path14, method, body, headers, query } = opts;
+      const { path: path13, method, body, headers, query } = opts;
       return {
-        path: path14,
+        path: path13,
         method,
         body,
         headers,
@@ -29661,10 +29077,10 @@ var require_pending_interceptors_formatter = __commonJS({
       }
       format(pendingInterceptors) {
         const withPrettyHeaders = pendingInterceptors.map(
-          ({ method, path: path14, data: { statusCode }, persist, times, timesInvoked, origin }) => ({
+          ({ method, path: path13, data: { statusCode }, persist, times, timesInvoked, origin }) => ({
             Method: method,
             Origin: origin,
-            Path: path14,
+            Path: path13,
             "Status code": statusCode,
             Persistent: persist ? "\u2705" : "\u274C",
             Invocations: timesInvoked,
@@ -34285,8 +33701,8 @@ var require_util6 = __commonJS({
         }
       }
     }
-    function validateCookiePath(path14) {
-      for (const char of path14) {
+    function validateCookiePath(path13) {
+      for (const char of path13) {
         const code = char.charCodeAt(0);
         if (code < 33 || char === ";") {
           throw new Error("Invalid cookie path");
@@ -35966,11 +35382,11 @@ var require_undici = __commonJS({
           if (typeof opts.path !== "string") {
             throw new InvalidArgumentError("invalid opts.path");
           }
-          let path14 = opts.path;
+          let path13 = opts.path;
           if (!opts.path.startsWith("/")) {
-            path14 = `/${path14}`;
+            path13 = `/${path13}`;
           }
-          url = new URL(util.parseOrigin(url).origin + path14);
+          url = new URL(util.parseOrigin(url).origin + path13);
         } else {
           if (!opts) {
             opts = typeof url === "object" ? url : {};
@@ -36398,10 +35814,11 @@ var init_mcp_check_provider = __esm({
               'No custom tools available. Define tools in the "tools" section of your configuration.'
             );
           }
-          const tool = this.customToolExecutor.getTool(config.method);
-          if (!tool) {
+          const hasTool = await this.customToolExecutor.hasTool(config.method);
+          if (!hasTool) {
+            const availableToolNames = await this.customToolExecutor.getToolNames();
             throw new Error(
-              `Custom tool not found: ${config.method}. Available tools: ${this.customToolExecutor.getTools().map((t) => t.name).join(", ")}`
+              `Custom tool not found: ${config.method}. Available tools: ${availableToolNames.join(", ")}`
             );
           }
           const context2 = {
@@ -36512,11 +35929,24 @@ var init_mcp_check_provider = __esm({
        * Execute MCP method using stdio transport
        */
       async executeStdioMethod(config, methodArgs, timeout) {
+        const env = {};
+        for (const [key, value] of Object.entries(process.env)) {
+          if (value !== void 0) {
+            env[key] = value;
+          }
+        }
+        if (config.env) {
+          for (const [key, value] of Object.entries(config.env)) {
+            if (value !== void 0 && value !== null) {
+              env[key] = String(EnvironmentResolver.resolveValue(value));
+            }
+          }
+        }
         return this.executeWithTransport(
           () => new StdioClientTransport({
             command: config.command,
             args: config.command_args,
-            env: config.env,
+            env,
             cwd: config.workingDirectory,
             stderr: "pipe"
             // Prevent child stderr from corrupting TUI
@@ -37092,8 +36522,8 @@ var init_stdin_reader = __esm({
 });
 
 // src/providers/human-input-check-provider.ts
-import * as fs9 from "fs";
-import * as path11 from "path";
+import * as fs8 from "fs";
+import * as path10 from "path";
 var HumanInputCheckProvider;
 var init_human_input_check_provider = __esm({
   "src/providers/human-input-check-provider.ts"() {
@@ -37276,19 +36706,19 @@ var init_human_input_check_provider = __esm({
        */
       async tryReadFile(filePath) {
         try {
-          const absolutePath = path11.isAbsolute(filePath) ? filePath : path11.resolve(process.cwd(), filePath);
-          const normalizedPath = path11.normalize(absolutePath);
+          const absolutePath = path10.isAbsolute(filePath) ? filePath : path10.resolve(process.cwd(), filePath);
+          const normalizedPath = path10.normalize(absolutePath);
           const cwd = process.cwd();
-          if (!normalizedPath.startsWith(cwd + path11.sep) && normalizedPath !== cwd) {
+          if (!normalizedPath.startsWith(cwd + path10.sep) && normalizedPath !== cwd) {
             return null;
           }
           try {
-            await fs9.promises.access(normalizedPath, fs9.constants.R_OK);
-            const stats = await fs9.promises.stat(normalizedPath);
+            await fs8.promises.access(normalizedPath, fs8.constants.R_OK);
+            const stats = await fs8.promises.stat(normalizedPath);
             if (!stats.isFile()) {
               return null;
             }
-            const content = await fs9.promises.readFile(normalizedPath, "utf-8");
+            const content = await fs8.promises.readFile(normalizedPath, "utf-8");
             return content.trim();
           } catch {
             return null;
@@ -37573,6 +37003,494 @@ ${snippet}`
   }
 });
 
+// src/utils/script-tool-environment.ts
+import * as acorn from "acorn";
+import * as walk from "acorn-walk";
+function formatSyntaxError(code, err) {
+  const line = err.loc?.line ?? 0;
+  const col = err.loc?.column ?? 0;
+  const baseMsg = err.message?.replace(/\s*\(\d+:\d+\)$/, "") || "Syntax error";
+  if (!line) return `Syntax error: ${baseMsg}`;
+  const lines = code.split("\n");
+  const snippetLines = [];
+  const start = Math.max(0, line - 2);
+  const end = Math.min(lines.length, line + 1);
+  for (let i = start; i < end; i++) {
+    const lineNum = String(i + 1).padStart(3, " ");
+    if (i === line - 1) {
+      snippetLines.push(`  > ${lineNum} | ${lines[i]}`);
+      snippetLines.push(`    ${" ".repeat(lineNum.length)} | ${" ".repeat(col)}^`);
+    } else {
+      snippetLines.push(`    ${lineNum} | ${lines[i]}`);
+    }
+  }
+  return `Syntax error at line ${line}, column ${col}: ${baseMsg}
+
+${snippetLines.join("\n")}`;
+}
+function levenshtein(a, b) {
+  const m = a.length;
+  const n = b.length;
+  const dp = Array.from({ length: m + 1 }, () => Array(n + 1).fill(0));
+  for (let i = 0; i <= m; i++) dp[i][0] = i;
+  for (let j = 0; j <= n; j++) dp[0][j] = j;
+  for (let i = 1; i <= m; i++) {
+    for (let j = 1; j <= n; j++) {
+      dp[i][j] = a[i - 1] === b[j - 1] ? dp[i - 1][j - 1] : 1 + Math.min(dp[i - 1][j], dp[i][j - 1], dp[i - 1][j - 1]);
+    }
+  }
+  return dp[m][n];
+}
+function transformScriptForAsync(code, asyncFunctionNames, opts) {
+  if (asyncFunctionNames.size === 0) {
+    return `return (() => {
+${code}
+})()`;
+  }
+  let ast;
+  try {
+    ast = acorn.parse(code, {
+      ecmaVersion: 2022,
+      sourceType: "script",
+      allowReturnOutsideFunction: true,
+      locations: true
+    });
+  } catch (e) {
+    throw new Error(formatSyntaxError(code, e));
+  }
+  if (opts?.knownGlobals) {
+    lintUnknownCalls(code, ast, opts.knownGlobals, opts.disabledBuiltins);
+  }
+  const insertions = [];
+  const functionsNeedingAsync = /* @__PURE__ */ new Set();
+  const functionScopes = [];
+  walk.full(ast, (node) => {
+    if (node.type === "ArrowFunctionExpression" || node.type === "FunctionExpression") {
+      functionScopes.push(node);
+    }
+  });
+  walk.full(ast, (node) => {
+    if (node.type !== "CallExpression") return;
+    const calleeName = getCalleeName(node);
+    if (!calleeName || !asyncFunctionNames.has(calleeName)) return;
+    insertions.push({ offset: node.start, text: "await " });
+    for (const fn of functionScopes) {
+      const body2 = fn.body;
+      if (body2 && body2.start <= node.start && body2.end >= node.end) {
+        functionsNeedingAsync.add(fn);
+      }
+    }
+  });
+  walk.full(ast, (node) => {
+    if (node.type !== "CallExpression") return;
+    const callNode = node;
+    const calleeName = getCalleeName(callNode);
+    if (calleeName !== "map" || !callNode.arguments || callNode.arguments.length < 2) return;
+    const callback = callNode.arguments[1];
+    if (callback.type === "ArrowFunctionExpression" || callback.type === "FunctionExpression") {
+      let hasAsyncCall = false;
+      walk.full(callback, (inner) => {
+        if (inner.type === "CallExpression") {
+          const innerName = getCalleeName(inner);
+          if (innerName && asyncFunctionNames.has(innerName)) {
+            hasAsyncCall = true;
+          }
+        }
+      });
+      if (hasAsyncCall) {
+        functionsNeedingAsync.add(callback);
+      }
+    }
+  });
+  walk.full(ast, (node) => {
+    if (node.type === "WhileStatement" || node.type === "ForStatement" || node.type === "ForOfStatement" || node.type === "ForInStatement") {
+      const body2 = node.body;
+      if (body2 && body2.type === "BlockStatement" && body2.body && body2.body.length > 0) {
+        insertions.push({ offset: body2.start + 1, text: " __checkLoop();" });
+      }
+    }
+  });
+  for (const fn of functionsNeedingAsync) {
+    insertions.push({ offset: fn.start, text: "async " });
+  }
+  const body = ast.body;
+  if (body && body.length > 0) {
+    const lastStmt = body[body.length - 1];
+    if (lastStmt.type === "ExpressionStatement") {
+      insertions.push({ offset: lastStmt.start, text: "return " });
+    }
+  }
+  insertions.sort((a, b) => b.offset - a.offset);
+  let transformed = code;
+  for (const ins of insertions) {
+    transformed = transformed.slice(0, ins.offset) + ins.text + transformed.slice(ins.offset);
+  }
+  return `return (async () => {
+${transformed}
+})()`;
+}
+function getCalleeName(callExpr) {
+  const callee = callExpr.callee;
+  if (callee.type === "Identifier" && callee.name) {
+    return callee.name;
+  }
+  return null;
+}
+function lintUnknownCalls(_code, ast, knownGlobals, disabledBuiltins) {
+  const declaredFunctions = /* @__PURE__ */ new Set();
+  walk.full(ast, (node) => {
+    if (node.type === "FunctionDeclaration" && node.id?.name) {
+      declaredFunctions.add(node.id.name);
+    }
+    if (node.type === "VariableDeclarator" && node.id?.name) {
+      const init = node.init;
+      if (init && (init.type === "ArrowFunctionExpression" || init.type === "FunctionExpression")) {
+        declaredFunctions.add(node.id.name);
+      }
+    }
+  });
+  const warnings = [];
+  walk.full(ast, (node) => {
+    if (node.type !== "CallExpression") return;
+    const name = getCalleeName(node);
+    if (!name) return;
+    if (knownGlobals.has(name) || JS_BUILTINS.has(name) || declaredFunctions.has(name)) return;
+    const loc = node.loc?.start;
+    const lineInfo = loc ? ` (line ${loc.line}, column ${loc.column})` : "";
+    if (disabledBuiltins?.has(name)) {
+      const hint = disabledBuiltins.get(name);
+      warnings.push(`'${name}()' is not enabled${lineInfo}. ${hint}`);
+      return;
+    }
+    const allNames = [...knownGlobals];
+    let bestMatch = "";
+    let bestDist = Infinity;
+    for (const candidate of allNames) {
+      const dist = levenshtein(name.toLowerCase(), candidate.toLowerCase());
+      if (dist < bestDist) {
+        bestDist = dist;
+        bestMatch = candidate;
+      }
+    }
+    const maxLen = Math.max(name.length, bestMatch.length);
+    const suggestion = bestDist <= Math.ceil(maxLen * 0.4) ? ` Did you mean '${bestMatch}'?` : "";
+    warnings.push(`Unknown function '${name}()'${lineInfo}.${suggestion}`);
+  });
+  if (warnings.length > 0) {
+    throw new Error(`Script lint errors:
+${warnings.map((w) => `  - ${w}`).join("\n")}`);
+  }
+}
+function tryParseJSON(text) {
+  if (typeof text !== "string") return text;
+  const firstChar = text.trimStart()[0];
+  if (firstChar === "{" || firstChar === "[") {
+    try {
+      return JSON.parse(text);
+    } catch {
+    }
+  }
+  return text;
+}
+function buildToolGlobals(opts) {
+  const { resolvedTools, mcpClients, toolContext, workflowContext } = opts;
+  const globals = {};
+  const asyncFunctionNames = /* @__PURE__ */ new Set();
+  const commandTools = {};
+  for (const [name, tool] of resolvedTools) {
+    if (!isWorkflowTool(tool)) {
+      commandTools[name] = tool;
+    }
+  }
+  const toolExecutor = new CustomToolExecutor(commandTools);
+  const allToolInfo = [];
+  for (const [name, tool] of resolvedTools) {
+    const toolFn = async (args = {}) => {
+      try {
+        if (isWorkflowTool(tool)) {
+          if (!workflowContext) {
+            return `ERROR: Workflow context not available for tool '${name}'`;
+          }
+          return await executeWorkflowAsTool(
+            tool.__workflowId,
+            args,
+            workflowContext,
+            tool.__argsOverrides
+          );
+        }
+        return await toolExecutor.execute(name, args, toolContext);
+      } catch (e) {
+        const msg = e instanceof Error ? e.message : String(e);
+        logger.warn(`[script:${name}] Tool error: ${msg}`);
+        return `ERROR: ${msg}`;
+      }
+    };
+    globals[name] = toolFn;
+    asyncFunctionNames.add(name);
+    allToolInfo.push({ name, description: tool.description });
+  }
+  if (mcpClients) {
+    for (const entry of mcpClients) {
+      for (const mcpTool of entry.tools) {
+        const globalName = `${entry.serverName}_${mcpTool.name}`;
+        const mcpToolFn = async (args = {}) => {
+          try {
+            const result = await entry.client.callTool({
+              name: mcpTool.name,
+              arguments: args
+            });
+            const content = result?.content;
+            if (Array.isArray(content) && content.length > 0) {
+              const text = content[0]?.text;
+              if (text !== void 0) {
+                return tryParseJSON(text);
+              }
+            }
+            return result;
+          } catch (e) {
+            const msg = e instanceof Error ? e.message : String(e);
+            logger.warn(`[script:${globalName}] MCP tool error: ${msg}`);
+            return `ERROR: ${msg}`;
+          }
+        };
+        globals[globalName] = mcpToolFn;
+        asyncFunctionNames.add(globalName);
+        allToolInfo.push({ name: globalName, description: mcpTool.description });
+      }
+    }
+  }
+  const callToolFn = async (name, args = {}) => {
+    const fn = globals[name];
+    if (!fn || typeof fn !== "function") {
+      const available = Array.from(asyncFunctionNames).join(", ");
+      return `ERROR: Tool '${name}' not found. Available: ${available}`;
+    }
+    return fn(args);
+  };
+  globals.callTool = callToolFn;
+  asyncFunctionNames.add("callTool");
+  globals.listTools = () => {
+    return [...allToolInfo];
+  };
+  return { globals, asyncFunctionNames };
+}
+function buildBuiltinGlobals(opts) {
+  const globals = {};
+  const asyncFunctionNames = /* @__PURE__ */ new Set();
+  const scheduleFn = async (args = {}) => {
+    try {
+      const { handleScheduleAction: handleScheduleAction2, buildScheduleToolContext: buildScheduleToolContext2 } = await import("./schedule-tool-2COUUTF7.mjs");
+      const { extractSlackContext: extractSlackContext2 } = await import("./schedule-tool-handler-Y2UABBXN.mjs");
+      const parentCtx = opts.sessionInfo?._parentContext;
+      const webhookData = parentCtx?.prInfo?.eventContext?.webhookData;
+      const visorCfg = parentCtx?.config;
+      const slackContext = webhookData ? extractSlackContext2(webhookData) : null;
+      const availableWorkflows = visorCfg?.checks ? Object.keys(visorCfg.checks) : void 0;
+      const permissions = visorCfg?.scheduler?.permissions;
+      const context2 = buildScheduleToolContext2(
+        {
+          slackContext: slackContext || void 0,
+          cliContext: slackContext ? void 0 : { userId: "script" }
+        },
+        availableWorkflows,
+        permissions
+      );
+      return await handleScheduleAction2(args, context2);
+    } catch (e) {
+      const msg = e instanceof Error ? e.message : String(e);
+      logger.warn(`[script:schedule] Error: ${msg}`);
+      return `ERROR: ${msg}`;
+    }
+  };
+  globals.schedule = scheduleFn;
+  asyncFunctionNames.add("schedule");
+  if (opts.config.enable_fetch === true) {
+    const fetchFn = async (args = {}) => {
+      try {
+        const url = String(args.url || "");
+        if (!url) return "ERROR: url is required";
+        const method = String(args.method || "GET");
+        const headers = args.headers || {};
+        const body = args.body != null ? String(args.body) : void 0;
+        const timeout = Number(args.timeout) || 3e4;
+        const controller = new AbortController();
+        const timeoutId = setTimeout(() => controller.abort(), timeout);
+        try {
+          const resp = await globalThis.fetch(url, {
+            method,
+            headers,
+            body: method !== "GET" ? body : void 0,
+            signal: controller.signal
+          });
+          clearTimeout(timeoutId);
+          const contentType = resp.headers.get("content-type") || "";
+          if (contentType.includes("json")) return await resp.json();
+          const text = await resp.text();
+          try {
+            return JSON.parse(text);
+          } catch {
+            return text;
+          }
+        } finally {
+          clearTimeout(timeoutId);
+        }
+      } catch (e) {
+        const msg = e instanceof Error ? e.message : String(e);
+        logger.warn(`[script:fetch] Error: ${msg}`);
+        return `ERROR: ${msg}`;
+      }
+    };
+    globals.fetch = fetchFn;
+    asyncFunctionNames.add("fetch");
+  }
+  const octokit = opts.config.eventContext?.octokit;
+  if (octokit) {
+    const githubFn = async (args = {}) => {
+      try {
+        const op = String(args.op || "");
+        const repoEnv = process.env.GITHUB_REPOSITORY || "";
+        let owner = "";
+        let repo = "";
+        if (repoEnv.includes("/")) {
+          [owner, repo] = repoEnv.split("/");
+        }
+        if (!owner || !repo) {
+          const ec = opts.config.eventContext || {};
+          owner = owner || ec.repository?.owner?.login || "";
+          repo = repo || ec.repository?.name || "";
+        }
+        const prNumber = opts.prInfo?.number;
+        if (!owner || !repo || !prNumber) {
+          return "ERROR: Missing GitHub repo/PR context";
+        }
+        const values = Array.isArray(args.values) ? args.values.map(String) : typeof args.value === "string" ? [args.value] : typeof args.values === "string" ? [args.values] : [];
+        switch (op) {
+          case "labels.add":
+            await octokit.rest.issues.addLabels({
+              owner,
+              repo,
+              issue_number: prNumber,
+              labels: values
+            });
+            return { success: true, op };
+          case "labels.remove":
+            for (const name of values) {
+              try {
+                await octokit.rest.issues.removeLabel({
+                  owner,
+                  repo,
+                  issue_number: prNumber,
+                  name
+                });
+              } catch {
+              }
+            }
+            return { success: true, op };
+          case "comment.create":
+            await octokit.rest.issues.createComment({
+              owner,
+              repo,
+              issue_number: prNumber,
+              body: values[0] || ""
+            });
+            return { success: true, op };
+          default:
+            return `ERROR: Unknown github op '${op}'. Supported: labels.add, labels.remove, comment.create`;
+        }
+      } catch (e) {
+        const msg = e instanceof Error ? e.message : String(e);
+        logger.warn(`[script:github] Error: ${msg}`);
+        return `ERROR: ${msg}`;
+      }
+    };
+    globals.github = githubFn;
+    asyncFunctionNames.add("github");
+  }
+  if (opts.config.enable_bash === true) {
+    const bashFn = async (args = {}) => {
+      try {
+        const { CommandExecutor } = await import("./command-executor-TOYBBE7S.mjs");
+        const executor = CommandExecutor.getInstance();
+        const command = String(args.command || "");
+        if (!command) return "ERROR: command is required";
+        return await executor.execute(command, {
+          cwd: args.cwd ? String(args.cwd) : void 0,
+          env: args.env,
+          timeout: Number(args.timeout) || 3e4
+        });
+      } catch (e) {
+        const msg = e instanceof Error ? e.message : String(e);
+        logger.warn(`[script:bash] Error: ${msg}`);
+        return `ERROR: ${msg}`;
+      }
+    };
+    globals.bash = bashFn;
+    asyncFunctionNames.add("bash");
+  }
+  return { globals, asyncFunctionNames };
+}
+var JS_BUILTINS;
+var init_script_tool_environment = __esm({
+  "src/utils/script-tool-environment.ts"() {
+    "use strict";
+    init_custom_tool_executor();
+    init_workflow_tool_executor();
+    init_logger();
+    JS_BUILTINS = /* @__PURE__ */ new Set([
+      // Constructors & types
+      "Array",
+      "Object",
+      "String",
+      "Number",
+      "Boolean",
+      "Date",
+      "RegExp",
+      "Error",
+      "TypeError",
+      "RangeError",
+      "Map",
+      "Set",
+      "WeakMap",
+      "WeakSet",
+      "Promise",
+      "Symbol",
+      "BigInt",
+      "Proxy",
+      "Reflect",
+      // Static methods commonly called as functions
+      "parseInt",
+      "parseFloat",
+      "isNaN",
+      "isFinite",
+      "encodeURIComponent",
+      "decodeURIComponent",
+      "encodeURI",
+      "decodeURI",
+      // Timers
+      "setTimeout",
+      "clearTimeout",
+      "setInterval",
+      "clearInterval",
+      // JSON/Math accessed via method calls are on objects, but just in case
+      "JSON",
+      "Math",
+      "console",
+      // Node.js globals — sandbox blocks these at runtime with a better error
+      "require",
+      "process",
+      "Buffer",
+      "global",
+      "globalThis",
+      // Common patterns
+      "eval",
+      "Function",
+      "alert",
+      "confirm",
+      "prompt"
+    ]);
+  }
+});
+
 // src/providers/script-check-provider.ts
 var ScriptCheckProvider;
 var init_script_check_provider = __esm({
@@ -37585,6 +37503,10 @@ var init_script_check_provider = __esm({
     init_sandbox();
     init_template_context();
     init_script_memory_ops();
+    init_tool_resolver();
+    init_script_tool_environment();
+    init_workflow_tool_executor();
+    init_env_resolver();
     ScriptCheckProvider = class extends CheckProvider {
       liquid;
       constructor() {
@@ -37601,7 +37523,7 @@ var init_script_check_provider = __esm({
         return "script";
       }
       getDescription() {
-        return "Execute JavaScript with access to PR context, dependency outputs, and memory.";
+        return "Execute JavaScript with access to PR context, dependency outputs, memory, and tools.";
       }
       async validateConfig(config) {
         if (!config || typeof config !== "object") return false;
@@ -37651,16 +37573,77 @@ var init_script_check_provider = __esm({
         ctx.atob = (str) => {
           return Buffer.from(String(str), "base64").toString("binary");
         };
+        const { globals: builtinGlobals, asyncFunctionNames: builtinAsyncNames } = buildBuiltinGlobals({
+          config,
+          prInfo,
+          sessionInfo: _sessionInfo
+        });
+        Object.assign(ctx, builtinGlobals);
+        const hasTools = Array.isArray(config.tools) || config.tools_js || config.mcp_servers;
         const sandbox = this.createSecureSandbox();
         let result;
+        let mcpClients = [];
         try {
-          result = compileAndRun(
+          const asyncFunctionNames = new Set(builtinAsyncNames);
+          if (hasTools) {
+            const toolItems = this.resolveToolItems(config, prInfo, dependencyResults, ctx);
+            const globalTools = config.__globalTools;
+            const resolvedTools = resolveTools(toolItems, globalTools, "[script]");
+            mcpClients = await this.connectMcpServers(config.mcp_servers);
+            const toolContext = {
+              pr: ctx.pr,
+              files: ctx.files || prInfo.files,
+              outputs: ctx.outputs,
+              env: process.env
+            };
+            const parentCtx = _sessionInfo?._parentContext;
+            const workflowContext = {
+              prInfo,
+              outputs: dependencyResults,
+              executionContext: _sessionInfo,
+              workspace: parentCtx?.workspace
+            };
+            const { globals: toolGlobals, asyncFunctionNames: toolAsyncNames } = buildToolGlobals({
+              resolvedTools,
+              mcpClients,
+              toolContext,
+              workflowContext
+            });
+            Object.assign(ctx, toolGlobals);
+            for (const name of toolAsyncNames) asyncFunctionNames.add(name);
+          }
+          let loopIterations = 0;
+          const maxLoopIterations = 1e4;
+          ctx.__checkLoop = () => {
+            loopIterations++;
+            if (loopIterations > maxLoopIterations) {
+              throw new Error(`Loop exceeded maximum of ${maxLoopIterations} iterations`);
+            }
+          };
+          const knownGlobals = new Set(Object.keys(ctx));
+          for (const name of asyncFunctionNames) knownGlobals.add(name);
+          knownGlobals.add("__checkLoop");
+          knownGlobals.add("log");
+          const disabledBuiltins = /* @__PURE__ */ new Map();
+          if (!config.enable_bash) {
+            disabledBuiltins.set("bash", "Add 'enable_bash: true' to your check config to enable it.");
+          }
+          if (!config.enable_fetch) {
+            disabledBuiltins.set(
+              "fetch",
+              "Add 'enable_fetch: true' to your check config to enable it."
+            );
+          }
+          const transformed = transformScriptForAsync(script, asyncFunctionNames, {
+            knownGlobals,
+            disabledBuiltins
+          });
+          result = await compileAndRunAsync(
             sandbox,
-            script,
+            transformed,
             { ...ctx },
             {
               injectLog: true,
-              wrapFunction: true,
               logPrefix: "[script]"
             }
           );
@@ -37680,6 +37663,8 @@ var init_script_check_provider = __esm({
             ],
             output: null
           };
+        } finally {
+          await this.disconnectMcpClients(mcpClients);
         }
         try {
           if (needsSave() && memoryStore.getConfig().storage === "file" && memoryStore.getConfig().auto_save) {
@@ -37705,17 +37690,167 @@ var init_script_check_provider = __esm({
         }
         return out;
       }
+      /**
+       * Resolve tool items from static config and optional JS expression.
+       */
+      resolveToolItems(config, prInfo, dependencyResults, ctx) {
+        let items = [];
+        const staticTools = config.tools;
+        if (Array.isArray(staticTools)) {
+          items = staticTools.filter(
+            (item) => typeof item === "string" || isWorkflowToolReference(item)
+          );
+        }
+        const toolsJsExpr = config.tools_js;
+        if (toolsJsExpr && dependencyResults) {
+          try {
+            const jsSandbox = this.createSecureSandbox();
+            const jsCtx = ctx || buildProviderTemplateContext(prInfo, dependencyResults);
+            jsCtx.env = process.env;
+            jsCtx.inputs = config.workflowInputs || {};
+            const evalResult = compileAndRun(jsSandbox, toolsJsExpr, jsCtx, {
+              injectLog: true,
+              wrapFunction: true,
+              logPrefix: "[tools_js]"
+            });
+            if (Array.isArray(evalResult)) {
+              const dynamic = evalResult.filter(
+                (item) => typeof item === "string" || isWorkflowToolReference(item)
+              );
+              const existingNames = new Set(items.map((i) => typeof i === "string" ? i : i.workflow));
+              for (const tool of dynamic) {
+                const name = typeof tool === "string" ? tool : tool.workflow;
+                if (!existingNames.has(name)) {
+                  items.push(tool);
+                }
+              }
+            }
+          } catch (error) {
+            logger.error(
+              `[script] Failed to evaluate tools_js: ${error instanceof Error ? error.message : "Unknown error"}`
+            );
+          }
+        }
+        return items;
+      }
+      /**
+       * Connect to MCP servers and discover their tools.
+       */
+      async connectMcpServers(mcpServersConfig) {
+        if (!mcpServersConfig || Object.keys(mcpServersConfig).length === 0) {
+          return [];
+        }
+        const entries = [];
+        for (const [serverName, serverConfig] of Object.entries(mcpServersConfig)) {
+          try {
+            const { Client: Client2 } = await import("@modelcontextprotocol/sdk/client/index.js");
+            const client = new Client2(
+              { name: "visor-script-client", version: "1.0.0" },
+              { capabilities: {} }
+            );
+            const env = {};
+            for (const [key, value] of Object.entries(process.env)) {
+              if (value !== void 0) env[key] = value;
+            }
+            if (serverConfig.env) {
+              for (const [key, value] of Object.entries(serverConfig.env)) {
+                env[key] = String(EnvironmentResolver.resolveValue(String(value)));
+              }
+            }
+            const timeout = (serverConfig.timeout || 60) * 1e3;
+            if (serverConfig.command) {
+              const { StdioClientTransport: StdioClientTransport2 } = await import("@modelcontextprotocol/sdk/client/stdio.js");
+              const transport = new StdioClientTransport2({
+                command: serverConfig.command,
+                args: serverConfig.args,
+                env,
+                stderr: "pipe"
+              });
+              await Promise.race([
+                client.connect(transport),
+                new Promise(
+                  (_, reject) => setTimeout(() => reject(new Error("MCP connection timeout")), timeout)
+                )
+              ]);
+            } else if (serverConfig.url) {
+              const transportType = serverConfig.transport || "sse";
+              if (transportType === "sse") {
+                const { SSEClientTransport: SSEClientTransport2 } = await import("@modelcontextprotocol/sdk/client/sse.js");
+                await Promise.race([
+                  client.connect(new SSEClientTransport2(new URL(serverConfig.url))),
+                  new Promise(
+                    (_, reject) => setTimeout(() => reject(new Error("MCP connection timeout")), timeout)
+                  )
+                ]);
+              } else {
+                const { StreamableHTTPClientTransport: StreamableHTTPClientTransport2 } = await import("@modelcontextprotocol/sdk/client/streamableHttp.js");
+                await Promise.race([
+                  client.connect(new StreamableHTTPClientTransport2(new URL(serverConfig.url))),
+                  new Promise(
+                    (_, reject) => setTimeout(() => reject(new Error("MCP connection timeout")), timeout)
+                  )
+                ]);
+              }
+            } else {
+              logger.warn(`[script] MCP server '${serverName}' has no command or url, skipping`);
+              continue;
+            }
+            let tools = [];
+            try {
+              const listResult = await client.listTools();
+              tools = (listResult?.tools || []).map((t) => ({
+                name: t.name,
+                description: t.description,
+                inputSchema: t.inputSchema
+              }));
+              logger.debug(
+                `[script] MCP '${serverName}': ${tools.length} tools [${tools.map((t) => t.name).join(", ")}]`
+              );
+            } catch (err) {
+              logger.warn(
+                `[script] Could not list tools from MCP '${serverName}': ${err instanceof Error ? err.message : String(err)}`
+              );
+            }
+            entries.push({ client, serverName, tools });
+          } catch (err) {
+            logger.error(
+              `[script] Failed to connect MCP '${serverName}': ${err instanceof Error ? err.message : String(err)}`
+            );
+          }
+        }
+        return entries;
+      }
+      /**
+       * Disconnect all MCP clients.
+       */
+      async disconnectMcpClients(clients) {
+        for (const entry of clients) {
+          try {
+            await entry.client.close();
+          } catch (err) {
+            logger.debug(
+              `[script] Error closing MCP '${entry.serverName}': ${err instanceof Error ? err.message : String(err)}`
+            );
+          }
+        }
+      }
       getSupportedConfigKeys() {
         return [
           "type",
           "content",
+          "tools",
+          "tools_js",
+          "mcp_servers",
+          "enable_fetch",
+          "enable_bash",
           "depends_on",
           "group",
           "on",
           "if",
           "fail_if",
           "on_fail",
-          "on_success"
+          "on_success",
+          "timeout"
         ];
       }
       async isAvailable() {
@@ -37724,15 +37859,14 @@ var init_script_check_provider = __esm({
       getRequirements() {
         return ["No external dependencies required"];
       }
-      // No local buildTemplateContext; uses shared builder above
     };
   }
 });
 
 // src/utils/worktree-manager.ts
-import * as fs10 from "fs";
+import * as fs9 from "fs";
 import * as fsp2 from "fs/promises";
-import * as path12 from "path";
+import * as path11 from "path";
 import * as crypto from "crypto";
 var WorktreeManager, worktreeManager;
 var init_worktree_manager = __esm({
@@ -37752,7 +37886,7 @@ var init_worktree_manager = __esm({
         } catch {
           cwd = "/tmp";
         }
-        const defaultBasePath = process.env.VISOR_WORKTREE_PATH || path12.join(cwd, ".visor", "worktrees");
+        const defaultBasePath = process.env.VISOR_WORKTREE_PATH || path11.join(cwd, ".visor", "worktrees");
         this.config = {
           enabled: true,
           base_path: defaultBasePath,
@@ -37789,20 +37923,20 @@ var init_worktree_manager = __esm({
         }
         const reposDir = this.getReposDir();
         const worktreesDir = this.getWorktreesDir();
-        if (!fs10.existsSync(reposDir)) {
-          fs10.mkdirSync(reposDir, { recursive: true });
+        if (!fs9.existsSync(reposDir)) {
+          fs9.mkdirSync(reposDir, { recursive: true });
           logger.debug(`Created repos directory: ${reposDir}`);
         }
-        if (!fs10.existsSync(worktreesDir)) {
-          fs10.mkdirSync(worktreesDir, { recursive: true });
+        if (!fs9.existsSync(worktreesDir)) {
+          fs9.mkdirSync(worktreesDir, { recursive: true });
           logger.debug(`Created worktrees directory: ${worktreesDir}`);
         }
       }
       getReposDir() {
-        return path12.join(this.config.base_path, "repos");
+        return path11.join(this.config.base_path, "repos");
       }
       getWorktreesDir() {
-        return path12.join(this.config.base_path, "worktrees");
+        return path11.join(this.config.base_path, "worktrees");
       }
       /**
        * Generate a deterministic worktree ID based on repository and ref.
@@ -37820,8 +37954,8 @@ var init_worktree_manager = __esm({
       async getOrCreateBareRepo(repository, repoUrl, token, fetchDepth, cloneTimeoutMs) {
         const reposDir = this.getReposDir();
         const repoName = repository.replace(/\//g, "-");
-        const bareRepoPath = path12.join(reposDir, `${repoName}.git`);
-        if (fs10.existsSync(bareRepoPath)) {
+        const bareRepoPath = path11.join(reposDir, `${repoName}.git`);
+        if (fs9.existsSync(bareRepoPath)) {
           logger.debug(`Bare repository already exists: ${bareRepoPath}`);
           const verifyResult = await this.verifyBareRepoRemote(bareRepoPath, repoUrl);
           if (verifyResult === "timeout") {
@@ -37940,11 +38074,11 @@ var init_worktree_manager = __esm({
           options.cloneTimeoutMs
         );
         const worktreeId = this.generateWorktreeId(repository, ref);
-        let worktreePath = options.workingDirectory || path12.join(this.getWorktreesDir(), worktreeId);
+        let worktreePath = options.workingDirectory || path11.join(this.getWorktreesDir(), worktreeId);
         if (options.workingDirectory) {
           worktreePath = this.validatePath(options.workingDirectory);
         }
-        if (fs10.existsSync(worktreePath)) {
+        if (fs9.existsSync(worktreePath)) {
           logger.debug(`Worktree already exists: ${worktreePath}`);
           const metadata2 = await this.loadMetadata(worktreePath);
           if (metadata2) {
@@ -38185,9 +38319,9 @@ var init_worktree_manager = __esm({
         const result = await this.executeGitCommand(removeCmd, { timeout: 3e4 });
         if (result.exitCode !== 0) {
           logger.warn(`Failed to remove worktree via git: ${result.stderr}`);
-          if (fs10.existsSync(worktree_path)) {
+          if (fs9.existsSync(worktree_path)) {
             logger.debug(`Manually removing worktree directory`);
-            fs10.rmSync(worktree_path, { recursive: true, force: true });
+            fs9.rmSync(worktree_path, { recursive: true, force: true });
           }
         }
         this.activeWorktrees.delete(worktreeId);
@@ -38197,19 +38331,19 @@ var init_worktree_manager = __esm({
        * Save worktree metadata
        */
       async saveMetadata(worktreePath, metadata) {
-        const metadataPath = path12.join(worktreePath, ".visor-metadata.json");
-        fs10.writeFileSync(metadataPath, JSON.stringify(metadata, null, 2), "utf8");
+        const metadataPath = path11.join(worktreePath, ".visor-metadata.json");
+        fs9.writeFileSync(metadataPath, JSON.stringify(metadata, null, 2), "utf8");
       }
       /**
        * Load worktree metadata
        */
       async loadMetadata(worktreePath) {
-        const metadataPath = path12.join(worktreePath, ".visor-metadata.json");
-        if (!fs10.existsSync(metadataPath)) {
+        const metadataPath = path11.join(worktreePath, ".visor-metadata.json");
+        if (!fs9.existsSync(metadataPath)) {
           return null;
         }
         try {
-          const content = fs10.readFileSync(metadataPath, "utf8");
+          const content = fs9.readFileSync(metadataPath, "utf8");
           return JSON.parse(content);
         } catch (error) {
           logger.warn(`Failed to load metadata: ${error}`);
@@ -38221,14 +38355,14 @@ var init_worktree_manager = __esm({
        */
       async listWorktrees() {
         const worktreesDir = this.getWorktreesDir();
-        if (!fs10.existsSync(worktreesDir)) {
+        if (!fs9.existsSync(worktreesDir)) {
           return [];
         }
-        const entries = fs10.readdirSync(worktreesDir, { withFileTypes: true });
+        const entries = fs9.readdirSync(worktreesDir, { withFileTypes: true });
         const worktrees = [];
         for (const entry of entries) {
           if (!entry.isDirectory()) continue;
-          const worktreePath = path12.join(worktreesDir, entry.name);
+          const worktreePath = path11.join(worktreesDir, entry.name);
           const metadata = await this.loadMetadata(worktreePath);
           if (metadata) {
             worktrees.push({
@@ -38360,8 +38494,8 @@ var init_worktree_manager = __esm({
        * Validate path to prevent directory traversal
        */
       validatePath(userPath) {
-        const resolvedPath = path12.resolve(userPath);
-        if (!path12.isAbsolute(resolvedPath)) {
+        const resolvedPath = path11.resolve(userPath);
+        if (!path11.isAbsolute(resolvedPath)) {
           throw new Error("Path must be absolute");
         }
         const sensitivePatterns = [
@@ -39339,7 +39473,7 @@ var init_workflow_projection = __esm({
 });
 
 // src/providers/workflow-check-provider.ts
-import * as path13 from "path";
+import * as path12 from "path";
 import * as yaml from "js-yaml";
 var WorkflowCheckProvider;
 var init_workflow_check_provider = __esm({
@@ -39558,13 +39692,13 @@ var init_workflow_check_provider = __esm({
         const loadConfigLiquid = createExtendedLiquid();
         const loadConfig = (filePath) => {
           try {
-            const normalizedBasePath = path13.normalize(basePath);
-            const resolvedPath = path13.isAbsolute(filePath) ? path13.normalize(filePath) : path13.normalize(path13.resolve(basePath, filePath));
-            const basePathWithSep = normalizedBasePath.endsWith(path13.sep) ? normalizedBasePath : normalizedBasePath + path13.sep;
+            const normalizedBasePath = path12.normalize(basePath);
+            const resolvedPath = path12.isAbsolute(filePath) ? path12.normalize(filePath) : path12.normalize(path12.resolve(basePath, filePath));
+            const basePathWithSep = normalizedBasePath.endsWith(path12.sep) ? normalizedBasePath : normalizedBasePath + path12.sep;
             if (!resolvedPath.startsWith(basePathWithSep) && resolvedPath !== normalizedBasePath) {
               throw new Error(`Path '${filePath}' escapes base directory`);
             }
-            const configDir = path13.dirname(resolvedPath);
+            const configDir = path12.dirname(resolvedPath);
             const rawContent = __require("fs").readFileSync(resolvedPath, "utf-8");
             const renderedContent = loadConfigLiquid.parseAndRenderSync(rawContent, {
               basePath: configDir
@@ -40015,17 +40149,17 @@ var init_workflow_check_provider = __esm({
        * so it can be executed by the state machine as a nested workflow.
        */
       async loadWorkflowFromConfigPath(sourcePath, baseDir) {
-        const path14 = __require("path");
-        const fs11 = __require("fs");
+        const path13 = __require("path");
+        const fs10 = __require("fs");
         const yaml2 = __require("js-yaml");
-        const resolved = path14.isAbsolute(sourcePath) ? sourcePath : path14.resolve(baseDir, sourcePath);
-        if (!fs11.existsSync(resolved)) {
+        const resolved = path13.isAbsolute(sourcePath) ? sourcePath : path13.resolve(baseDir, sourcePath);
+        if (!fs10.existsSync(resolved)) {
           throw new Error(`Workflow config not found at: ${resolved}`);
         }
-        const rawContent = fs11.readFileSync(resolved, "utf8");
+        const rawContent = fs10.readFileSync(resolved, "utf8");
         const rawData = yaml2.load(rawContent);
         if (rawData.imports && Array.isArray(rawData.imports)) {
-          const configDir = path14.dirname(resolved);
+          const configDir = path13.dirname(resolved);
           for (const source of rawData.imports) {
             const results = await this.registry.import(source, {
               basePath: configDir,
@@ -40055,8 +40189,8 @@ ${errors}`);
         if (!steps || Object.keys(steps).length === 0) {
           throw new Error(`Config '${resolved}' does not contain any steps to execute as a workflow`);
         }
-        const id = path14.basename(resolved).replace(/\.(ya?ml)$/i, "");
-        const name = loaded.name || `Workflow from ${path14.basename(resolved)}`;
+        const id = path13.basename(resolved).replace(/\.(ya?ml)$/i, "");
+        const name = loaded.name || `Workflow from ${path13.basename(resolved)}`;
         const workflowDef = {
           id,
           name,
@@ -40098,4 +40232,4 @@ undici/lib/fetch/body.js:
 undici/lib/websocket/frame.js:
   (*! ws. MIT License. Einar Otto Stangvik <einaros@gmail.com> *)
 */
-//# sourceMappingURL=chunk-BOGVSF57.mjs.map
+//# sourceMappingURL=chunk-J6F5K5EG.mjs.map