@todoforai/cli 0.1.55 → 0.1.57

package/dist/todoforai-cli.js

@@ -42745,7 +42745,7 @@ function randomTip() {
   return TIPS[Math.floor(Math.random() * TIPS.length)];
 }
 
-// ../../../home/hm/repo/todoforai/packages/shared-api/src/api.ts
+// ../packages/shared-api/src/api.ts
 function restBasePath(apiKey) {
   return apiKey.startsWith("dst_") ? "/dst/v1" : "/api/v1";
 }
@@ -42939,6 +42939,12 @@ class ApiClient {
   sendFeedMessage(msg) {
     return this.request("POST", "/api/v1/feed/message", msg);
   }
+  getProjectMembers(projectId) {
+    return this.request("GET", `/api/v1/projects/${projectId}/members`);
+  }
+  sendMemberMessage(msg) {
+    return this.request("POST", "/api/v1/feed/message/member", msg);
+  }
   listProjectSurfaces(projectId) {
     return this.request("GET", `/api/v1/projects/${projectId}/surfaces`);
   }
@@ -43169,11 +43175,11 @@ class ApiClient {
     return res.json();
   }
 }
-// ../../../home/hm/repo/todoforai/packages/shared-api/src/frontend-ws.ts
+// ../packages/shared-api/src/frontend-ws.ts
 import { randomUUID } from "crypto";
 import WebSocket from "ws";
 
-// ../../../home/hm/repo/todoforai/packages/shared-credentials/src/index.ts
+// ../packages/shared-credentials/src/index.ts
 import { readFileSync, writeFileSync, mkdirSync, chmodSync } from "node:fs";
 import { join, dirname } from "node:path";
 import { homedir, platform } from "node:os";
@@ -43213,7 +43219,7 @@ function writeCredential(apiUrl, apiKey) {
   writeSecure(c);
 }
 
-// ../../../home/hm/repo/todoforai/packages/shared-api/src/frontend-ws.ts
+// ../packages/shared-api/src/frontend-ws.ts
 var log = (level, ...args) => console.log(`[frontend-ws:${level}]`, ...args);
 
 class FrontendWebSocket {
@@ -43483,7 +43489,7 @@ class FrontendWebSocket {
     });
   }
 }
-// ../../../home/hm/repo/todoforai/packages/shared-fbe/src/enums.ts
+// ../packages/shared-fbe/src/enums.ts
 var TodoStatus;
 ((TodoStatus2) => {
   TodoStatus2["PROPOSED"] = "PROPOSED";
@@ -43507,7 +43513,7 @@ var TodoStatus;
   TodoStatus2["ARCHIVED"] = "ARCHIVED";
   TodoStatus2["DELETED"] = "DELETED";
 })(TodoStatus ||= {});
-// ../../../home/hm/repo/todoforai/packages/shared-fbe/src/models.ts
+// ../packages/shared-fbe/src/models.ts
 var DEFAULT_MODEL = "anthropic:anthropic/claude-opus-5.5";
 var MODEL_ALIASES = {
   claude: DEFAULT_MODEL
@@ -43578,7 +43584,7 @@ function qualifiedModelIds(listing, filter) {
   }
   return q ? ids.filter((id) => id.toLowerCase().includes(q)) : ids;
 }
-// ../../../home/hm/repo/todoforai/packages/shared-fbe/src/billing.ts
+// ../packages/shared-fbe/src/billing.ts
 var USAGE_WINDOWS = {
   SESSION_MS: 5 * 60 * 60 * 1000,
   WEEK_MS: 7 * 24 * 60 * 60 * 1000,
@@ -43586,7 +43592,7 @@ var USAGE_WINDOWS = {
   SESSION_FACTOR: 1 / 5
 };
 var NEVER_SCHEDULED_TIMESTAMP = 8640000000000000;
-// ../../../home/hm/repo/todoforai/packages/shared-fbe/src/mimetypes.json
+// ../packages/shared-fbe/src/mimetypes.json
 var mimetypes_default = {
   conversionProfiles: {
     to_jpeg_90: { toMime: "image/jpeg", toExt: "jpg", quality: 0.9 }
@@ -43679,7 +43685,7 @@ var mimetypes_default = {
   }
 };
 
-// ../../../home/hm/repo/todoforai/packages/shared-fbe/src/attachmentUtils.ts
+// ../packages/shared-fbe/src/attachmentUtils.ts
 var MCP_TEXT_MIME = Object.entries(mimetypes_default.aliases).find(([, type]) => type === "mcp_text")[0];
 var MCP_AUDIO_MIME = Object.entries(mimetypes_default.aliases).find(([, type]) => type === "mcp_audio")[0];
 var AttachmentType = Object.fromEntries(Object.keys(mimetypes_default.types).map((k) => [k.toUpperCase(), k]));
@@ -43719,7 +43725,7 @@ for (const [ext, entry] of Object.entries(mimetypes_default.extensions)) {
   if (!MIME_TO_EXT[mime])
     MIME_TO_EXT[mime] = ext;
 }
-// ../../../home/hm/repo/todoforai/packages/shared-fbe/src/edgeTypes.ts
+// ../packages/shared-fbe/src/edgeTypes.ts
 var NON_SHELL_TYPES = new Set([
   "WEB_EXTENSION" /* WEB_EXTENSION */,
   "EXTENSION" /* EXTENSION */,
@@ -43727,7 +43733,7 @@ var NON_SHELL_TYPES = new Set([
   "ANDROID" /* ANDROID */,
   "IOS" /* IOS */
 ]);
-// ../../../home/hm/repo/todoforai/packages/shared-fbe/src/blocks/index.ts
+// ../packages/shared-fbe/src/blocks/index.ts
 var USER_INPUT_BLOCK_TYPES = new Set([
   "question" /* Question */,
   "login_prompt" /* Login */,
@@ -43781,7 +43787,7 @@ var FILE_TOOL_TYPES = new Set([
   "edit" /* Edit */,
   "modify_file" /* ModifyFile */
 ]);
-// ../../../home/hm/repo/todoforai/packages/shared-fbe/src/channels.ts
+// ../packages/shared-fbe/src/channels.ts
 var privateSuffix = (privateOwnerId) => privateOwnerId ? `:private:${privateOwnerId}` : "";
 var SERVER_TO_FRONTENDS = {
   task: {
@@ -43871,7 +43877,7 @@ var SERVER_TO_FRONTENDS = {
     function_call_request: (userId) => `${"FUNCTION_CALL_REQUEST_AGENT" /* FUNCTION_CALL_REQUEST_AGENT */}:frontend:${userId}`
   }
 };
-// ../../../home/hm/repo/todoforai/packages/shared-fbe/src/REST_types.ts
+// ../packages/shared-fbe/src/REST_types.ts
 var MANUAL_CHANNEL = "Manual";
 function manualAnswersOf(sources) {
   const manual = sources?.find((s) => s.channel === MANUAL_CHANNEL);
@@ -43882,8 +43888,8 @@ function manualAnswersOf(sources) {
   return out;
 }
 var manualSamples = (answers) => Object.entries(answers).filter(([, a]) => a.trim()).map(([prompt, text]) => ({ prompt, text: text.trim() }));
-var senderLabel = (s) => s.kind === "team" ? `${s.name} · TODO for AI team` : `${s.name} · your agent`;
-// ../../../home/hm/repo/todoforai/packages/shared-fbe/src/templateBody.ts
+var senderLabel = (s) => s.kind === "team" ? `${s.name} · TODO for AI team` : s.kind === "member" ? `${s.name} · teammate` : `${s.name} · your agent`;
+// ../packages/shared-fbe/src/templateBody.ts
 var USER_HEADINGS = new Set([
   "your task",
   "your tasks",
@@ -43892,7 +43898,7 @@ var USER_HEADINGS = new Set([
   "steps",
   "data needed"
 ]);
-// ../../../home/hm/repo/todoforai/packages/shared-fbe/src/bashPatterns.ts
+// ../packages/shared-fbe/src/bashPatterns.ts
 function splitShellCommands(input) {
   const parts = [];
   let current = "";
@@ -44134,7 +44140,7 @@ function getBlockServerId(block) {
   return prefix ? prefix.slice(0, -1) : "*";
 }
 
-// ../../../home/hm/repo/todoforai/packages/shared-fbe/src/permissionUtils.ts
+// ../packages/shared-fbe/src/permissionUtils.ts
 function parsePattern(pattern) {
   const colonIndex = pattern.indexOf(":");
   if (colonIndex === -1)
@@ -44235,7 +44241,7 @@ function getBlockNewPatterns(block, permissions) {
   }
   return pairs.filter(({ raw, pattern }) => !isPatternAllowed(permissions, pattern) && !allow.some((rule) => bashRuleMatchesCmd(rule, serverId, raw))).map(({ pattern }) => pattern);
 }
-// ../../../home/hm/repo/todoforai/packages/shared-fbe/src/systemAgents.ts
+// ../packages/shared-fbe/src/systemAgents.ts
 var BUSINESS_ANALYZER_AGENT = {
   id: "00000000-0000-0000-0000-202601013151",
   name: "Business Analyzer",
@@ -44381,7 +44387,7 @@ var SYSTEM_AGENTS = {
   [ONBOARDING_AGENT.id]: ONBOARDING_AGENT
 };
 var RECOMMEND_STEP = "Recommend growth TODOs for this project: materialize the ones you genuinely believe fit " + "as proposal cards on the board (api_recommend_template, one call per recommendation). " + "No quota — fewer good cards beat padding.";
-// ../../../home/hm/repo/todoforai/packages/shared-fbe/src/outputLimits.ts
+// ../packages/shared-fbe/src/outputLimits.ts
 var MAX_LINE_LEN = 300;
 var STREAM_FIRST = 1e4;
 var STREAM_LAST = 1e4;
@@ -44392,7 +44398,1501 @@ var OUTPUT_POLICIES = {
   full: { firstLimit: Infinity, lastLimit: 0, hardCap: RUN_OUTPUT_CAP, lineLimit: MAX_LINE_LEN },
   raw: { firstLimit: Infinity, lastLimit: 0, hardCap: Infinity, lineLimit: Infinity }
 };
-// ../../../home/hm/repo/todoforai/packages/shared-fbe/src/model_promos.json
+// ../packages/shared-fbe/src/tool_catalog.json
+var tool_catalog_default = {
+  zele: {
+    category: "email",
+    pkg: "zele",
+    installer: "npm",
+    label: "Gmail",
+    summary: "Read and send Gmail from your own account.",
+    statusCmd: "zele whoami 2>/dev/null | grep 'email:' | grep -m1 .",
+    loginNeedsPty: true,
+    loginCmd: "zele login --method google",
+    oauthUrlPattern: "(https://accounts\\.google\\.com\\S+)",
+    oauthCallbackPort: 8089,
+    credentialPaths: ["~/.zele/sqlite.db"],
+    versionCmd: "zele --version 2>/dev/null | sed -n 1p",
+    preinstallCloud: true,
+    preinstallJarvis: true,
+    description: "Gmail (multi-account, OAuth login): inbox, search, send, reply, contacts. Google Calendar via `zele cal`: list/create/update/delete events (Meet links, recurrence), respond to invites, free/busy."
+  },
+  "zele-calendar": {
+    preinstallCloud: true,
+    category: "utility",
+    pkg: "zele",
+    installer: "npm",
+    binName: "zele",
+    label: "Google Calendar",
+    summary: "See your Google Calendar and book, move or cancel events.",
+    statusCmd: "zele whoami 2>/dev/null | grep 'email:' | grep -m1 .",
+    loginNeedsPty: true,
+    loginCmd: "zele login --method google",
+    oauthUrlPattern: "(https://accounts\\.google\\.com\\S+)",
+    oauthCallbackPort: 8089,
+    credentialPaths: ["~/.zele/sqlite.db"],
+    versionCmd: "zele --version 2>/dev/null | sed -n 1p",
+    preinstallJarvis: true,
+    description: "Google Calendar via `zele cal`: list calendars and events, create/update/delete events with Google Meet links, recurrence and reminders, respond to invites, free/busy."
+  },
+  xurl: {
+    category: "social",
+    pkg: "@xdevplatform/xurl",
+    installer: "npm",
+    label: "X",
+    summary: "Post to X and read timelines, replies and DMs.",
+    statusCmd: `xurl whoami 2>&1 | sed -n 's/.*"username"[[:space:]]*:[[:space:]]*"\\([^"]*\\)".*/\\1/p' | grep -m10 .`,
+    loginCmd: "xurl auth oauth2",
+    loginTerminalHint: "X needs your own developer app first: create one at developer.x.com (callback `http://localhost:8080/callback`), run `xurl auth apps add tfa --client-id <id> --client-secret <secret>`, then `xurl auth oauth2`.",
+    oauthUrlPattern: "(https://(?:twitter|x)\\.com/i/oauth2\\S+)",
+    oauthCallbackPort: 8080,
+    credentialPaths: ["~/.xurl"],
+    description: "Raw X API access via `xurl <method> <path>`.",
+    versionCmd: "xurl version 2>/dev/null | sed -n 1p",
+    preinstallJarvis: true,
+    preinstallCloud: true
+  },
+  "linkedin-api": {
+    preinstallCloud: true,
+    category: "social",
+    pkg: "@todoforai/linkedin-api",
+    installer: "npm",
+    label: "LinkedIn",
+    summary: "Read LinkedIn profiles and send messages and connection requests.",
+    statusCmd: `linkedin-api whoami 2>/dev/null | sed -n 's/.*"publicId"[[:space:]]*:[[:space:]]*"\\([^"]*\\)".*/\\1/p' | grep -m10 .`,
+    loginCmd: "linkedin-api auth <li_at> <jsessionid>",
+    credentialPaths: ["~/.config/linkedin-api/credentials.json"],
+    description: "LinkedIn Voyager API CLI for profiles, conversations, DMs, and connections.",
+    versionCmd: "linkedin-api --version 2>/dev/null | sed -n 1p"
+  },
+  "figma-api": {
+    category: "design",
+    pkg: "@todoforai/figma-api",
+    installer: "npm",
+    label: "Figma",
+    summary: "Read Figma files, export images and leave comments.",
+    statusCmd: `figma-api me 2>/dev/null | sed -n 's/.*"email"[[:space:]]*:[[:space:]]*"\\([^"]*\\)".*/\\1/p' | grep -m10 .`,
+    loginCmd: "figma-api auth <token>",
+    credentialPaths: ["~/.config/figma-api/credentials.json"],
+    description: "Figma REST API CLI. File commands take a file key or Figma URL. Canvas writes (frames/text/shapes) use `figma-api run` via the plugin bridge. Run `figma-api <cmd> --help` for params.",
+    versionCmd: "figma-api --version 2>/dev/null | sed -n 1p"
+  },
+  "slack-cli": {
+    preinstallCloud: true,
+    cloudInstallCmd: "curl -fsSL https://github.com/slackapi/slack-cli/releases/download/v4.2.0/slack_cli_4.2.0_linux_amd64.tar.gz | tar -xz -C /tmp bin/slack && install -m0755 /tmp/bin/slack /usr/local/bin/slack-cli && rm -rf /tmp/bin",
+    cloudVerifyCmd: "slack-cli --version",
+    category: "social",
+    pkg: "slack-cli",
+    installer: "binary",
+    label: "Slack",
+    summary: "Work with Slack workspaces and apps.",
+    statusCmd: "slack-cli auth list 2>&1 | grep 'Team' >/dev/null && echo authenticated",
+    loginCmd: "slack-cli login",
+    loginTerminalHint: "Run `slack-cli login` in a terminal on this host, paste the `/slackauthticket …` command it prints into any Slack channel, then type the challenge code Slack shows you back into the terminal.",
+    credentialPaths: ["~/.slack/credentials.json"],
+    description: "Invoked as `slack-cli` to avoid colliding with the Slack desktop app’s `slack` binary.",
+    versionCmd: "slack-cli version 2>/dev/null | sed -n 1p",
+    binName: "slack-cli",
+    binary: {
+      "linux-x86_64": {
+        url: "https://github.com/slackapi/slack-cli/releases/download/v4.2.0/slack_cli_4.2.0_linux_amd64.tar.gz",
+        archive: "tar.gz",
+        extract: "bin/slack"
+      },
+      "linux-aarch64": {
+        url: "https://github.com/slackapi/slack-cli/releases/download/v4.2.0/slack_cli_4.2.0_linux_arm64.tar.gz",
+        archive: "tar.gz",
+        extract: "bin/slack"
+      },
+      "darwin-x86_64": {
+        url: "https://github.com/slackapi/slack-cli/releases/download/v4.2.0/slack_cli_4.2.0_macOS_amd64.tar.gz",
+        archive: "tar.gz",
+        extract: "bin/slack"
+      },
+      "darwin-aarch64": {
+        url: "https://github.com/slackapi/slack-cli/releases/download/v4.2.0/slack_cli_4.2.0_macOS_arm64.tar.gz",
+        archive: "tar.gz",
+        extract: "bin/slack"
+      },
+      "windows-x86_64": {
+        url: "https://github.com/slackapi/slack-cli/releases/download/v4.2.0/slack_cli_4.2.0_windows_64-bit.zip",
+        archive: "zip",
+        extract: "bin/slack.exe"
+      }
+    }
+  },
+  "telegram-send": {
+    preinstallCloud: true,
+    packages: ["telegram-send==0.39.2"],
+    category: "social",
+    pkg: "telegram-send",
+    installer: "pip",
+    label: "Telegram",
+    summary: "Send Telegram messages, photos and files.",
+    loginCmd: `t=<bot_token>; c=$(curl -sf "https://api.telegram.org/bot$t/getUpdates" | python3 -c "import json,sys; u=[x for x in json.load(sys.stdin)['result'] if 'message' in x]; print(u[-1]['message']['chat']['id'])" 2>/dev/null) || { echo "No message from you yet: open your bot in Telegram, send it any message, then retry"; exit 1; }; mkdir -p "$HOME/.config" && printf '[telegram]\\ntoken = %s\\nchat_id = %s\\n' "$t" "$c" > "$HOME/.config/telegram-send.conf" && telegram-send "Connected to TODOforAI"`,
+    credentialPaths: ["~/.config/telegram-send.conf"],
+    versionCmd: "telegram-send --version 2>/dev/null | sed -n 1p",
+    statusCmd: "test -f ~/.config/telegram-send.conf && echo authenticated",
+    description: "Send messages, send files & images, send video & audio, Markdown/HTML formatting, channel & group support"
+  },
+  "meta-ads": {
+    preinstallCloud: true,
+    packages: ["meta-ads==1.1.0"],
+    category: "marketing",
+    pkg: "meta-ads",
+    installer: "pip",
+    label: "Meta Ads",
+    summary: "Run Facebook and Instagram ad campaigns and see how they perform.",
+    binName: "meta",
+    statusCmd: `out=$(meta auth status 2>&1); rc=$?; printf '%s\\n' "$out" | grep -m1 .; exit $rc`,
+    versionCmd: "meta --version 2>/dev/null | sed -n 1p",
+    description: "Meta/Facebook & Instagram ad campaigns: campaigns/adsets/ads CRUD, insights & reporting, catalog/product-feed/product-set/product-item, ad creatives, datasets (pixels), pages — Marketing API via the official `meta` CLI. No raw/passthrough mode; for arbitrary Graph API calls with a Page token use `facebook-pages-api request <method> <path>`."
+  },
+  "elevenlabs-api": {
+    preinstallCloud: true,
+    category: "media",
+    pkg: "@todoforai/elevenlabs-api",
+    installer: "npm",
+    label: "ElevenLabs",
+    summary: "Turn text into natural speech, in many voices and languages.",
+    versionCmd: "elevenlabs-api --version 2>/dev/null | sed -n 1p",
+    statusCmd: 'test -f ~/.config/todoforai/elevenlabs.json -o -n "$ELEVENLABS_API_KEY" && echo authenticated',
+    loginCmd: "elevenlabs-api auth <api_key>",
+    credentialPaths: ["~/.config/todoforai/elevenlabs.json"],
+    description: "Text-to-speech, voice cloning, multiple languages."
+  },
+  ffmpeg: {
+    commodity: true,
+    category: "media",
+    pkg: "ffmpeg",
+    installer: "system",
+    label: "FFmpeg",
+    summary: "Convert, trim and resize video and audio files.",
+    cloudAptPackages: ["ffmpeg"],
+    preinstallCloud: true,
+    description: "Media swiss-army knife: `ffmpeg -i in.mp4 out.webm`; `ffprobe` for metadata.",
+    versionCmd: "ffmpeg -version 2>/dev/null | sed -n 1p"
+  },
+  "tfa-imagegen": {
+    preinstallCloud: true,
+    category: "media",
+    pkg: "@todoforai/image-api",
+    installer: "npm",
+    label: "Image Gen",
+    summary: "Generate and edit images from a description.",
+    platformAuth: true,
+    versionCmd: "tfa-imagegen --version 2>/dev/null | sed -n 1p",
+    credentialPaths: ["~/.config/todoforai/credentials.json"],
+    description: "AI image generation & editing via TODOFORAI backend (gpt-image, nano-banana, nano-banana-pro, mai-image-2.6)"
+  },
+  "suno-api": {
+    preinstallCloud: true,
+    category: "media",
+    pkg: "@todoforai/suno-api",
+    installer: "npm",
+    label: "Suno",
+    summary: "Generate music and songs from a prompt.",
+    versionCmd: "suno-api --version 2>/dev/null | sed -n 1p",
+    statusCmd: 'test -f ~/.config/todoforai/suno.json -o -n "$SUNO_API_KEY" && echo authenticated',
+    loginCmd: "suno-api auth <api_key>",
+    credentialPaths: [
+      "~/.config/todoforai/suno.json"
+    ],
+    description: "AI music generation, custom lyrics, multiple genres."
+  },
+  ntn: {
+    preinstallCloud: true,
+    category: "utility",
+    pkg: "ntn",
+    installer: "npm",
+    label: "Notion",
+    summary: "Read and update Notion pages and databases.",
+    statusCmd: "ntn doctor 2>&1 | grep -E 'Token valid\\s+✔' >/dev/null && echo authenticated",
+    loginCmd: "ntn login",
+    loginNeedsPty: true,
+    oauthUrlPattern: "(https://www\\.notion\\.so/workers/cli-login\\S+)",
+    sessionIdPattern: "verificationCode=([A-Z0-9-]{5,12})",
+    credentialPaths: ["~/.config/notion"],
+    versionCmd: "ntn --version 2>/dev/null | sed -n 1p",
+    description: "Official Notion CLI: raw API calls (`ntn api <path>`), page/data-source management, file uploads, Workers deploy."
+  },
+  "perplexity-api": {
+    preinstallCloud: true,
+    category: "utility",
+    pkg: "@todoforai/perplexity-api",
+    installer: "npm",
+    label: "Perplexity",
+    summary: "Ask questions and get answers researched from the web.",
+    versionCmd: "perplexity-api --version 2>/dev/null | sed -n 1p",
+    statusCmd: 'test -f ~/.config/todoforai/perplexity.json && echo authenticated || test -n "$PERPLEXITY_API_KEY" && echo authenticated',
+    loginCmd: "perplexity-api auth <api_key>",
+    credentialPaths: ["~/.config/todoforai/perplexity.json"],
+    description: "AI-powered web search, chat completions, async chat, embeddings and agent runs"
+  },
+  gh: {
+    category: "development",
+    pkg: "gh",
+    installer: "binary",
+    preinstallCloud: true,
+    label: "GitHub",
+    summary: "Work with your GitHub repos, pull requests and issues.",
+    statusCmd: "gh auth status 2>&1 | grep 'Logged in to' | grep -m1 .",
+    loginCmd: "gh auth login --hostname github.com --git-protocol https",
+    oauthUrlPattern: "(https://github\\.com/login/device\\S*)",
+    deviceCodePattern: "one-time code:\\s*([A-Z0-9]{4}-[A-Z0-9]{4})",
+    canStreamLogin: true,
+    logoutCmd: "gh auth logout --hostname github.com --user {{ACCOUNT}}",
+    credentialPaths: ["~/.config/gh/hosts.yml"],
+    description: "Prefer `gh` over raw GitHub API calls.",
+    versionCmd: "gh --version 2>/dev/null | sed -n 1p",
+    preinstallJarvis: true
+  },
+  mcporter: {
+    category: "development",
+    pkg: "mcporter",
+    installer: "npm",
+    label: "MCP (mcporter)",
+    summary: "Use tools from any MCP server.",
+    statusCmd: "mcporter list 2>/dev/null | grep -v 'No MCP servers' | grep -m1 .",
+    description: "MCP servers as CLI: `mcporter list [server] [--schema]`, `mcporter call <server>.<tool> key=value` (`key=@file`), `mcporter config add <name> <cmd-or-url>`, `mcporter auth <server>`. `--help` for more.",
+    versionCmd: "mcporter --version 2>/dev/null | sed -n 1p",
+    preinstallJarvis: true,
+    preinstallCloud: true
+  },
+  glab: {
+    category: "development",
+    pkg: "glab",
+    installer: "binary",
+    label: "GitLab",
+    summary: "Work with your GitLab repos, merge requests and pipelines.",
+    statusCmd: "glab auth status 2>&1 | grep 'Logged in to' | grep -m1 .",
+    loginCmd: "glab auth login --device",
+    credentialPaths: ["~/.config/glab-cli/config.yml"],
+    description: "GitLab equivalent of `gh`.",
+    versionCmd: "glab --version 2>/dev/null | sed -n 1p",
+    deviceCodePattern: "one-time code: ([A-Z0-9-]+)",
+    oauthUrlPattern: "(https://gitlab\\.com/oauth/device)",
+    canStreamLogin: true
+  },
+  vercel: {
+    preinstallCloud: true,
+    category: "deployment",
+    pkg: "vercel",
+    installer: "npm",
+    label: "Vercel",
+    summary: "Deploy websites to Vercel and manage them.",
+    statusCmd: "vercel whoami 2>/dev/null | tr -d '\\r' | grep -m1 .",
+    loginCmd: "vercel login",
+    credentialPaths: ["~/.local/share/com.vercel.cli/auth.json"],
+    description: "`vercel deploy`; manage env vars, domains, preview URLs.",
+    versionCmd: "vercel --version 2>/dev/null | sed -n 1p",
+    deviceCodePattern: "user_code=([A-Z0-9-]+)",
+    oauthUrlPattern: "(https://vercel\\.com/oauth/device\\S*)",
+    canStreamLogin: true
+  },
+  eas: {
+    category: "deployment",
+    pkg: "eas-cli",
+    installer: "npm",
+    label: "Expo EAS",
+    summary: "Build, update and submit mobile apps with Expo.",
+    statusCmd: `out=$(eas whoami 2>/dev/null) && printf '%s\\n' "$out" | tr -d '\\r' | grep -m1 .`,
+    loginCmd: "eas login --browser",
+    logoutCmd: "eas logout",
+    oauthUrlPattern: "(https://expo\\.dev/(?:sso-)?login\\?\\S+)",
+    canStreamLogin: true,
+    credentialPaths: ["~/.expo/state.json"],
+    description: "Expo Application Services for React Native apps: `eas update --channel <c>` ships a JS-only OTA, `eas build -p ios --profile production --auto-submit` (`-p all` for both) makes a native build and sends it to TestFlight / Play. `eas build:list`, `eas update:list` and `eas submit` inspect or re-submit existing builds. An OTA only reaches installs whose runtimeVersion matches, so a native version bump needs a real build. The browser login binds to a RANDOM loopback port, so it only completes in a browser on the same host; on a remote/headless host set EXPO_TOKEN (Account -> Access tokens) instead. EXPO_TOKEN (Account -> Access tokens) works in CI instead of a login.",
+    versionCmd: "eas --version 2>/dev/null | sed -n 1p"
+  },
+  netlify: {
+    category: "deployment",
+    pkg: "netlify-cli",
+    installer: "npm",
+    label: "Netlify",
+    summary: "Deploy websites to Netlify and manage them.",
+    statusCmd: `netlify api getCurrentUser 2>&1 | sed -n 's/.*"email"[[:space:]]*:[[:space:]]*"\\([^"]*\\)".*/\\1/p' | grep -m10 .`,
+    loginCmd: "netlify login",
+    credentialPaths: ["~/.netlify/config.json"],
+    description: "`netlify deploy --prod` for production; manage env vars, forms, identity.",
+    versionCmd: "netlify --version 2>/dev/null | sed -n 1p",
+    oauthUrlPattern: "(https://app\\.netlify\\.com/authorize\\S+)",
+    canStreamLogin: true
+  },
+  firebase: {
+    preinstallCloud: true,
+    category: "deployment",
+    pkg: "firebase-tools",
+    installer: "npm",
+    label: "Firebase",
+    summary: "Deploy and manage Firebase hosting, database and functions.",
+    statusCmd: "firebase login:list 2>&1 | grep -oiE '[[:alnum:]._%+-]+@[[:alnum:].-]+\\.[[:alpha:]]{2,}' | grep -m1 .",
+    loginCmd: "firebase login --no-localhost --reauth",
+    loginNeedsPty: true,
+    stdinPaste: true,
+    credentialPaths: ["~/.config/configstore/firebase-tools.json"],
+    description: "Deploy hosting/functions, manage Firestore/RTDB rules and data, auth users, emulators.",
+    versionCmd: "firebase --version 2>/dev/null | sed -n 1p",
+    oauthUrlPattern: "(https://auth\\.firebase\\.tools/login\\S+)",
+    sessionIdPattern: "session ID:\\s*([0-9A-Za-z]{4,8})"
+  },
+  wrangler: {
+    preinstallCloud: true,
+    category: "deployment",
+    pkg: "wrangler",
+    installer: "npm",
+    label: "Cloudflare",
+    summary: "Deploy and manage Cloudflare Workers and Pages.",
+    statusCmd: "wrangler whoami 2>&1 | grep -oiE '[[:alnum:]._%+-]+@[[:alnum:].-]+\\.[[:alpha:]]{2,}' | grep -m1 .",
+    loginCmd: "wrangler login",
+    credentialPaths: ["~/.config/.wrangler/config/default.toml"],
+    description: "Tail logs with `wrangler tail`. Use `cloudflared` for tunnels.",
+    versionCmd: "wrangler --version 2>/dev/null | sed -n 1p",
+    oauthUrlPattern: "(https://dash\\.cloudflare\\.com/oauth2/auth\\S+)",
+    oauthCallbackPort: 8976
+  },
+  stripe: {
+    preinstallCloud: true,
+    cloudInstallCmd: "curl -fsSL https://github.com/stripe/stripe-cli/releases/download/v1.50.10/stripe_1.50.10_linux_x86_64.tar.gz | tar -xz -C /usr/local/bin stripe",
+    cloudVerifyCmd: "stripe --version",
+    category: "payments",
+    pkg: "stripe",
+    installer: "binary",
+    label: "Stripe",
+    summary: "Look up Stripe payments, customers and subscriptions.",
+    statusCmd: "stripe config --list 2>/dev/null | sed -n 's/^account_id[[:space:]]*=[[:space:]]*.\\([^'\\'']*\\).*/\\1/p' | grep -m10 .",
+    loginCmd: "stripe login",
+    loginNeedsPty: true,
+    credentialPaths: ["~/.config/stripe/config.toml"],
+    description: "`stripe listen` forwards webhooks locally; `stripe get/post /v1/...` for raw API.",
+    versionCmd: "stripe --version 2>/dev/null | sed -n 1p",
+    deviceCodePattern: "verification code:\\s*([A-Z0-9]{4}-[A-Z0-9]{4})",
+    oauthUrlPattern: "(https://access\\.stripe\\.com/stripecli/\\S+)",
+    canStreamLogin: true
+  },
+  flyctl: {
+    category: "cloud",
+    pkg: "flyctl",
+    installer: "binary",
+    label: "Fly.io",
+    summary: "Deploy and scale apps on Fly.io.",
+    statusCmd: "flyctl auth whoami 2>/dev/null | tr -d '\\r' | grep -m1 .",
+    loginCmd: "flyctl auth login -t <access_token>",
+    credentialPaths: ["~/.fly/config.yml"],
+    description: "`flyctl deploy` from app dir; manage Postgres/volumes/machines/secrets.",
+    versionCmd: "flyctl version 2>/dev/null | sed -n 1p"
+  },
+  supabase: {
+    preinstallCloud: true,
+    cloudInstallCmd: "curl -fsSL https://github.com/supabase/cli/releases/download/v2.117.0/supabase_2.117.0_linux_amd64.tar.gz | tar -xz -C /usr/local/bin supabase",
+    cloudVerifyCmd: "supabase --version",
+    category: "cloud",
+    pkg: "supabase",
+    installer: "binary",
+    label: "Supabase",
+    summary: "Manage your Supabase database, auth and storage.",
+    statusCmd: "supabase projects list >/dev/null 2>&1 && echo authenticated",
+    loginCmd: "supabase login --token <access_token>",
+    credentialPaths: ["~/.config/supabase/access-token"],
+    description: "Link to cloud project; runs/migrates local Postgres.",
+    versionCmd: "supabase --version 2>/dev/null | sed -n 1p"
+  },
+  railway: {
+    category: "cloud",
+    pkg: "@railway/cli",
+    installer: "npm",
+    label: "Railway",
+    summary: "Deploy and manage apps and databases on Railway.",
+    statusCmd: `out=$(RAILWAY_NO_TELEMETRY=1 railway whoami 2>&1); rc=$?; printf '%s\\n' "$out" | grep -m1 .; exit $rc`,
+    loginCmd: "railway login --browserless",
+    credentialPaths: ["~/.railway/config.json"],
+    description: "`railway up` to deploy current dir.",
+    versionCmd: "railway --version 2>/dev/null | sed -n 1p",
+    deviceCodePattern: "user_code=([A-Z0-9-]+)",
+    oauthUrlPattern: "(https://railway\\.com/activate\\S*)",
+    canStreamLogin: true
+  },
+  shopify: {
+    preinstallCloud: true,
+    category: "ecommerce",
+    pkg: "@shopify/cli",
+    installer: "npm",
+    label: "Shopify",
+    summary: "Build and manage Shopify stores and themes.",
+    loginCmd: "shopify auth login --alias tfa",
+    credentialPaths: ["~/.config/shopify-cli-kit-nodejs/config.json"],
+    versionCmd: `node -p "require(require('fs').realpathSync(require('child_process').execSync('command -v shopify',{encoding:'utf8'}).trim()).replace(/\\/bin\\/[^/]*$/, '/package.json')).version" 2>/dev/null`,
+    statusCmd: `python3 -c "import json,os,sys;p=os.path.expanduser('~/.config/shopify-cli-kit-nodejs/config.json');sys.exit(0 if json.load(open(p)).get('session') else 1)" 2>/dev/null && echo authenticated`,
+    deviceCodePattern: "verification code: ([A-Z0-9-]+)",
+    oauthUrlPattern: "(https://accounts\\.shopify\\.com/activate-with-code\\S*)",
+    canStreamLogin: true,
+    description: "Theme development, app scaffolding, store management"
+  },
+  "shop-app": {
+    preinstallCloud: true,
+    category: "ecommerce",
+    pkg: "@todoforai/shop-app",
+    installer: "npm",
+    label: "Shop",
+    summary: "Search products and compare prices across Shopify stores.",
+    description: "Shop.app product search across Shopify stores. `shop-app search '<query>' --ships-to HU -n 10` returns products with price, rating, URL, and variants. `shop-app similar <variantId>` finds lookalikes.",
+    versionCmd: "shop-app --version 2>/dev/null | sed -n 1p"
+  },
+  "datadog-ci": {
+    category: "monitoring",
+    pkg: "@datadog/datadog-ci",
+    installer: "npm",
+    label: "Datadog",
+    summary: "Send test results and releases to Datadog.",
+    versionCmd: "datadog-ci version 2>/dev/null | sed -n 1p",
+    statusCmd: 'test -n "$DATADOG_API_KEY" && echo authenticated',
+    description: "CI test visibility, sourcemap uploads, deployment tracking."
+  },
+  "sentry-cli": {
+    preinstallCloud: true,
+    category: "monitoring",
+    pkg: "@sentry/cli",
+    installer: "npm",
+    label: "Sentry",
+    summary: "Manage Sentry releases and error tracking.",
+    statusCmd: "sentry-cli info --no-defaults >/dev/null 2>&1 && echo authenticated",
+    loginCmd: "sentry-cli login --auth-token <auth_token>",
+    credentialPaths: ["~/.sentryclirc"],
+    description: "`sentry-cli releases new <version>`.",
+    versionCmd: "sentry-cli --version 2>/dev/null | sed -n 1p"
+  },
+  "tfa-cli": {
+    category: "utility",
+    pkg: "@todoforai/cli",
+    installer: "npm",
+    label: "TODOforAI",
+    summary: "Create and follow up on your TODOs, and show results in the chat.",
+    description: 'Manage the user\'s OWN TODOforAI tasks (not code `// TODO` comments). Delegate/spin off work: `tfa-cli "prompt"` creates a real TODO with its own agent and chat (`-n` wait for completion, `--no-watch` fire-and-forget, `--project/--agent/--model`, `--resume <id>`, `addmessage <id> "text"`). Inspect: `list [--status open]`, `--inspect <id>`. Edit any todo without opening it: `status <id> DONE|READY|ARCHIVED|POSTPONED|CANCELLED|DELETED` (close, reopen, shelve, trash — `todo restore <id>` undoes a delete) and `todo set <id|-> title=… group=… star=true schedule=<unix-ms> agent=… brand=…` (own todo fields). Both take ONE id, so a loop over `list --json | jq -r \'.items[].id\'` is how you close, retitle, refile or archive MANY todos at once; `project set|settings|groups …` (name, settings, todo groups), `agent create|update <agent> model=… sysmsg=…` (permissions/MCP/device wiring and delete are refused from an agent shell). Surface results into chat: `show <file|-> [todo-id]` (renders by mimetype; `--card <name>` via project renderer; `--alias <name>` updates in place), `open <url>` embeds a live preview. Notifications: `inbox [needs-you|messages|activity] [--unread]` reads the user\'s bell feed (what finished/failed/needs them while away), `inbox seen [tab]` marks it read; `notify "Title" "message" [--href /t/<id>]` leaves a note in the user\'s Messages tab + phone push (shown as from you); `--to <email>` reaches a member of the current project instead (`project members` lists them, 20/day) — nobody else; same text is delivered once, max 10/day to the user, use for things they must see later (not chat replies). This is the ONLY way to display a local file (image, pdf, html) in the chat: markdown `![](path.png)` with a local/relative path does NOT resolve to workspace files or attachments and 404s in the browser. `--template` for registry workflows.',
+    installCmd: "npm install -g @todoforai/cli",
+    versionCmd: "tfa-cli --version 2>/dev/null | sed -n 1p",
+    preinstallCloud: true,
+    preinstallJarvis: true,
+    aliases: ["todoforai-cli", "todoai"]
+  },
+  curl: {
+    commodity: true,
+    category: "networking",
+    pkg: "curl",
+    installer: "system",
+    label: "Web Request",
+    summary: "Fetch URLs and call web APIs.",
+    binName: "curl",
+    description: "HTTP/HTTPS/FTP client: GET/POST/PUT/DELETE, headers, auth, file upload/download, follow redirects, cookies, TLS.",
+    versionCmd: "curl --version 2>/dev/null | sed -n 1p | cut -d' ' -f1-2",
+    preinstallCloud: true,
+    internal: true,
+    preinstallJarvis: true
+  },
+  cloudflared: {
+    preinstallCloud: true,
+    cloudInstallCmd: "curl -fsSL https://github.com/cloudflare/cloudflared/releases/download/2026.9.0/cloudflared-linux-amd64 -o /usr/local/bin/cloudflared && chmod 0755 /usr/local/bin/cloudflared",
+    cloudVerifyCmd: "cloudflared --version",
+    commodity: true,
+    category: "networking",
+    pkg: "cloudflared",
+    installer: "binary",
+    label: "Tunnel",
+    summary: "Put a local app on a public web address.",
+    description: "`cloudflared tunnel --url http://localhost:<port>` prints a public https URL.",
+    versionCmd: "cloudflared --version 2>/dev/null | sed -n 1p"
+  },
+  vault: {
+    category: "security",
+    pkg: "vault",
+    installer: "binary",
+    label: "HashiCorp Vault",
+    summary: "Read and manage secrets in HashiCorp Vault.",
+    statusCmd: "vault token lookup >/dev/null 2>&1 && echo authenticated",
+    loginCmd: "vault login <token>",
+    credentialPaths: ["~/.vault-token"],
+    versionCmd: "vault --version 2>/dev/null | sed -n '1s/ (.*//p'",
+    description: "HashiCorp Vault secrets management and dynamic credentials."
+  },
+  rclone: {
+    category: "cloud",
+    pkg: "rclone",
+    installer: "binary",
+    preinstallCloud: true,
+    binary: {
+      "linux-x86_64": { url: "https://github.com/todoforai/rclone-backend/releases/download/v0.1.6/rclone-linux-amd64.tar.gz", archive: "tar.gz", extract: "rclone" },
+      "linux-aarch64": { url: "https://github.com/todoforai/rclone-backend/releases/download/v0.1.6/rclone-linux-arm64.tar.gz", archive: "tar.gz", extract: "rclone" },
+      "darwin-x86_64": { url: "https://github.com/todoforai/rclone-backend/releases/download/v0.1.6/rclone-darwin-amd64.tar.gz", archive: "tar.gz", extract: "rclone" },
+      "darwin-aarch64": { url: "https://github.com/todoforai/rclone-backend/releases/download/v0.1.6/rclone-darwin-arm64.tar.gz", archive: "tar.gz", extract: "rclone" },
+      "windows-x86_64": { url: "https://github.com/todoforai/rclone-backend/releases/download/v0.1.6/rclone-windows-amd64.zip", archive: "zip", extract: "rclone.exe" }
+    },
+    label: "Cloud Storage",
+    summary: "Move files between Google Drive, Dropbox, OneDrive, S3 and more.",
+    statusCmd: "rclone listremotes --long 2>/dev/null | tr -s ' ' | grep -v ' todoforai *$' | grep -m20 .",
+    loginCmd: "rclone config",
+    loginTerminalHint: "Connect a storage from its own tile (Google Drive, OneDrive, Dropbox…). For other backends run `rclone config` in a terminal on this host.",
+    oauthUrlPattern: "(https?://127\\.0\\.0\\.1:\\d+/auth\\?\\S+)",
+    oauthCallbackPort: 53682,
+    credentialPaths: ["~/.config/rclone/rclone.conf"],
+    subProviders: {
+      gdrive: {
+        label: "Google Drive",
+        authType: "oauth",
+        connectCmd: "rclone config create {{REMOTE}} drive",
+        remoteName: "gdrive",
+        rcloneType: "drive",
+        userInfoCmd: `TOKEN=$(rclone config dump 2>/dev/null | python3 -c "import json,sys; print(json.loads(json.load(sys.stdin)['{{REMOTE}}']['token'])['access_token'])") && curl -sf 'https://www.googleapis.com/drive/v3/about?fields=user' -H "Authorization: Bearer $TOKEN" | python3 -c "import json,sys; print(json.load(sys.stdin)['user']['emailAddress'])" 2>/dev/null`
+      },
+      onedrive: {
+        label: "OneDrive",
+        authType: "oauth",
+        connectCmd: "rclone config create {{REMOTE}} onedrive",
+        remoteName: "onedrive",
+        rcloneType: "onedrive",
+        userInfoCmd: `TOKEN=$(rclone config dump 2>/dev/null | python3 -c "import json,sys; print(json.loads(json.load(sys.stdin)['{{REMOTE}}']['token'])['access_token'])") && curl -sf 'https://graph.microsoft.com/v1.0/me' -H "Authorization: Bearer $TOKEN" | python3 -c "import json,sys; d=json.load(sys.stdin); print(d.get('mail') or d.get('userPrincipalName',''))" 2>/dev/null`
+      },
+      dropbox: {
+        label: "Dropbox",
+        authType: "oauth",
+        connectCmd: "rclone config create {{REMOTE}} dropbox",
+        remoteName: "dropbox",
+        rcloneType: "dropbox",
+        userInfoCmd: `TOKEN=$(rclone config dump 2>/dev/null | python3 -c "import json,sys; print(json.loads(json.load(sys.stdin)['{{REMOTE}}']['token'])['access_token'])") && curl -sf -X POST 'https://api.dropboxapi.com/2/users/get_current_account' -H "Authorization: Bearer $TOKEN" | python3 -c "import json,sys; print(json.load(sys.stdin)['email'])" 2>/dev/null`
+      },
+      s3: {
+        label: "Amazon S3",
+        authType: "credentials",
+        connectCmd: "rclone config create {{REMOTE}} s3",
+        remoteName: "s3",
+        rcloneType: "s3"
+      }
+    },
+    versionCmd: "rclone version 2>/dev/null | sed -n 1p",
+    preinstallJarvis: true,
+    description: "Access Google Drive, OneDrive, Dropbox, S3, and 40+ cloud providers. List, copy, sync, move, and mount files; use `rclone config create <name> <provider>` to connect."
+  },
+  aws: {
+    preinstallCloud: true,
+    cloudInstallCmd: "curl -fsSL https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip -o /tmp/awscli.zip && unzip -qo /tmp/awscli.zip -d /tmp && /tmp/aws/install --update && rm -rf /tmp/aws /tmp/awscli.zip",
+    cloudVerifyCmd: "aws --version",
+    category: "cloud",
+    pkg: "awscli",
+    installer: "system",
+    label: "AWS",
+    summary: "Manage your AWS account and services.",
+    installCmd: `mkdir -p "$HOME/.todoforai/tools/bin"; if [ "$(uname -s)" = Darwin ]; then curl -fsSL https://awscli.amazonaws.com/AWSCLIV2.pkg -o /tmp/AWSCLIV2.pkg && printf '<?xml version="1.0" encoding="UTF-8"?>\\n<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">\\n<plist version="1.0"><array><dict><key>choiceAttribute</key><string>customLocation</string><key>attributeSetting</key><string>%s</string><key>choiceIdentifier</key><string>default</string></dict></array></plist>\\n' "$HOME/.todoforai/tools" > /tmp/aws-choices.xml && installer -pkg /tmp/AWSCLIV2.pkg -target CurrentUserHomeDirectory -applyChoiceChangesXML /tmp/aws-choices.xml && mkdir -p "$HOME/.todoforai/tools/bin" && ln -sf "$HOME/.todoforai/tools/aws-cli/aws" "$HOME/.todoforai/tools/bin/aws" && ln -sf "$HOME/.todoforai/tools/aws-cli/aws_completer" "$HOME/.todoforai/tools/bin/aws_completer"; rc=$?; rm -f /tmp/AWSCLIV2.pkg /tmp/aws-choices.xml; exit $rc; else ARCH=$(uname -m); case "$ARCH" in arm64|aarch64) ARCH=aarch64;; *) ARCH=x86_64;; esac; curl -fsSL "https://awscli.amazonaws.com/awscli-exe-linux-$ARCH.zip" -o /tmp/awscli.zip && rm -rf /tmp/aws && unzip -qo /tmp/awscli.zip -d /tmp && /tmp/aws/install --update --install-dir "$HOME/.todoforai/tools/aws-cli" --bin-dir "$HOME/.todoforai/tools/bin"; rc=$?; rm -rf /tmp/aws /tmp/awscli.zip; exit $rc; fi`,
+    statusCmd: "aws sts get-caller-identity --query Arn --output text 2>/dev/null | sed 's/.*\\///' | grep -m1 .",
+    loginCmd: "aws configure set aws_access_key_id <access_key_id> && aws configure set aws_secret_access_key <secret_access_key> && aws configure set region <region>",
+    credentialPaths: ["~/.aws/credentials", "~/.aws/config", "~/.aws/sso/cache"],
+    description: "Official AWS CLI v2, installed user-locally into ~/.todoforai/tools (no sudo; Linux x86_64/aarch64 + macOS). Auth via `aws configure` (access keys) or `aws configure sso` + `aws sso login` (browser device flow).",
+    versionCmd: "aws --version 2>/dev/null | sed -n 1p",
+    uninstallCmd: 'rm -rf "$HOME/.todoforai/tools/aws-cli" "$HOME/.todoforai/tools/bin/aws" "$HOME/.todoforai/tools/bin/aws_completer"; hash -r 2>/dev/null; ! command -v aws >/dev/null 2>&1 || { echo "aws is still on PATH: $(command -v aws) — not installed by TODOforAI, remove it with the package manager that installed it (snap/apt/brew/sudo)"; exit 1; }'
+  },
+  gcloud: {
+    category: "cloud",
+    pkg: "google-cloud-sdk",
+    installer: "system",
+    label: "Google Cloud",
+    summary: "Manage your Google Cloud projects and services.",
+    needsPython: true,
+    installCmd: `curl -fsSL https://dl.google.com/dl/cloudsdk/channels/rapid/google-cloud-sdk.tar.gz | tar -xzC "$HOME" && CLOUDSDK_PYTHON="$py" "$HOME/google-cloud-sdk/install.sh" --quiet --install-python false --usage-reporting false --path-update false --command-completion false && mkdir -p "$HOME/.todoforai/tools/bin" && rm -f "$HOME/.todoforai/tools/bin/gcloud" && printf '#!/bin/sh\\nCLOUDSDK_PYTHON="\${CLOUDSDK_PYTHON:-%s}" exec "$HOME/google-cloud-sdk/bin/gcloud" "$@"\\n' "$py" > "$HOME/.todoforai/tools/bin/gcloud" && chmod +x "$HOME/.todoforai/tools/bin/gcloud"`,
+    statusCmd: `gcloud auth list --filter=status:ACTIVE --format="value(account)" 2>/dev/null | tr -d '\\r' | grep -m1 .`,
+    loginCmd: "gcloud auth login --no-launch-browser",
+    loginNeedsPty: true,
+    stdinPaste: true,
+    oauthUrlPattern: "(https://accounts\\.google\\.com/o/oauth2/auth\\S+)",
+    credentialPaths: ["~/.config/gcloud"],
+    description: "Official Google Cloud CLI. `gcloud auth login --no-launch-browser` prints the OAuth URL and waits for the pasted verification code.",
+    versionCmd: "gcloud --version 2>/dev/null | sed -n 1p",
+    uninstallCmd: 'rm -rf "$HOME/google-cloud-sdk" "$HOME/.todoforai/tools/bin/gcloud"; hash -r 2>/dev/null; ! command -v gcloud >/dev/null 2>&1 || { echo "gcloud is still on PATH: $(command -v gcloud)"; exit 1; }',
+    updateCmd: "gcloud components update --quiet"
+  },
+  az: {
+    category: "cloud",
+    pkg: "azure-cli",
+    installer: "pip",
+    label: "Azure",
+    summary: "Manage your Microsoft Azure resources.",
+    binName: "az",
+    statusCmd: "az account show --query user.name -o tsv 2>/dev/null | tr -d '\\r' | grep -m1 .",
+    loginCmd: "az login --use-device-code",
+    oauthUrlPattern: "(https://login\\.microsoft\\.com/device\\S*)",
+    deviceCodePattern: "enter the code ([A-Z0-9]+)",
+    canStreamLogin: true,
+    credentialPaths: ["~/.azure"],
+    description: "Official Azure CLI. Device-code login: prints login.microsoft.com/device + a code, then polls — no callback port.",
+    versionCmd: `az version --query '"azure-cli"' -o tsv 2>/dev/null | sed -n 1p`
+  },
+  doctl: {
+    preinstallCloud: true,
+    cloudInstallCmd: "curl -fsSL https://github.com/digitalocean/doctl/releases/download/v1.168.0/doctl-1.168.0-linux-amd64.tar.gz | tar -xz -C /usr/local/bin doctl",
+    cloudVerifyCmd: "doctl version",
+    category: "cloud",
+    pkg: "doctl",
+    installer: "binary",
+    label: "DigitalOcean",
+    summary: "Manage your DigitalOcean servers and apps.",
+    statusCmd: "doctl account get --format Email --no-header 2>/dev/null | tr -d '\\r' | grep -m1 .",
+    loginCmd: "doctl auth init -t <access_token>",
+    loginNeedsPty: true,
+    credentialPaths: ["~/.config/doctl/config.yaml"],
+    description: "Official DigitalOcean CLI. `doctl auth init` prompts for an API token from cloud.digitalocean.com/account/api/tokens.",
+    versionCmd: "doctl version 2>/dev/null | sed -n 1p"
+  },
+  rdt: {
+    preinstallCloud: true,
+    packages: ["rdt-cli==0.4.1"],
+    category: "social",
+    pkg: "rdt-cli",
+    installer: "pip",
+    label: "Reddit",
+    summary: "Search Reddit, read threads and post comments.",
+    statusCmd: `rdt status 2>&1 | sed -n 's/.*"username"[[:space:]]*:[[:space:]]*"\\([^"]*\\)".*/\\1/p' | grep -m10 .`,
+    loginCmd: "rdt login",
+    loginTerminalHint: "Log in to reddit.com in a browser on this host (Chrome/Firefox), then run `rdt login`: it imports that browser's Reddit cookies.",
+    credentialPaths: ["~/.config/rdt-cli/credential.json"],
+    description: 'Reddit CLI. Read: `rdt search "<query>" -r <sub> --json -c`, `rdt sub <name>`, `rdt read <postId>`, `rdt user-comments <user>`. Write: `rdt comment <postId> "<text>"`, `rdt upvote`, `rdt save`.',
+    versionCmd: "rdt --version 2>/dev/null | sed -n 1p"
+  },
+  pymupdf: {
+    category: "utility",
+    pkg: "pymupdf",
+    packages: ["pymupdf==1.28.2"],
+    installer: "pip",
+    label: "PDF",
+    summary: "Read, edit, merge and split PDF files.",
+    versionCmd: "{ python -c 'import pymupdf; print(pymupdf.__version__)' || python3 -c 'import pymupdf; print(pymupdf.__version__)' || py -c 'import pymupdf; print(pymupdf.__version__)'; } 2>/dev/null",
+    preinstallCloud: true,
+    cloudVerifyCmd: "python3 -c 'import pymupdf'",
+    preinstallJarvis: true,
+    description: "PDF text editing, extraction, merge, split. Call via `python3 -c`."
+  },
+  pyhanko: {
+    category: "security",
+    pkg: "pyhanko-cli",
+    packages: ["pyhanko-cli==0.5.0", "pyHanko[pkcs11,image-support,opentype]==0.37.0"],
+    installer: "pip",
+    binName: "pyhanko",
+    label: "PDF Signing",
+    summary: "Digitally sign and verify PDFs with a certificate (PAdES, timestamps, smart cards).",
+    versionCmd: "pyhanko --version 2>/dev/null | sed -n 1p",
+    preinstallCloud: true,
+    cloudVerifyCmd: "pyhanko --version",
+    preinstallJarvis: true,
+    description: "Cryptographic PDF signing/validation (PAdES B-B..B-LTA). Sign: `pyhanko sign addsig --field Sig1 [--timestamp-url <tsa>] pkcs12 --passfile pass.txt in.pdf out.pdf cert.p12`; smart card/eID: `... pkcs11 --lib <pkcs11.so> in.pdf out.pdf`; verify: `pyhanko sign validate --pretty-print [--trust ca.pem] out.pdf`; list fields: `pyhanko sign list`. The signer's cert/key comes from the user (vault); self-signed certs validate only with `--trust`. Not for click-to-sign workflows."
+  },
+  anydoc: {
+    category: "utility",
+    pkg: "@firecrawl/anydoc",
+    installer: "npm",
+    binName: "anydoc",
+    label: "Doc to Markdown",
+    summary: "Turn Word, PowerPoint, Excel and other documents into clean text.",
+    description: "Office/rich docs (docx/pptx/xlsx/odt/rtf/epub/csv) → Markdown, fully local. `anydoc file.docx` → stdout, `-o out.md` writes, `anydoc - --format csv < stdin`. Prefer over raw XML extraction for reading; one-way, no OCR for scanned PDFs.",
+    versionCmd: "anydoc --version 2>/dev/null | sed -n 1p",
+    preinstallCloud: true,
+    preinstallJarvis: true
+  },
+  "agent-browser": {
+    category: "development",
+    pkg: "agent-browser@0.30.1",
+    installer: "npm",
+    preinstallCloud: true,
+    label: "Browser",
+    summary: "Browse websites automatically: click, type, read and screenshot.",
+    description: "Browser automation over CDP (`open`/`snapshot`/`click`/`type`/`fill`/`read`/`screenshot`/`eval`). `connect '<url>'` to a listed live browser (prefer the user's real Chrome), verify with `snapshot`; if empty, `close` (own session only) and reconnect once. NEVER `close --all`. Shared browser: `tab new` for your own tab, `tab <id>` before each command. No URL listed: cloud → browser-manager-cli; PC with display → Chrome `--remote-debugging-port=9222`, attach `--cdp 9222`.",
+    versionCmd: "agent-browser --version 2>/dev/null | sed -n 1p",
+    preinstallJarvis: true
+  },
+  "browser-manager-cli": {
+    category: "development",
+    pkg: "browser-manager-cli",
+    installer: "binary",
+    binName: "browser-manager-cli",
+    preinstallCloud: true,
+    label: "Browser Manager",
+    summary: "Start browsers in the cloud for automated browsing.",
+    platformAuth: true,
+    description: "Spawns cloud Chromium sessions, each exposed as a CDP WebSocket for agent-browser to drive. `create` prints one line ending in a cdpUrl — pass it straight to `agent-browser connect '<cdpUrl>'` (connect the cdpUrl, not the Chrome debug port). `list`/`get <id>`, `delete <id>`/`delete-all`, `hibernate`/`restore`. Sessions run stealth Chromium that reads as a real desktop browser. For sites that block datacenter IPs, route through a proxy: `create --proxy socks5://host:port [--proxy-user U --proxy-pass P]`. Use this on the cloud VM instead of launching a local browser.",
+    versionCmd: "browser-manager-cli version 2>/dev/null | sed -n 1p",
+    binary: {
+      "linux-x86_64": {
+        url: "https://github.com/todoforai/browser-manager/releases/download/cli-v0.1.1/browser-manager-cli-linux-x86_64",
+        archive: "raw"
+      },
+      "linux-aarch64": {
+        url: "https://github.com/todoforai/browser-manager/releases/download/cli-v0.1.1/browser-manager-cli-linux-aarch64",
+        archive: "raw"
+      },
+      "darwin-x86_64": {
+        url: "https://github.com/todoforai/browser-manager/releases/download/cli-v0.1.1/browser-manager-cli-darwin-x86_64",
+        archive: "raw"
+      },
+      "darwin-aarch64": {
+        url: "https://github.com/todoforai/browser-manager/releases/download/cli-v0.1.1/browser-manager-cli-darwin-aarch64",
+        archive: "raw"
+      },
+      "windows-x86_64": {
+        url: "https://github.com/todoforai/browser-manager/releases/download/cli-v0.1.1/browser-manager-cli-windows-x86_64.exe",
+        archive: "raw"
+      }
+    },
+    preinstallJarvis: true
+  },
+  "todoforai-browser": {
+    category: "development",
+    pkg: "@todoforai/browser",
+    aliases: ["tfa-browser"],
+    installer: "npm",
+    preinstallCloud: true,
+    label: "Browser (Extension)",
+    summary: "Drive your own browser through the TODOforAI extension.",
+    versionCmd: `node -p "require(require('fs').realpathSync(require('child_process').execSync('command -v todoforai-browser',{encoding:'utf8'}).trim()).replace(/\\/dist\\/index\\.js$/, '/package.json')).version" 2>/dev/null`,
+    internal: true,
+    preinstallJarvis: true,
+    description: "Browser automation via extension (non-headless), web scraping, accessibility tree snapshots, screenshots, PDF generation"
+  },
+  "tfa-explore": {
+    preinstallCloud: true,
+    category: "development",
+    pkg: "@todoforai/tfa-explore",
+    installer: "npm",
+    label: "Explore",
+    summary: "Send a helper agent to explore a codebase and report back.",
+    platformAuth: true,
+    description: 'Sub-agent codebase exploration in its own context, you get only the answer: `tfa-explore "where is auth handled?" [--repo <path>]`. Prefer over manual multi-file searching.',
+    versionCmd: "tfa-explore --version 2>/dev/null | sed -n 1p",
+    installCmd: "npm install -g @todoforai/tfa-explore",
+    internal: true
+  },
+  "tfa-review": {
+    preinstallCloud: true,
+    category: "development",
+    pkg: "@todoforai/tfa-review",
+    installer: "npm",
+    label: "Review",
+    summary: "Send a helper agent to review your code changes.",
+    platformAuth: true,
+    description: 'Sub-agent review of a git diff in its own context: `tfa-review "<goal>" [--repo <path>] [--against <ref>]` (default: uncommitted). Run before calling a non-trivial change done.',
+    versionCmd: "tfa-review --version 2>/dev/null | sed -n 1p",
+    installCmd: "npm install -g @todoforai/tfa-review",
+    internal: true
+  },
+  "tfa-summary": {
+    preinstallCloud: true,
+    category: "development",
+    pkg: "@todoforai/tfa-summary",
+    installer: "npm",
+    label: "Summary",
+    summary: "Summarize files or long output with a helper agent.",
+    platformAuth: true,
+    description: 'Sub-agent summary so raw text never enters your context: `cat big.log | tfa-summary "what failed?"`, or `-f <file>` (repeatable).',
+    versionCmd: "tfa-summary --version 2>/dev/null | sed -n 1p",
+    installCmd: "npm install -g @todoforai/tfa-summary",
+    internal: true
+  },
+  "tfa-handoff": {
+    preinstallCloud: true,
+    category: "development",
+    pkg: "@todoforai/tfa-handoff",
+    installer: "npm",
+    label: "Handoff",
+    summary: "Turn a long conversation into a short handover note.",
+    platformAuth: true,
+    description: "Compact a conversation into a handoff document for a fresh agent.",
+    versionCmd: "tfa-handoff --version 2>/dev/null | sed -n 1p",
+    installCmd: "npm install -g @todoforai/tfa-handoff",
+    internal: true
+  },
+  "tfa-wait": {
+    category: "development",
+    pkg: "@todoforai/tfa-wait",
+    installer: "npm",
+    label: "Wait",
+    summary: "Wait for a time or an event, then continue the task.",
+    platformAuth: true,
+    description: "Schedule a wake-up: `tfa-wait '<expr>' \"<message>\"` — expr is a time (`3h`, `daily@9:00`), a webhook, or a command's output; the message arrives later as a new chat message. Wait for a long job: `tfa-wait 'bench || 6h' \"Done: exit {{payload.exit}}\"` then `tfa-wait run '<cmd>' --pipe bench --on-exit &` (each stdout line = event; cancelling kills the command). Never pgrep/sleep poll loops.",
+    versionCmd: "tfa-wait --version 2>/dev/null | sed -n 1p",
+    installCmd: "npm install -g @todoforai/tfa-wait",
+    preinstallCloud: true,
+    internal: true,
+    preinstallJarvis: true
+  },
+  "tfa-vault": {
+    category: "security",
+    pkg: "@todoforai/tfa-vault",
+    installer: "npm",
+    label: "Vault",
+    summary: "Your password and secret store.",
+    platformAuth: true,
+    description: "The user's encrypted secret vault — using its secrets is the intended workflow. READ: when a task needs a key/token/password the user owns, `tfa-vault list` then `get <path>`; don't ask for what's already stored; never echo values. WRITE proactively: any new secret in the conversation (pasted, generated, from a login) → `put <path> field=value` (`patch` adds fields; `put` refuses an existing path — `put --force` replaces all fields on rotation). Paths: `accounts/<svc>`, `api/<svc>`, `secrets/<name>`.",
+    versionCmd: "tfa-vault --version 2>/dev/null | sed -n 1p",
+    installCmd: "npm install -g @todoforai/tfa-vault",
+    preinstallCloud: true,
+    preinstallJarvis: true
+  },
+  "tfa-settings": {
+    category: "utility",
+    pkg: "@todoforai/tfa-settings",
+    installer: "npm",
+    label: "Settings",
+    summary: "Change your TODOforAI app preferences from the shell.",
+    platformAuth: true,
+    description: "The user's TODOforAI app preferences (AppSettings): `list`, `get <key>`, `set key=value …`, `keys` (documented keys). Use when asked to change theme, list style, tool-block density, thinking traces, sounds/toasts, preview columns, wallpaper etc. Values are JSON when parseable. Consent/credential/escalation keys (shellExecution, notifications, analytics, keyboard bindings, vault provider, billing address) are refused from an agent shell — tell the user to change those in Settings.",
+    versionCmd: "tfa-settings --version 2>/dev/null | sed -n 1p",
+    installCmd: "npm install -g @todoforai/tfa-settings",
+    preinstallCloud: true,
+    preinstallJarvis: true
+  },
+  "tfa-memory": {
+    category: "productivity",
+    pkg: "@todoforai/tfa-memory",
+    installer: "npm",
+    label: "Memory",
+    summary: "Your long-term memory of notes, facts and past TODOs.",
+    platformAuth: true,
+    description: 'User\'s long-term memory (notes/procedures/decisions, address `source/ref`) plus every past TODO message (read-only, `todo/<todoId>:<messageId>`). READ: `search "<topic>" --mode fused` first (`lexical` = all words newest first, `semantic` = meaning; `--source todo` / `--todo <id>` narrow). stderr prints `N row(s) contain a query word` — if N exceeds what you saw, page with `--exclude <address>`. `get <address>` = full row, `around <address> --before N --after N` = surrounding dialogue. Before answering from memory, search once more with your draft\'s key facts. WRITE durable facts proactively: `add <source>/<ref> "text"` (same address updates in place; short source names like deploy-notes, preferences). `sources` lists them.',
+    versionCmd: "tfa-memory --version 2>/dev/null | sed -n 1p",
+    installCmd: "npm install -g @todoforai/tfa-memory",
+    preinstallCloud: true,
+    preinstallJarvis: true
+  },
+  "todoregistry-cli": {
+    category: "development",
+    pkg: "@todoforai/todoregistry-cli",
+    installer: "npm",
+    label: "TODO Registry",
+    summary: "Browse ready-made business task templates.",
+    description: "Reusable business task templates (SEO, email, CRM, ads, social, …): `search <q>`, `get <id>`, `list [category]`, `categories`, `create --name … --description … --body @prompt.md`. To recommend a template, don't create a todo directly — `tfa-cli recommend --template <id> --project <projectId>`.",
+    versionCmd: "todoregistry-cli --version 2>/dev/null | sed -n 1p",
+    installCmd: "npm install -g @todoforai/todoregistry-cli",
+    preinstallCloud: true,
+    internal: true,
+    preinstallJarvis: true
+  },
+  "tfa-surface": {
+    preinstallCloud: true,
+    category: "utility",
+    pkg: "@todoforai/tfa-surface",
+    installer: "npm",
+    label: "Surface",
+    summary: "See and control what is on your TODOforAI screen.",
+    platformAuth: true,
+    description: "The user's live UI from the shell. Everything on screen is a SURFACE holding one ref (a todo id, `<todoId>:<alias>` = a shown artifact, or a url). `describe` lists them (kind, id, ref, focus, embedded-browser CDP URL; `--json`). `open overlay <todoId>` (full page), `open window <ref>` (floating), `open panel changes|preview|browser|terminal [--url]` (a todo's side panel), `open card <ref> [--title] [--group <slug>]` (a persisted board card every member sees); `close|focus <kind> <id>`. Persistent state (plans, reports, live status) → `show chat.panel <todoId> \"...md\"` (stdin ok; re-show updates in place), `clear` removes; events go in chat. `card add|list|get|rm <name>` = project HTML renderers. Exit 2 = no frontend connected.",
+    versionCmd: "tfa-surface --version 2>/dev/null | sed -n 1p",
+    installCmd: "npm install -g @todoforai/tfa-surface",
+    internal: true
+  },
+  bun: {
+    commodity: true,
+    category: "development",
+    pkg: "bun",
+    installer: "system",
+    label: "JS/TS Runtime",
+    summary: "Run JavaScript and TypeScript code, fast.",
+    versionCmd: "bun --version 2>/dev/null",
+    preinstallCloud: true,
+    cloudInstallCmd: "export BUN_INSTALL=/usr/local && curl -fsSL https://bun.sh/install | bash && ln -sf /usr/local/bin/bun /usr/local/bin/bunx",
+    cloudVerifyCmd: "bun --version",
+    internal: true,
+    preinstallJarvis: true,
+    description: "Run JavaScript/TypeScript, install packages, run tests (`bun`, `bunx`)."
+  },
+  bunx: {
+    commodity: true,
+    category: "development",
+    pkg: "bunx",
+    installer: "system",
+    label: "Bun Package Runner",
+    summary: "Run a JavaScript package without installing it.",
+    versionCmd: "bunx --version 2>/dev/null",
+    preinstallCloud: true,
+    cloudVerifyCmd: "bunx --version",
+    internal: true,
+    description: "Run package binaries with Bun."
+  },
+  node: {
+    commodity: true,
+    category: "development",
+    pkg: "node",
+    installer: "system",
+    label: "JavaScript Runtime",
+    summary: "Run JavaScript code.",
+    versionCmd: "node -p 'process.version' 2>/dev/null",
+    preinstallCloud: true,
+    cloudInstallCmd: "curl -fsSL https://deb.nodesource.com/setup_24.x | bash -",
+    cloudAptPackages: ["nodejs"],
+    cloudVerifyCmd: "node --version",
+    internal: true,
+    preinstallJarvis: true,
+    description: "Run Node.js scripts."
+  },
+  python3: {
+    commodity: true,
+    category: "development",
+    pkg: "python3",
+    installer: "system",
+    label: "Python",
+    summary: "Run Python code.",
+    versionCmd: "{ python3 --version || python --version || py --version; } 2>/dev/null | sed -n 1p",
+    preinstallCloud: true,
+    cloudAptPackages: ["python3"],
+    cloudVerifyCmd: "python3 --version",
+    internal: true,
+    preinstallJarvis: true,
+    description: "Run Python scripts."
+  },
+  npm: {
+    commodity: true,
+    category: "development",
+    pkg: "npm",
+    installer: "system",
+    label: "Node Package Manager",
+    summary: "Install JavaScript packages.",
+    versionCmd: "npm --version 2>/dev/null",
+    preinstallCloud: true,
+    cloudVerifyCmd: "npm --version",
+    internal: true,
+    description: "Install Node packages and run package scripts."
+  },
+  npx: {
+    commodity: true,
+    category: "development",
+    pkg: "npx",
+    installer: "system",
+    label: "Node Package Runner",
+    summary: "Run a JavaScript package without installing it.",
+    versionCmd: "npx --version 2>/dev/null",
+    preinstallCloud: true,
+    cloudVerifyCmd: "npx --version",
+    internal: true,
+    description: "Run npm package binaries."
+  },
+  pip3: {
+    preinstallCloud: true,
+    cloudAptPackages: ["python3-pip"],
+    cloudVerifyCmd: "pip3 --version",
+    commodity: true,
+    category: "development",
+    pkg: "pip3",
+    installer: "system",
+    label: "Python Package Installer",
+    summary: "Install Python packages.",
+    versionCmd: "pip3 --version 2>/dev/null | sed -n 1p | cut -d' ' -f1-2",
+    internal: true,
+    description: "Install Python packages."
+  },
+  uv: {
+    commodity: true,
+    category: "development",
+    pkg: "uv",
+    installer: "system",
+    label: "Python Package Manager",
+    summary: "Install Python packages and manage environments, fast.",
+    versionCmd: "uv --version 2>/dev/null",
+    preinstallCloud: true,
+    cloudInstallCmd: "curl -LsSf https://astral.sh/uv/0.9.6/install.sh | env UV_INSTALL_DIR=/usr/local/bin sh",
+    cloudVerifyCmd: "uv --version",
+    internal: true,
+    description: "Manage Python dependencies, environments, tools, and scripts (`uv`, `uvx`)."
+  },
+  uvx: {
+    commodity: true,
+    category: "development",
+    pkg: "uvx",
+    installer: "system",
+    label: "Python Tool Runner",
+    summary: "Run a Python tool without installing it.",
+    versionCmd: "uvx --version 2>/dev/null",
+    preinstallCloud: true,
+    cloudVerifyCmd: "uvx --version",
+    internal: true,
+    description: "Run Python tools in isolated environments."
+  },
+  ripgrep: {
+    commodity: true,
+    category: "development",
+    pkg: "ripgrep",
+    installer: "binary",
+    label: "Search",
+    summary: "Search text across files, very fast.",
+    description: "Fast recursive grep with regex, .gitignore-aware, parallel, unicode-correct",
+    versionCmd: "rg --version 2>/dev/null | sed -n 1p",
+    preinstallCloud: true,
+    binary: {
+      "linux-x86_64": {
+        url: "https://github.com/BurntSushi/ripgrep/releases/download/14.1.1/ripgrep-14.1.1-x86_64-unknown-linux-musl.tar.gz",
+        archive: "tar.gz",
+        extract: "ripgrep-14.1.1-x86_64-unknown-linux-musl/rg"
+      },
+      "linux-aarch64": {
+        url: "https://github.com/BurntSushi/ripgrep/releases/download/14.1.1/ripgrep-14.1.1-aarch64-unknown-linux-gnu.tar.gz",
+        archive: "tar.gz",
+        extract: "ripgrep-14.1.1-aarch64-unknown-linux-gnu/rg"
+      },
+      "darwin-x86_64": {
+        url: "https://github.com/BurntSushi/ripgrep/releases/download/14.1.1/ripgrep-14.1.1-x86_64-apple-darwin.tar.gz",
+        archive: "tar.gz",
+        extract: "ripgrep-14.1.1-x86_64-apple-darwin/rg"
+      },
+      "darwin-aarch64": {
+        url: "https://github.com/BurntSushi/ripgrep/releases/download/14.1.1/ripgrep-14.1.1-aarch64-apple-darwin.tar.gz",
+        archive: "tar.gz",
+        extract: "ripgrep-14.1.1-aarch64-apple-darwin/rg"
+      },
+      "windows-x86_64": {
+        url: "https://github.com/BurntSushi/ripgrep/releases/download/14.1.1/ripgrep-14.1.1-x86_64-pc-windows-msvc.zip",
+        archive: "zip",
+        extract: "ripgrep-14.1.1-x86_64-pc-windows-msvc/rg.exe"
+      }
+    },
+    binName: "rg",
+    internal: true,
+    preinstallJarvis: true
+  },
+  "ast-grep": {
+    category: "development",
+    pkg: "ast-grep",
+    installer: "binary",
+    label: "Structural Search",
+    summary: "Search and rewrite code by its structure, not just text.",
+    description: 'Use when regex cannot distinguish syntax from text: `ast-grep -p "foo($$$)" -l ts` finds real calls while ignoring strings and comments; add `--rewrite "..."` for codemods. Prefer `rg` for literal or token search.',
+    versionCmd: "ast-grep --version 2>/dev/null | sed -n 1p",
+    preinstallCloud: true,
+    binary: {
+      "linux-x86_64": {
+        url: "https://github.com/ast-grep/ast-grep/releases/download/0.44.1/app-x86_64-unknown-linux-gnu.zip",
+        archive: "zip",
+        extract: "ast-grep"
+      },
+      "linux-aarch64": {
+        url: "https://github.com/ast-grep/ast-grep/releases/download/0.44.1/app-aarch64-unknown-linux-gnu.zip",
+        archive: "zip",
+        extract: "ast-grep"
+      },
+      "darwin-x86_64": {
+        url: "https://github.com/ast-grep/ast-grep/releases/download/0.44.1/app-x86_64-apple-darwin.zip",
+        archive: "zip",
+        extract: "ast-grep"
+      },
+      "darwin-aarch64": {
+        url: "https://github.com/ast-grep/ast-grep/releases/download/0.44.1/app-aarch64-apple-darwin.zip",
+        archive: "zip",
+        extract: "ast-grep"
+      },
+      "windows-x86_64": {
+        url: "https://github.com/ast-grep/ast-grep/releases/download/0.44.1/app-x86_64-pc-windows-msvc.zip",
+        archive: "zip",
+        extract: "ast-grep.exe"
+      }
+    },
+    binName: "ast-grep",
+    internal: true,
+    preinstallJarvis: true
+  },
+  fd: {
+    commodity: true,
+    category: "development",
+    pkg: "fd-find",
+    installer: "binary",
+    label: "Find Files",
+    summary: "Find files and folders by name.",
+    description: "Fast user-friendly find replacement: regex by default, .gitignore-aware, parallel",
+    versionCmd: "fd --version 2>/dev/null | sed -n 1p",
+    preinstallCloud: true,
+    binary: {
+      "linux-x86_64": {
+        url: "https://github.com/sharkdp/fd/releases/download/v10.2.0/fd-v10.2.0-x86_64-unknown-linux-musl.tar.gz",
+        archive: "tar.gz",
+        extract: "fd-v10.2.0-x86_64-unknown-linux-musl/fd"
+      },
+      "linux-aarch64": {
+        url: "https://github.com/sharkdp/fd/releases/download/v10.2.0/fd-v10.2.0-aarch64-unknown-linux-gnu.tar.gz",
+        archive: "tar.gz",
+        extract: "fd-v10.2.0-aarch64-unknown-linux-gnu/fd"
+      },
+      "darwin-x86_64": {
+        url: "https://github.com/sharkdp/fd/releases/download/v10.2.0/fd-v10.2.0-x86_64-apple-darwin.tar.gz",
+        archive: "tar.gz",
+        extract: "fd-v10.2.0-x86_64-apple-darwin/fd"
+      },
+      "darwin-aarch64": {
+        url: "https://github.com/sharkdp/fd/releases/download/v10.2.0/fd-v10.2.0-aarch64-apple-darwin.tar.gz",
+        archive: "tar.gz",
+        extract: "fd-v10.2.0-aarch64-apple-darwin/fd"
+      },
+      "windows-x86_64": {
+        url: "https://github.com/sharkdp/fd/releases/download/v10.2.0/fd-v10.2.0-x86_64-pc-windows-msvc.zip",
+        archive: "zip",
+        extract: "fd-v10.2.0-x86_64-pc-windows-msvc/fd.exe"
+      }
+    },
+    binName: "fd",
+    internal: true,
+    preinstallJarvis: true
+  },
+  jq: {
+    commodity: true,
+    category: "development",
+    pkg: "jq",
+    installer: "binary",
+    label: "JSON",
+    summary: "Read and reshape JSON data.",
+    description: "Command-line JSON processor: query, filter, transform, format JSON streams",
+    versionCmd: "jq --version 2>/dev/null | sed -n 1p",
+    preinstallCloud: true,
+    binary: {
+      "linux-x86_64": {
+        url: "https://github.com/jqlang/jq/releases/download/jq-1.7.1/jq-linux-amd64",
+        archive: "raw"
+      },
+      "linux-aarch64": {
+        url: "https://github.com/jqlang/jq/releases/download/jq-1.7.1/jq-linux-arm64",
+        archive: "raw"
+      },
+      "darwin-x86_64": {
+        url: "https://github.com/jqlang/jq/releases/download/jq-1.7.1/jq-macos-amd64",
+        archive: "raw"
+      },
+      "darwin-aarch64": {
+        url: "https://github.com/jqlang/jq/releases/download/jq-1.7.1/jq-macos-arm64",
+        archive: "raw"
+      },
+      "windows-x86_64": {
+        url: "https://github.com/jqlang/jq/releases/download/jq-1.7.1/jq-windows-amd64.exe",
+        archive: "raw"
+      }
+    },
+    binName: "jq",
+    internal: true,
+    preinstallJarvis: true
+  },
+  patch: {
+    commodity: true,
+    category: "development",
+    pkg: "patch",
+    installer: "system",
+    preinstallCloud: true,
+    label: "Apply Diff",
+    summary: "Apply a diff to files.",
+    description: "Apply unified/context diff patches to files; reverse, dry-run, fuzzy matching",
+    versionCmd: "patch --version 2>/dev/null | sed -n 1p",
+    binName: "patch",
+    internal: true,
+    preinstallJarvis: true
+  },
+  sed: {
+    commodity: true,
+    category: "development",
+    pkg: "sed",
+    installer: "system",
+    preinstallCloud: true,
+    label: "Replace Text",
+    summary: "Find and replace text in files.",
+    description: "Stream editor: in-place text substitution, line filtering, scripted edits",
+    versionCmd: "sed --version 2>/dev/null | sed -n 1p",
+    binName: "sed",
+    internal: true,
+    preinstallJarvis: true
+  },
+  grep: {
+    commodity: true,
+    category: "development",
+    pkg: "grep",
+    installer: "system",
+    preinstallCloud: true,
+    label: "Search Text",
+    summary: "Search for text in files.",
+    description: "Search plain text for lines matching a regex: recursive, fixed-string, context, invert, count",
+    versionCmd: "grep --version 2>/dev/null | sed -n 1p",
+    binName: "grep",
+    internal: true,
+    preinstallJarvis: true
+  },
+  "wordpress-api": {
+    preinstallCloud: true,
+    category: "development",
+    pkg: "@todoforai/wordpress-api",
+    installer: "npm",
+    label: "WordPress",
+    summary: "Read and publish WordPress posts and pages.",
+    statusCmd: `wordpress-api whoami 2>/dev/null | sed -n 's/.*"slug"[[:space:]]*:[[:space:]]*"\\([^"]*\\)".*/\\1/p' | grep -m10 .`,
+    loginCmd: "wordpress-api auth --site <url> --user <username> --password <app_password>",
+    credentialPaths: ["~/.config/wordpress-api/credentials.json"],
+    description: "WordPress REST API CLI. `wordpress-api auth --site https://example.com --user <user> --password '<application password>'` (application password, not the login password). Reading published content needs no auth. `posts list|get|create|update|delete`, `pages`, `media`, `categories`. `posts create` saves a draft unless --status publish. On Elementor/JetEngine sites content.rendered comes back empty — fetch the post's public URL for the body.",
+    versionCmd: "wordpress-api --version 2>/dev/null | sed -n 1p"
+  },
+  "facebook-pages-api": {
+    preinstallCloud: true,
+    category: "social",
+    pkg: "@todoforai/facebook-pages-api",
+    installer: "npm",
+    label: "Facebook Pages",
+    summary: "Post to your Facebook Page and handle comments.",
+    statusCmd: `facebook-pages-api whoami 2>/dev/null | sed -n 's/.*"name"[[:space:]]*:[[:space:]]*"\\([^"]*\\)".*/\\1/p' | grep -m10 .`,
+    loginCmd: "facebook-pages-api auth --page-id <id> --page-token <token>",
+    credentialPaths: ["~/.config/facebook-pages-api/credentials.json"],
+    description: "Facebook Pages CLI (Meta Graph API). `auth --page-id <id> --page-token <token>` (or env FB_PAGE_ID/FB_PAGE_TOKEN). `feed`, `comments`, `insights`, `conversations`, `media`, and `request <GET|POST|DELETE> <path> [--data <json>]` = any Graph edge with the page token attached (use instead of curl). Writes are live: `feed create --published false` for tests; `comments reply` posts publicly — get human approval. Follower totals: `whoami --fields followers_count,fan_count` (many classic insights metrics are retired). `--help` for subcommands.",
+    versionCmd: "facebook-pages-api --version 2>/dev/null | sed -n 1p"
+  },
+  "ews-api": {
+    category: "email",
+    pkg: "ews-api",
+    installer: "pip",
+    label: "Exchange (EWS)",
+    summary: "Read and write mail on a company Exchange server.",
+    statusCmd: `ews-api whoami 2>/dev/null | sed -n 's/.*"email"[[:space:]]*:[[:space:]]*"\\([^"]*\\)".*/\\1/p' | grep -m10 .`,
+    loginCmd: "ews-api auth --email <email> --username <username> --server <server> --password <password>",
+    credentialPaths: ["~/.config/ews-api/credentials.json"],
+    description: "On-prem Microsoft Exchange mail over EWS (cloud/M365 → outlook-api). `auth --email <e> --username 'DOMAIN\\\\user' --server <host>` (NTLM; password prompt or `--password-stdin`; --server required). Multi-mailbox: `whoami`, `--account <email>`/EWS_ACCOUNT, `default`, `logout`; EWS_EMAIL/EWS_USERNAME/EWS_PASSWORD/EWS_SERVER for unattended runs. `list`, `search <q>`, `read <id>`, `draft`, `reply <id>` — draft/reply stay in Drafts unless --send. Password stored plaintext in ~/.config/ews-api (0600); re-auth after rotation.",
+    versionCmd: "ews-api --version 2>/dev/null | sed -n 1p",
+    logoutCmd: "ews-api logout {{ACCOUNT}}"
+  },
+  "outlook-api": {
+    preinstallCloud: true,
+    category: "email",
+    pkg: "@todoforai/outlook-api",
+    installer: "npm",
+    label: "Outlook (Graph)",
+    summary: "Read and write your Outlook mail.",
+    statusCmd: `outlook-api whoami 2>/dev/null | sed -n 's/.*"userPrincipalName"[[:space:]]*:[[:space:]]*"\\([^"]*\\)".*/\\1/p' | grep -m10 .`,
+    loginCmd: "outlook-api auth",
+    credentialPaths: ["~/.config/outlook-api/config.json"],
+    description: "Outlook/Hotmail/M365 mail over Microsoft Graph (on-prem Exchange → ews-api). `auth` = device-code flow; `--tenant consumers` (default, personal) | `organizations`. list/search/read/attachments are read-only; `draft`/`reply` stay in Drafts unless --send; `send <draftId>`. `get <path>` = raw Graph GET. JSON out.",
+    versionCmd: "outlook-api --version 2>/dev/null | sed -n 1p",
+    deviceCodePattern: "enter the code ([A-Z0-9]+)",
+    oauthUrlPattern: "(https://(?:www\\.microsoft\\.com/link|login\\.microsoft\\.com/device))",
+    canStreamLogin: true
+  },
+  neonctl: {
+    category: "database",
+    pkg: "neonctl",
+    installer: "npm",
+    label: "Neon Postgres",
+    summary: "Manage your Neon Postgres databases and branches.",
+    statusCmd: `test -f ~/.config/neon/credentials.json && neonctl me --output json 2>/dev/null | sed -n 's/.*"email"[[:space:]]*:[[:space:]]*"\\([^"]*\\)".*/\\1/p' | grep -m10 .`,
+    loginCmd: "neonctl auth",
+    oauthUrlPattern: "(https://oauth2\\.neon\\.tech/oauth2/auth\\S+)",
+    credentialPaths: ["~/.config/neon/credentials.json"],
+    description: "Manage Neon Postgres branches and run SQL: `neonctl projects list`, `neonctl branches create`, `neonctl connection-string`. Aliased as `neon`.",
+    versionCmd: "neonctl --version 2>/dev/null | sed -n 1p",
+    aliases: ["neon"],
+    canStreamLogin: true
+  },
+  m365: {
+    preinstallCloud: true,
+    category: "productivity",
+    pkg: "@pnp/cli-microsoft365",
+    installer: "npm",
+    label: "Microsoft 365",
+    summary: "Work with Microsoft 365 mail, Teams, SharePoint and users.",
+    statusCmd: `m365 status --output text 2>/dev/null | tr -d '"' | grep -vi 'logged out' | grep -m1 .`,
+    loginCmd: "m365 login --authType deviceCode --appId 04b07795-8ddb-461a-bbee-02f9e1bf7b46",
+    deviceCodePattern: "enter the code ([A-Z0-9]{8,}) to authenticate",
+    oauthUrlPattern: "open the page (https://\\S+) and enter",
+    credentialPaths: ["~/.cli-m365-msal.json", "~/.cli-m365-connection.json"],
+    description: "Microsoft 365 from the shell: `m365 outlook message list`, `m365 teams team list`, `m365 spo site list`. Device-code login; add `--output json` for parseable output.",
+    versionCmd: `m365 version 2>/dev/null | tr -d '"' | sed -n 1p`
+  },
+  hubspot: {
+    preinstallCloud: true,
+    category: "marketing",
+    pkg: "@hubspot/cli",
+    installer: "npm",
+    label: "HubSpot",
+    summary: "Work with your HubSpot contacts, deals and content.",
+    binName: "hs",
+    statusCmd: "hs account list >/dev/null 2>&1 && echo authenticated",
+    loginCmd: "hs account auth",
+    oauthUrlPattern: "(https://app\\.hubspot\\.com/l/personal-access-key\\S+)",
+    loginNeedsPty: true,
+    credentialPaths: ["~/.hscli/config.yml"],
+    description: "Invoked as `hs`. `hs api <endpoint>` makes authenticated calls to any HubSpot API (contacts, deals, companies) — prefer it over raw curl.",
+    versionCmd: "hs --version 2>/dev/null | sed -n 1p",
+    canStreamLogin: true
+  },
+  "posthog-cli": {
+    preinstallCloud: true,
+    category: "monitoring",
+    pkg: "@posthog/cli",
+    installer: "npm",
+    label: "PostHog",
+    summary: "Query PostHog product analytics and manage feature flags.",
+    statusCmd: `grep -q '"token"' "\${POSTHOG_HOME:-$HOME/.posthog}/credentials.json" 2>/dev/null && echo authenticated`,
+    loginCmd: "posthog-cli login",
+    loginTerminalHint: "Interactive only: run `posthog-cli login` in a terminal on this host (it asks for host, project and a personal API key), or set `POSTHOG_CLI_API_KEY` + `POSTHOG_CLI_PROJECT_ID`.",
+    credentialPaths: ["~/.posthog/credentials.json"],
+    description: "Official PostHog CLI. `posthog-cli api tools` lists the agent-first API tool catalog, `posthog-cli api call <tool> '<json>'` runs one (SQL queries, insights, flags). Also uploads sourcemaps/dSYM. Env alternative: POSTHOG_CLI_API_KEY + POSTHOG_CLI_PROJECT_ID.",
+    versionCmd: "posthog-cli --version 2>/dev/null | sed -n 1p"
+  },
+  canva: {
+    category: "design",
+    pkg: "@canva/cli",
+    installer: "npm",
+    label: "Canva",
+    summary: "Build and deploy Canva apps.",
+    statusCmd: "test -s ~/.canva-cli/credentials && echo authenticated",
+    loginCmd: "canva login --mode manual --lite",
+    loginNeedsPty: true,
+    stdinPaste: true,
+    credentialPaths: ["~/.canva-cli/credentials"],
+    description: "Official Canva CLI — app-development focused: `canva apps create/list/preview`. `canva mcp` starts the Canva Developer MCP server. For design/export automation use the Canva Connect REST API.",
+    versionCmd: "canva --version 2>/dev/null | sed -n 1p",
+    oauthUrlPattern: "OPEN_URL: (https://www\\.canva\\.com/api/oauth/authorize\\S+)"
+  },
+  webflow: {
+    category: "development",
+    pkg: "@webflow/webflow-cli",
+    installer: "npm",
+    label: "Webflow",
+    summary: "Manage Webflow sites, CMS content and assets.",
+    statusCmd: "webflow auth status --skip-update-check >/dev/null 2>&1 && echo authenticated",
+    loginCmd: "webflow auth login --skip-update-check",
+    loginNeedsPty: true,
+    oauthUrlPattern: "(https://webflow\\.com/oauth/webflow/initiate\\S+)",
+    credentialPaths: ["~/.config/webflow"],
+    description: "Manage Webflow sites from the shell: `webflow sites list`, `webflow cms ...`, `webflow assets ...`. Add `--skip-update-check` in scripts.",
+    versionCmd: "webflow --version 2>/dev/null | sed -n 1p"
+  },
+  readwise: {
+    category: "productivity",
+    pkg: "@readwise/cli",
+    installer: "npm",
+    label: "Readwise",
+    summary: "Search and save articles and highlights in Readwise.",
+    statusCmd: "readwise whoami >/dev/null 2>&1 && readwise whoami 2>/dev/null | sed 's/\\x1b\\[[0-9;]*m//g' | grep -m1 .",
+    loginCmd: "readwise login",
+    credentialPaths: ["~/.readwise-cli.json"],
+    description: "Official Readwise/Reader CLI. `readwise search <query>`, `readwise list`, `readwise save <url>`; supports JSON output for piping and a read-only mode for agents. Token login for CI: `readwise login-with-token <token>` (get one at readwise.io/access_token).",
+    versionCmd: "readwise --version 2>/dev/null | sed -n 1p",
+    oauthUrlPattern: "OPEN_URL: (https://readwise\\.io/o/authorize\\S+)",
+    oauthCallbackPort: 6274
+  },
+  granola: {
+    preinstallCloud: true,
+    category: "productivity",
+    pkg: "granola-cli",
+    installer: "npm",
+    binName: "granola",
+    label: "Granola",
+    summary: "Read your Granola meeting notes and transcripts.",
+    statusCmd: `granola auth status -o json 2>/dev/null | sed -n 's/.*"authenticated": *true.*/authenticated/p' | grep -m1 .`,
+    loginCmd: "granola auth login",
+    loginTerminalHint: "Imports the Granola desktop app's session: install Granola on this host, sign in there, then run `granola auth login`.",
+    credentialPaths: ["~/.config/keyring", "~/.config/granola"],
+    versionCmd: "granola --version 2>/dev/null | sed -n 1p",
+    description: "Community Granola CLI (read-only). `granola meeting list [-l N] [--since <date>] [-s <query>] [-a <attendee>] -o json`, `granola meeting notes|enhanced|transcript <id>`, `granola meeting export <id>`; `granola folder list`, `granola workspace list`. `-o json|yaml|toon` for piping. Login imports credentials from the installed Granola desktop app (`granola auth login`) — desktop app must be logged in on the same machine; transcripts need a paid Granola plan."
+  },
+  trello: {
+    preinstallCloud: true,
+    category: "productivity",
+    pkg: "trello-cli",
+    installer: "npm",
+    binName: "trello",
+    label: "Trello",
+    summary: "Manage your Trello boards, lists and cards.",
+    statusCmd: "trello board:list --format json </dev/null >/dev/null 2>&1 && echo authenticated",
+    loginCmd: "trello auth:api-key <key> && trello auth:token <token>",
+    credentialPaths: [
+      "~/.trello-cli"
+    ],
+    versionCmd: "trello --version 2>/dev/null | sed -n 1p",
+    description: "Community Trello CLI (mheap/trello-cli, no official one exists). Auth is a Trello API key + token from https://trello.com/app-key — `trello auth:api-key <key>` then `trello auth:token <token>`. `board:list`, `list:list --board <name>`, `card:list --board <b> --list <l>`, `card:create --board <b> --list <l> --name <n> [--description ..] [--due <date>]`, `card:move`, `card:comment`, `label:*`, `search <q>`. Add `--format json` for piping. Names resolve via a local cache; run `trello board:list` once after login to warm it."
+  },
+  mapps: {
+    category: "development",
+    pkg: "@mondaycom/apps-cli",
+    installer: "npm",
+    label: "monday.com",
+    summary: "Build and deploy monday.com apps.",
+    statusCmd: "grep -qsE '[A-Za-z0-9]' ~/.config/mapps/.mappsrc ~/.mappsrc && echo authenticated",
+    loginCmd: "mapps init -t <api_token>",
+    credentialPaths: ["~/.config/mapps/.mappsrc", "~/.mappsrc"],
+    description: "Invoked as `mapps` — app development and monday-code deployments only; `mapps init -t <token>` stores a monday.com API token in ~/.mappsrc. To read/write board DATA use the monday.com GraphQL API (api.monday.com/v2) with that same token.",
+    versionCmd: "mapps --version 2>/dev/null | sed -n 1p"
+  },
+  "exa-cli": {
+    preinstallCloud: true,
+    category: "utility",
+    pkg: "exa-cli",
+    installer: "npm",
+    label: "Exa Search",
+    summary: "Search the web and pull page contents, built for AI.",
+    binName: "exa",
+    statusCmd: 'test -n "$EXA_API_KEY" && echo authenticated',
+    credentialPaths: [],
+    description: "Invoked as `exa`. `exa search <query>`, `exa answer <question>`, `exa contents <url>`, `exa find-similar <url>` — JSON by default. Needs EXA_API_KEY in the environment (get one at dashboard.exa.ai); store it in the vault.",
+    versionCmd: "exa --version 2>/dev/null | sed -n 1p"
+  },
+  mobbin: {
+    category: "design",
+    pkg: "mobbin",
+    installer: "npm",
+    label: "Mobbin",
+    summary: "Browse real app and website design examples.",
+    statusCmd: "mobbin auth print-cookie 2>/dev/null | grep -E '[A-Za-z0-9]' >/dev/null && echo authenticated",
+    loginCmd: "mobbin auth save-cookie",
+    loginTerminalHint: "Log in to mobbin.com in a browser on this host, then run `mobbin auth save-cookie`: it imports that browser's cookies.",
+    credentialPaths: ["~/.config/mobbin/cookie.txt", "~/.config/mobbin/storage-state.json"],
+    description: 'Unofficial CLI over Mobbin\'s undocumented web endpoints. `mobbin search --query "login" --platform ios`. Auth reuses browser cookies: log into mobbin.com in Chrome, then `mobbin auth save-cookie`.',
+    versionCmd: "mobbin --version 2>/dev/null | sed -n '1,2p' | tr '\\n' ' '"
+  },
+  "blender-mcp": {
+    preinstallCloud: true,
+    packages: ["blender-mcp==1.9.1"],
+    category: "design",
+    pkg: "blender-mcp",
+    installer: "pip",
+    label: "Blender",
+    summary: "Model, texture and render 3D scenes in a running Blender.",
+    statusCmd: `command -v blender-mcp >/dev/null && mcporter call blender.get_addon_status --output json 2>/dev/null | grep -o '"blender_version": "[^"]*"' | grep -m1 .`,
+    loginNoBrowser: true,
+    loginTerminalHint: "Needs Blender (blender.org) open on this host: in Blender, Edit → Preferences → Add-ons, enable `Blender MCP`, then press N in the 3D view → BlenderMCP tab → Connect / Start MCP server. Then press Connect here.",
+    loginCmd: `blender-mcp install-addon >/dev/null 2>&1; command -v mcporter >/dev/null 2>&1 || npm install -g --prefix "$HOME/.local" mcporter; mcporter config add blender --command blender-mcp --env BLENDER_MCP_DISABLE_TELEMETRY=1 --description 'Blender 3D via ahujasid/blender-mcp addon' --scope home`,
+    logoutCmd: "cd ~ && mcporter config remove blender",
+    credentialPaths: ["~/.mcporter/mcporter.json"],
+    description: "Blender 3D via the ahujasid/blender-mcp server through mcporter: `mcporter list blender --schema`, `mcporter call blender.<tool> key=value` (`code=@file.py`; every tool needs `user_prompt`). Workhorse: execute_blender_code (any bpy Python); also scene/object info, viewport screenshot (`--save-images <dir>`), PolyHaven/Sketchfab import. Needs a GUI Blender with the addon server started (socket :9876; headless has none). 'Could not connect' → `blender-mcp install-addon`, enable in Preferences → Add-ons, N-panel → Start MCP Server (scripted: `blender --python s.py`, s.py registers a `bpy.app.timers` calling `bpy.ops.blendermcp.start_server()`). Code runs unguarded: save first (`bpy.ops.wm.save_mainfile()`), approve destructive ops.",
+    versionCmd: `{ python -c 'from importlib.metadata import version; print(version("blender-mcp"))' || python3 -c 'from importlib.metadata import version; print(version("blender-mcp"))'; } 2>/dev/null`
+  },
+  "google-ads": {
+    category: "marketing",
+    pkg: "google-ads",
+    packages: [
+      "google-ads==32.0.0"
+    ],
+    installer: "pip",
+    label: "Google Ads",
+    summary: "Query and manage Google Ads campaigns, keywords and conversions.",
+    loginCmd: `printf 'developer_token: %s\\nclient_id: %s\\nclient_secret: %s\\nrefresh_token: %s\\nlogin_customer_id: %s\\nuse_proto_plus: true\\n' <developer_token> <client_id> <client_secret> <refresh_token> <mcc_id_digits_only> > "$HOME/google-ads.yaml" && python3 -c 'from google.ads.googleads.client import GoogleAdsClient; GoogleAdsClient.load_from_storage(); print("ok")'`,
+    credentialPaths: [
+      "~/google-ads.yaml"
+    ],
+    statusCmd: `python3 -c 'from google.ads.googleads.client import GoogleAdsClient; c=GoogleAdsClient.load_from_storage(); print(c.login_customer_id or "authenticated")' 2>/dev/null | grep -m1 .`,
+    versionCmd: "python3 -c 'import google.ads.googleads as g; print(g.VERSION)' 2>/dev/null",
+    cloudVerifyCmd: "python3 -c 'import google.ads.googleads'",
+    description: "Official Google Ads API client library (Python) — there is no official CLI, so call it via `python3 -c` or a script. Config `~/google-ads.yaml` (developer_token, client_id/secret, refresh_token, login_customer_id = MCC digits). Mint refresh_token with the bundled `google-oauthlib-tool --client-secrets <json> --scope https://www.googleapis.com/auth/adwords --save --headless` (or examples/authentication/generate_user_credentials.py). Read: `client.get_service('GoogleAdsService').search_stream(customer_id=<digits>, query=<GAQL>)`. Write: `<X>Service.mutate_<x>s(customer_id, operations, validate_only=True)` first, then real. Keyword ideas: `KeywordPlanIdeaService.generate_keyword_ideas`. Offline conversions: `ConversionUploadService.upload_click_conversions`. Customer ids are digits without dashes."
+  },
+  "cua-driver": {
+    category: "development",
+    pkg: "cua-driver",
+    installer: "system",
+    label: "Desktop Control",
+    summary: "Click, type and read native desktop apps without taking over the mouse or focus.",
+    installCmd: 'curl -fsSL https://cua.ai/driver/install.sh | CUA_DRIVER_NO_MODIFY_PATH=1 CUA_DRIVER_BIN_DIR="$HOME/.todoforai/tools/bin" bash',
+    uninstallCmd: 'curl -fsSL https://cua.ai/driver/uninstall.sh | bash; rm -f "$HOME/.todoforai/tools/bin/cua-driver" "$HOME/.todoforai/tools/bin/cua-cursor-theme"; hash -r 2>/dev/null; ! command -v cua-driver >/dev/null 2>&1 || { echo "cua-driver is still on PATH: $(command -v cua-driver)"; exit 1; }',
+    installCmdWindows: "powershell.exe -NoProfile -ExecutionPolicy Bypass -Command '$ProgressPreference='\\''SilentlyContinue'\\''; $ErrorActionPreference='\\''Stop'\\''; [Net.ServicePointManager]::SecurityProtocol=[Net.ServicePointManager]::SecurityProtocol -bor [Net.SecurityProtocolType]::Tls12; $t=Join-Path $env:USERPROFILE '\\''.todoforai\\tools'\\''; $d=Join-Path $t '\\''bin'\\''; New-Item -ItemType Directory -Force -Path $d | Out-Null; $env:CUA_DRIVER_RS_INSTALL_DIR=Join-Path $t '\\''cua-driver\\bin'\\''; $f=Join-Path $env:TEMP '\\''cua-driver-install.ps1'\\''; Invoke-RestMethod -UseBasicParsing https://cua.ai/driver/install.ps1 | Set-Content -LiteralPath $f -Encoding UTF8; & $f -NoAutoStart -NoPathUpdate; if($LASTEXITCODE){exit $LASTEXITCODE}; $u=New-Object Text.UTF8Encoding $false; [IO.File]::WriteAllText((Join-Path $d '\\''cua-driver'\\''), \"#!/bin/sh`nexec `\"`$(dirname `\"`$0`\")/../cua-driver/bin/cua-driver.exe`\" `\"`$@`\"`n\", $u); [IO.File]::WriteAllText((Join-Path $d '\\''cua-driver.cmd'\\''), \"@echo off`r`n`\"%~dp0..\\cua-driver\\bin\\cua-driver.exe`\" %*`r`n\", $u)'",
+    uninstallCmdWindows: "powershell.exe -NoProfile -ExecutionPolicy Bypass -Command '$ErrorActionPreference='\\''Continue'\\''; $t=Join-Path $env:USERPROFILE '\\''.todoforai\\tools'\\''; $d=Join-Path $t '\\''bin'\\''; $j=Join-Path $t '\\''cua-driver\\bin'\\''; $exe=Join-Path $j '\\''cua-driver.exe'\\''; if(Test-Path -LiteralPath $exe){& $exe stop 2>$null | Out-Null}; Stop-Process -Name cua-driver -Force -ErrorAction SilentlyContinue; $env:CUA_DRIVER_RS_UNINSTALL_FORCE='\\''1'\\''; $env:CUA_DRIVER_RS_INSTALL_DIR=$j; Invoke-RestMethod -UseBasicParsing https://cua.ai/driver/uninstall.ps1 | Invoke-Expression; Remove-Item -Force -ErrorAction SilentlyContinue (Join-Path $d '\\''cua-driver'\\''), (Join-Path $d '\\''cua-driver.cmd'\\''); if(Test-Path -LiteralPath $j){[IO.Directory]::Delete($j,$false)}; Remove-Item -Recurse -Force -ErrorAction SilentlyContinue (Join-Path $t '\\''cua-driver'\\'')'",
+    versionCmd: "cua-driver --version 2>/dev/null | sed -n 1p",
+    description: 'Native desktop automation (macOS/Windows/Linux X11; Wayland only via AT-SPI, no window screenshots) through the accessibility tree — actions land in the BACKGROUND without moving the user\'s focus or pointer. Needs a daemon: `cua-driver status || (cua-driver serve --no-overlay >/dev/null 2>&1 &)`; on macOS grant permissions first with `cua-driver permissions grant`; on Windows the daemon must run in the interactive desktop session (`cua-driver autostart enable` registers a logon task). Loop: `cua-driver call list_windows \'{}\'` → pid+window_id; `cua-driver call get_window_state \'{"pid":P,"window_id":W,"include_screenshot":false}\'` → `elements[]` with `element_token`; act with `cua-driver call click \'{"pid":P,"window_id":W,"element_token":"s..:N"}\'`, `type_text {..,"text":".."}`, `hotkey {..,"keys":["ctrl","s"]}`, `press_key`, `scroll`, `invoke_menu`. Tokens are snapshot-bound: re-run get_window_state after EVERY action (stale token = refusal). Window screenshot: add `--screenshot-out-file out.png` (`max_dimension` to shrink). Responses say `effect:unverifiable` — verify from a fresh tree, not from the click reply. `delivery_mode:"foreground"` steals focus; use only when asked. Chrome/Electron trees are near-empty — use agent-browser for web pages. `cua-driver list-tools` / `describe <tool>` for the full surface; `cua-driver mcp` exposes the same over stdio MCP.'
+  }
+};
+
+// ../packages/shared-fbe/src/toolCatalog.ts
+var TOOL_CATALOG = tool_catalog_default;
+// ../packages/shared-fbe/src/toolInstallCommand.ts
+var KEY_OF = new Map(Object.entries(TOOL_CATALOG).map(([k, e]) => [e, k]));
+var NODE_MIN_MAJOR = 24;
+var NODE_OK = `command -v npm >/dev/null 2>&1 && node -e 'process.exit(+process.versions.node.split(".")[0]>=${NODE_MIN_MAJOR}?0:1)' >/dev/null 2>&1`;
+// ../packages/shared-fbe/src/model_promos.json
 var model_promos_default = {
   _doc: [
     "Single source of truth for TODOforAI promotional model discounts.",
@@ -44434,10 +45934,10 @@ var model_promos_default = {
   ]
 };
 
-// ../../../home/hm/repo/todoforai/packages/shared-fbe/src/modelPromos.ts
+// ../packages/shared-fbe/src/modelPromos.ts
 var BOOST_FACTOR = model_promos_default.boost_remaining_price_factor;
 var MODEL_PROMOS = model_promos_default.promos;
-// ../../../home/hm/repo/todoforai/packages/shared-fbe/src/realtime/topics.ts
+// ../packages/shared-fbe/src/realtime/topics.ts
 var TOPICS = {
   ["todo:new" /* NEW_TODO */]: {
     channel: (p) => SERVER_TO_FRONTENDS.project.new_todo(p.projectId, p.privateOwnerId),
@@ -44604,12 +46104,12 @@ var TOPICS = {
     audience: "frontend"
   }
 };
-// ../../../home/hm/repo/todoforai/packages/shared-fbe/src/modelNames.ts
+// ../packages/shared-fbe/src/modelNames.ts
 var LEGACY_MODEL_MAPPING = {
   claude: DEFAULT_MODEL.slice(DEFAULT_MODEL.indexOf(":") + 1),
   "gemini-pro": "google/gemini-3.1-pro-preview"
 };
-// ../../../home/hm/repo/todoforai/packages/shared-credentials/src/index.ts
+// ../packages/shared-credentials/src/index.ts
 function normalizeApiUrl2(url) {
   if (url.startsWith("localhost"))
     return `http://${url}`;
@@ -44623,7 +46123,7 @@ import { parseArgs } from "util";
 // package.json
 var package_default = {
   name: "@todoforai/cli",
-  version: "0.1.55",
+  version: "0.1.57",
   type: "module",
   bin: {
     "todoforai-cli": "bin/todoforai-cli.js",
@@ -44693,7 +46193,7 @@ Examples:
   tfa-cli recommend --template <id>    # Add a template as a recommendation card
   tfa-cli inbox [needs-you|messages|activity] [--unread]  # Read the notification feed (the bell)
   tfa-cli inbox seen [tab]              # Mark notifications read
-  tfa-cli notify "Title" "message" [--href /t/<id>]  # Note to YOUR OWN user only (Messages tab + phone push); no --to
+  tfa-cli notify [--to <email>] "Title" "message" [--href /t/<id>]  # Note to your own user, or --to a project member (Messages tab + phone push)
   tfa-cli claim mint --seed <projectId> [--emails a@x,b@y] [--ttl <sec>]  # Mint /claim/<token> links for a project you own
   tfa-cli next [--direction "<text>"]  # Analyzer growth recommendation cards
   tfa-cli <command> help                # Details per command
@@ -44811,6 +46311,7 @@ function parseCliArgs() {
       ttl: { type: "string" },
       subject: { type: "string" },
       href: { type: "string" },
+      to: { type: "string" },
       unread: { type: "boolean", default: false },
       limit: { type: "string" },
       resume: { type: "string", short: "r" },
@@ -48031,6 +49532,7 @@ tfa-cli project — edit the current project
 
 Usage:
   tfa-cli project list                             Projects you can access (* = default)
+  tfa-cli project members                          Who is on it (notify --to <email> reaches them)
   tfa-cli project set <field=value>…               name=… description=…
                                                     (isPublic refused from an agent shell)
   tfa-cli project default                          Make it the project you land on at /
@@ -48132,6 +49634,17 @@ async function projectCommand(api, positionals, args, projectId) {
   }
   if (!projectId)
     fail(NO_PROJECT);
+  if (sub === "members") {
+    const members = await api.getProjectMembers(projectId);
+    if (args.json) {
+      console.log(JSON.stringify(members, null, 2));
+      return;
+    }
+    for (const m of members)
+      process.stderr.write(`  ${m.name ?? ""}  ${m.email ?? ""}  ${DIM}${m.id}${RESET}
+`);
+    return;
+  }
   if (sub === "set") {
     if (!rest.length)
       fail("Usage: tfa-cli project set <field=value>…");
@@ -49064,16 +50577,19 @@ Filters (same as the bell's chips):
 }
 function printNotifyHelp() {
   process.stderr.write(`
-tfa-cli notify — leave a note for YOUR user (their Messages tab + phone push)
+tfa-cli notify — leave a note in someone's Messages inbox (+ phone push)
 
 Usage:
   tfa-cli notify "Title" "message" [--href /t/<todo-id>] [--subject <key>] [--json]
+  tfa-cli notify --to <email> "Title" "message" [--project <id>]
   echo "message" | tfa-cli notify "Title"
 
-Recipient: ALWAYS the user this key belongs to (the person you work for). There is no --to:
-it cannot message a teammate, a customer or any other account. Shown as from your agent.
+Recipient: your own user by default. --to <email> reaches a TEAMMATE: someone who is a member
+of the current project (--project, $TODOFORAI_PROJECT_ID or your default), shown as from you.
+Anyone else is refused. List them with: tfa-cli project members
 --subject dedupes: the same subject is delivered once (default: hash of title+message,
-so a retry never double-notifies). --href must be an in-app path. Max 10 new notes/day.
+so a retry never double-notifies). --href must be an in-app path.
+Limits: 10 notes/day to yourself, 20/day to teammates.
 `);
 }
 function tierArg(name) {
@@ -49125,12 +50641,22 @@ async function inboxCommand(api, positionals, args) {
       console.log(`    ${DIM}${e.href}${RESET}`);
   }
 }
-var RECIPIENT_FLAGS = ["--to", "--email", "--user", "--recipient", "--cc"];
-async function notifyCommand(api, positionals, args) {
-  const argv = process.argv.slice(2);
-  const bad = argv.find((a) => RECIPIENT_FLAGS.some((f) => a === f || a.startsWith(`${f}=`)));
+var OTHER_RECIPIENT_FLAGS = ["--email", "--user", "--recipient", "--cc"];
+async function notifyCommand(api, positionals, args, projectId) {
+  const bad = process.argv.slice(2).find((a) => OTHER_RECIPIENT_FLAGS.some((f) => a === f || a.startsWith(`${f}=`)));
   if (bad) {
-    process.stderr.write(`${RED}notify has no recipient option (${bad.split("=")[0]}): it only reaches the user this key belongs to — your own user. Messaging other people is not supported.${RESET}
+    process.stderr.write(`${RED}Unknown option ${bad.split("=")[0]}: use --to <email> for a project teammate${RESET}
+`);
+    process.exit(2);
+  }
+  const to = args.to === undefined ? undefined : String(args.to).trim();
+  if (to === "") {
+    process.stderr.write(`${RED}--to is empty: pass a teammate's email, or drop --to to notify your own user${RESET}
+`);
+    process.exit(2);
+  }
+  if (to && !projectId) {
+    process.stderr.write(`${RED}--to needs a project: pass --project <id> (the recipient must be a member of it)${RESET}
 `);
     process.exit(2);
   }
@@ -49142,12 +50668,13 @@ async function notifyCommand(api, positionals, args) {
   }
   const subject = args.subject || createHash("sha256").update(`${title}
 ${message}`).digest("hex").slice(0, 16);
-  const row = await api.sendFeedMessage({ subject, title, message, ...args.href ? { href: String(args.href) } : {} });
+  const msg = { subject, title, message, ...args.href ? { href: String(args.href) } : {} };
+  const row = await (to ? api.sendMemberMessage({ ...msg, projectId, to }) : api.sendFeedMessage(msg));
   if (args.json) {
     console.log(JSON.stringify(row));
     return;
   }
-  process.stderr.write(row.created !== false ? `${GREEN}✅ Delivered to your own user's Messages inbox (not anyone else)${RESET} ${DIM}(subject ${subject})${RESET}
+  process.stderr.write(row.created !== false ? `${GREEN}✅ Delivered to ${to ?? "your own user"}'s Messages inbox${RESET} ${DIM}(subject ${subject})${RESET}
 ` : `${DIM}Already sent (subject ${subject}) — nothing new delivered${RESET}
 `);
 }
@@ -73860,7 +75387,7 @@ async function main() {
     return;
   }
   if (positionals[0] === "notify") {
-    await notifyCommand(api2, positionals, args);
+    await notifyCommand(api2, positionals, args, scopedProject);
     return;
   }
   if (positionals[0] === "delete") {