@uru-intelligence/cli 0.4.15 → 0.4.17

package/dist/uru.mjs

@@ -80,6 +80,20 @@ var cliRemoteOperationContracts = [
     errorResponses: [],
     reason: "The tool parameters and result are intentionally open-world transport values. Individual tools remain CLI-only until their backend-owned exact output schemas are available."
   },
+  {
+    id: "tool_control_plane.catalog.list",
+    operationId: "list_catalog_api_tool_control_plane_catalog_get",
+    method: "get",
+    path: "/api/tool-control-plane/catalog",
+    authentication: "bearer_required",
+    workspaceAuthorization: "optional_selector_server_validated",
+    inputSchema: "zListCatalogApiToolControlPlaneCatalogGetQuery",
+    successStatus: "200",
+    outputSchema: "CanonicalToolCatalogEntry[]",
+    responseShape: "exact",
+    stream: "none",
+    errorResponses: []
+  },
   {
     id: "auth.logout",
     operationId: "logout_user_api_auth_logout_post",
@@ -936,6 +950,134 @@ var CURRENT_GEM_SDK_REPLACEMENT = new Map([
 var externalCompanyMcpDeniedToolIds = new Set([
   "MAGUIRE_WRITE_SQL"
 ]);
+// ../../packages/platform-operations/src/tool_address.ts
+var TOOL_OWNER_CLASSES = [
+  "platform",
+  "personal",
+  "adopted",
+  "company"
+];
+function isToolOwnerClass(value) {
+  return typeof value === "string" && TOOL_OWNER_CLASSES.includes(value);
+}
+var TOOL_CONNECTION_TYPES = [
+  "platform",
+  "composio",
+  "managed_mcp",
+  "external_mcp",
+  "company"
+];
+function isToolConnectionType(value) {
+  return typeof value === "string" && TOOL_CONNECTION_TYPES.includes(value);
+}
+var TOOL_CONNECTION_TYPE_LABELS = {
+  platform: "Uru",
+  composio: "Marketplace",
+  managed_mcp: "Managed MCP",
+  external_mcp: "Custom MCP",
+  company: "Company"
+};
+function toolConnectionTypeLabel(type) {
+  return TOOL_CONNECTION_TYPE_LABELS[type];
+}
+function parseToolAddress(address) {
+  const segments = address.trim().split(".");
+  if (segments.length !== 4) {
+    return null;
+  }
+  const [provider, owner, connection, tool] = segments;
+  if (provider === undefined || owner === undefined || connection === undefined || tool === undefined || provider === "" || tool === "" || !isToolOwnerClass(owner)) {
+    return null;
+  }
+  return { provider, owner, connection, tool };
+}
+var TOOL_SEARCH_MIN_TERM_LENGTH = 2;
+var TOOL_SEARCH_MIN_PENALTY_TERM_LENGTH = 3;
+function scoreToolRelevance(fields, query, options = {}) {
+  const terms = query.toLowerCase().split(/[^a-z0-9]+/u).filter((term) => term.length >= TOOL_SEARCH_MIN_TERM_LENGTH);
+  if (terms.length === 0) {
+    return 0;
+  }
+  const address = fields.address.toLowerCase();
+  const tool = fields.tool.toLowerCase();
+  const text = `${fields.title ?? ""} ${fields.description} ${fields.category ?? ""}`.toLowerCase().trim();
+  let score = 0;
+  for (const term of terms) {
+    let hit = false;
+    if (tool.includes(term)) {
+      score += 3;
+      hit = true;
+    } else if (address.includes(term)) {
+      score += 2;
+      hit = true;
+    }
+    if (text.includes(term)) {
+      score += 1;
+      hit = true;
+    }
+    if (!hit && options.missPenalty === true && term.length >= TOOL_SEARCH_MIN_PENALTY_TERM_LENGTH) {
+      score -= 2;
+    }
+  }
+  return score;
+}
+// ../../packages/platform-operations/src/tool_refusal_envelope.ts
+var TOOL_REFUSAL_STATUSES = [
+  "approval_required",
+  "refused_by_policy"
+];
+function isToolRefusalStatus(value) {
+  return typeof value === "string" && TOOL_REFUSAL_STATUSES.includes(value);
+}
+var TOOL_REFUSAL_ENVELOPE_FIELDS = [
+  "status",
+  "questionId",
+  "writeClass",
+  "toolName"
+];
+function asRecord(value) {
+  if (value === null || typeof value !== "object" || Array.isArray(value)) {
+    return null;
+  }
+  return value;
+}
+function readToolRefusalEnvelope(value) {
+  const record = asRecord(value);
+  if (record === null) {
+    return { outcome: "absent" };
+  }
+  const status = record["status"];
+  if (!isToolRefusalStatus(status)) {
+    return { outcome: "absent" };
+  }
+  const declared = TOOL_REFUSAL_ENVELOPE_FIELDS;
+  for (const key of Object.keys(record).sort()) {
+    if (!declared.includes(key)) {
+      return { outcome: "undeclared_field", field: key };
+    }
+  }
+  const questionId = record["questionId"];
+  if (typeof questionId !== "string" && questionId !== null) {
+    return { outcome: "malformed_field", field: "questionId" };
+  }
+  const writeClass = record["writeClass"];
+  if (typeof writeClass !== "string") {
+    return { outcome: "malformed_field", field: "writeClass" };
+  }
+  const toolName = record["toolName"];
+  if (toolName !== undefined && typeof toolName !== "string") {
+    return { outcome: "malformed_field", field: "toolName" };
+  }
+  return {
+    outcome: "envelope",
+    envelope: {
+      status,
+      questionId,
+      writeClass,
+      ...toolName === undefined ? {} : { toolName }
+    }
+  };
+}
 // ../../packages/platform-operations/src/wrapper_tool_names.ts
 var WRAPPER_LIST_TOOLS_SUFFIX = "__list_tools";
 var WRAPPER_EXECUTE_TOOL_SUFFIX = "__execute_tool";
@@ -1103,11 +1245,7 @@ var remoteContractsByCommand = {
     "platform.tools.schema",
     ...TOOL_EXECUTION_CONTRACTS
   ],
-  tools: [
-    "platform.tools.list",
-    "platform.tools.schema",
-    ...TOOL_EXECUTION_CONTRACTS
-  ],
+  tools: ["tool_control_plane.catalog.list", ...TOOL_EXECUTION_CONTRACTS],
   init: TOOL_EXECUTION_CONTRACTS,
   build: TOOL_EXECUTION_CONTRACTS,
   deploy: TOOL_EXECUTION_CONTRACTS,
@@ -1150,7 +1288,7 @@ var cliCommandSpecs = [
   spec("mcp", "Print or install MCP client configuration", "optional", "optional", "write", TEXT_AND_JSON),
   spec("complete", "Generate shell completion metadata", "none", "none", "read", TEXT_AND_JSON),
   spec("update", "Check for a newer CLI and print the install command", "none", "none", "read", TEXT_AND_JSON),
-  spec("tools", "Inspect or run a platform tool", "required", "required", "write", ALL_OUTPUTS),
+  spec("tools", "Search, inspect and run every tool you can reach", "required", "required", "write", ALL_OUTPUTS),
   spec("init", "Initialize a Gem project", "required", "required", "write", TEXT_AND_JSON),
   spec("build", "Build a Gem", "required", "required", "write", TEXT_AND_JSON),
   spec("deploy", "Save and deploy a Gem Version", "required", "required", "write", ALL_OUTPUTS),
@@ -1196,6 +1334,14 @@ var booleanFlag = (token) => ({
 });
 var valueFlag = (token, options = {}) => ({ token, value: "required", ...options });
 var paramsJsonFlag = () => valueFlag("--params-json", { aliases: ["--args-json"] });
+var toolParamsJsonFlag = () => valueFlag("--params-json", { aliases: ["--args-json", "-d", "--data"] });
+var toolCatalogFilterFlags = [
+  valueFlag("--namespace"),
+  valueFlag("--owner"),
+  valueFlag("--type"),
+  valueFlag("--category"),
+  valueFlag("--limit")
+];
 var enumFlag = (token, values) => ({ token, value: "one_of", values });
 function pathSpec(path, binding, positionals = [], localFlags = [], options = {}) {
   return {
@@ -1322,33 +1468,61 @@ var cliCommandPathSpecs = [
     positionals: [required("operation-id")],
     localFlags: [paramsJsonFlag()]
   },
+  {
+    path: ["tools", "search"],
+    binding: "tools",
+    helpKey: "tools",
+    positionals: [variadic("task")],
+    localFlags: [...toolCatalogFilterFlags, valueFlag("--offset")]
+  },
   {
     path: ["tools", "ls"],
+    aliases: [["tools", "list"]],
     binding: "tools",
     helpKey: "tools",
     positionals: [],
-    localFlags: []
+    localFlags: [...toolCatalogFilterFlags]
+  },
+  {
+    path: ["tools", "connections"],
+    binding: "tools",
+    helpKey: "tools",
+    positionals: [],
+    localFlags: [valueFlag("--owner"), valueFlag("--type")]
   },
   {
     path: ["tools", "schema"],
     binding: "tools",
     helpKey: "tools",
-    positionals: [required("name")],
+    positionals: [required("address")],
     localFlags: []
   },
   {
     path: ["tools", "inspect"],
     binding: "tools",
     helpKey: "tools",
-    positionals: [required("name")],
+    positionals: [required("address")],
     localFlags: []
   },
   {
     path: ["tools", "run"],
     binding: "tools",
     helpKey: "tools",
-    positionals: [required("name")],
-    localFlags: [paramsJsonFlag()]
+    positionals: [required("address")],
+    localFlags: [
+      toolParamsJsonFlag(),
+      booleanFlag("--get-schema"),
+      booleanFlag("--dry-run"),
+      booleanFlag("--parallel"),
+      valueFlag("--mcp-url")
+    ]
+  },
+  {
+    path: ["tools", "approve"],
+    binding: "tools",
+    helpKey: "tools",
+    positionals: [required("question-id")],
+    localFlags: [booleanFlag("--accept"), booleanFlag("--decline")]
   },
   ...libraryPathSpecs(),
   ...datasetPathSpecs(),
@@ -1632,7 +1806,7 @@ function topLevelPathSpecs() {
     pathSpec(["secrets"], "secrets"),
     pathSpec(["env"], "env"),
     pathSpec(["operations"], "operations"),
-    pathSpec(["tools"], "tools"),
+    pathSpec(["tools"], "tools", [variadic("address")], [valueFlag("--match"), valueFlag("--limit")]),
     pathSpec(["mcp"], "mcp")
   ];
 }
@@ -1765,6 +1939,25 @@ function gemPathSpecs() {
       ...gemRefFlags
     ]),
     pathSpec(["gems", "status"], "gems", [optional("gem")], gemRefFlags),
+    pathSpec(["gems", "source", "status"], "gems", [optional("gem")], gemRefFlags),
+    pathSpec(["gems", "source", "refresh"], "gems", [optional("gem")], gemRefFlags),
+    pathSpec(["gems", "source", "copy"], "gems", [optional("gem")], gemRefFlags),
+    pathSpec(["gems", "source", "retry"], "gems", [optional("gem")], [...gemRefFlags, valueFlag("--import-id"), valueFlag("--idempotency-key")]),
+    pathSpec(["gems", "source", "cancel"], "gems", [optional("gem")], [...gemRefFlags, valueFlag("--import-id"), booleanFlag("--yes")]),
+    pathSpec(["gems", "source", "policy"], "gems", [optional("gem")], [
+      ...gemRefFlags,
+      valueFlag("--expected-revision"),
+      valueFlag("--automatic-publishing"),
+      valueFlag("--previews-enabled")
+    ], { aliases: [["gems", "source", "change-policy"]] }),
+    pathSpec(["gems", "source", "disconnect"], "gems", [optional("gem")], [...gemRefFlags, valueFlag("--expected-revision"), booleanFlag("--yes")]),
+    pathSpec(["gems", "source", "change-source"], "gems", [optional("gem")], [
+      ...gemRefFlags,
+      valueFlag("--expected-revision"),
+      valueFlag("--ref"),
+      valueFlag("--app-directory"),
+      valueFlag("--commit-sha")
+    ], { aliases: [["gems", "source", "source-change"]] }),
     pathSpec(["gems", "read"], "gems", [required("gem-path"), required("file")]),
     pathSpec(["gems", "write"], "gems", [required("gem-path"), required("file")], [valueFlag("--file"), valueFlag("--content"), booleanFlag("--no-create")]),
     pathSpec(["gems", "versions", "save"], "gems", [optional("gem")], [
@@ -2388,7 +2581,21 @@ var cliRootHelpGroups = [
       {
         command: "tools",
         lines: [
-          "  uru tools ls|schema|inspect <name>|run <name>     Full platform-tool access"
+          '  uru tools search "<task>" [--limit N] [--namespace NS] [--owner OWNER] [--type TYPE] [--category CAT]',
+          "                                                    Rank every reachable tool against a task",
+          "  uru tools ls [--namespace NS] [--owner OWNER] [--type TYPE] [--category CAT]",
+          "                                                    Every tool you can reach, by connection",
+          "                                                    --owner platform|personal|adopted|company (whose it is)",
+          "                                                    --type platform|composio|managed_mcp|external_mcp|company (what kind)",
+          "  uru tools <partial address> --help [--match TEXT] [--limit N]",
+          "                                                    Drill into <provider>.<owner>.<connection>.<tool>",
+          "  uru tools schema <address>                        Input and output shape for one tool",
+          "  uru tools inspect <address>                       Owner, type, connection, write class, policy answer",
+          "  uru tools run <address> -d '{...}'                Run a platform or connector tool",
+          "  uru tools run <address> --get-schema|--dry-run|--parallel",
+          "  uru tools approve <question-id> --accept|--decline Answer a call that parked for approval",
+          "  uru tools connections [--owner OWNER] [--type TYPE]",
+          "                                                    Every connection behind your tools"
         ]
       },
       {
@@ -2462,7 +2669,7 @@ function spec(id, summary, auth, workspace, safety, outputModes, cancellation =
 // package.json
 var package_default = {
   name: "@uru-intelligence/cli",
-  version: "0.4.15",
+  version: "0.4.17",
   private: false,
   description: "Uru full-platform command line interface",
   repository: {
@@ -2492,9 +2699,7 @@ var package_default = {
     "type-check": "tsc --noEmit",
     test: "bun test",
     "test:unit": "bun test",
-    format: "prettier --write . --ignore-path ../../.prettierignore",
-    "format:check": "prettier --check . --ignore-path ../../.prettierignore",
-    ci: "bun run lint && bun run type-check && bun run test:unit && bun run docs:check && bun run changelog:check && bun run format:check && bun run build && bun run smoke:package && bun run smoke:binaries",
+    ci: "bun run lint && bun run type-check && bun run test:unit && bun run docs:check && bun run changelog:check && bun run build && bun run smoke:package && bun run smoke:binaries",
     build: "node scripts/build.mjs",
     prepack: "bun run build",
     "docs:generate": "bun scripts/generate-docs.mjs",
@@ -9548,6 +9753,7 @@ var zBulkPermissionsUpdateResponse = object({
   updatedCount: int()
 });
 var zCanonicalToolCatalogEntry = object({
+  address: string2(),
   agentAliasFragment: string2().nullish(),
   agentVisibleNamespace: string2().nullish(),
   annotations: record(string2(), unknown()).nullish(),
@@ -9569,6 +9775,7 @@ var zCanonicalToolCatalogEntry = object({
   namespace: string2(),
   normalizedSubtoolName: string2(),
   outputSchema: record(string2(), unknown()).nullish(),
+  owner: _enum(["platform", "personal", "adopted", "company"]),
   ownerUserId: uuid2().nullable(),
   personaLinkId: uuid2().nullish(),
   personaName: string2().nullish(),
@@ -9577,6 +9784,8 @@ var zCanonicalToolCatalogEntry = object({
   serviceSlug: string2(),
   sourceUserName: string2().nullish(),
   title: string2().nullish(),
+  type: _enum(["platform", "composio", "managed_mcp", "external_mcp", "company"]),
+  typeLabel: string2(),
   visibilitySource: string2().nullish(),
   workspaceId: uuid2().nullable(),
   wrapperToolName: string2()
@@ -19410,6 +19619,9 @@ var zListAvailableToolDefinitionsApiToolControlPlaneAvailableGetQuery = object({
   enabledOnly: _enum(["true", "false"]).optional().default("true")
 });
 var zListAvailableToolDefinitionsApiToolControlPlaneAvailableGetResponse = array(zToolDefinitionResponse);
+var zListCatalogApiToolControlPlaneCatalogGetHeaders = object({
+  "X-Uru-Workspace-Id": string2().min(1).optional()
+});
 var zListCatalogApiToolControlPlaneCatalogGetQuery = object({
   enabledOnly: _enum(["true", "false"]).optional().default("true")
 });
@@ -20389,8 +20601,7 @@ function parseOAuthCallbackUrl(callbackUrl, expectedState) {
   }
   const error2 = url2.searchParams.get("error");
   if (error2 !== null && error2 !== "") {
-    const description = url2.searchParams.get("error_description");
-    throw new CliError(description === null || description === "" ? `OAuth authorization failed: ${error2}` : `OAuth authorization failed: ${error2}: ${description}`, { code: ExitCode.AuthRequired, errorCode: "oauth_authorization_failed" });
+    throw new CliError("OAuth authorization failed. Start sign-in again and approve access.", { code: ExitCode.AuthRequired, errorCode: "oauth_authorization_failed" });
   }
   const code = url2.searchParams.get("code") ?? "";
   if (code === "") {
@@ -20723,12 +20934,21 @@ function errorMessage2(payload) {
   if (!isRecord(payload)) {
     return;
   }
-  const description = payload["error_description"];
-  if (typeof description === "string" && description.trim() !== "") {
-    return description;
-  }
   const error2 = payload["error"];
-  return typeof error2 === "string" && error2.trim() !== "" ? error2 : undefined;
+  switch (error2) {
+    case "access_denied":
+      return "Authorization was denied. Start sign-in again.";
+    case "invalid_grant":
+      return "Authorization expired or was revoked. Sign in again.";
+    case "invalid_client":
+      return "The sign-in client is not accepted by the server.";
+    case "expired_token":
+      return "The sign-in request expired. Start sign-in again.";
+    case "temporarily_unavailable":
+      return "The sign-in service is temporarily unavailable.";
+    default:
+      return;
+  }
 }
 function defaultSleep(milliseconds) {
   return new Promise((resolve) => setTimeout(resolve, milliseconds));
@@ -20964,32 +21184,6 @@ function formatWorkspaces(workspaces, style = PLAIN_VISUAL, currentWorkspaceId)
     currentId !== undefined && workspace.id === currentId ? "current" : ""
   ]));
 }
-function formatTools(tools, style = PLAIN_VISUAL) {
-  if (tools.length === 0) {
-    return "No tools found";
-  }
-  if (!style.rich) {
-    return tools.map((tool) => {
-      const description = tool.description === undefined ? "" : `	${tool.description}`;
-      return `${tool.name}${description}`;
-    }).join(`
-`);
-  }
-  return formatTable(style, ["NAME", "DESCRIPTION"], tools.map((tool) => [tool.name, tool.description ?? ""]));
-}
-function formatToolContract(contract) {
-  const name = typeof contract["name"] === "string" ? contract["name"] : "unknown";
-  const description = typeof contract["description"] === "string" ? contract["description"] : "";
-  const schema = contract["inputSchema"];
-  const lines = [`Name: ${name}`];
-  if (description !== "") {
-    lines.push(`Description: ${description}`);
-  }
-  lines.push("Input schema:");
-  lines.push(JSON.stringify(schema ?? {}, null, 2));
-  return lines.join(`
-`);
-}
 function formatOperationContract(contract) {
   const id = typeof contract["id"] === "string" ? contract["id"] : "unknown";
   const family = typeof contract["family"] === "string" ? contract["family"] : "unknown";
@@ -21222,7 +21416,7 @@ or --output-format stream-json before the command to emit NDJSON events.
 Print one explicit active Link URL. When a Gem has more than one active Link,
 use --link to choose the Link rather than guessing which URL you mean.
 `,
-  gems: `Usage: uru gems <inspect|validate|build|deploy|verify|fs|status|read|write|edits|versions|releases|links|runs|capabilities|schedules|bindings|components|delegations|api|domains|analytics|power|logs> [...]
+  gems: `Usage: uru gems <inspect|validate|build|deploy|verify|fs|status|source|read|write|edits|versions|releases|links|runs|capabilities|schedules|bindings|components|delegations|api|domains|analytics|power|logs> [...]
        uru gems validate [library/name.gem] [--wait] [--timeout-ms 600000] [--poll-interval-ms 2000]
        uru gems build [library/name.gem] [--force] [--wait] [--timeout-ms 600000] [--poll-interval-ms 2000]
 
@@ -21511,13 +21705,29 @@ env pull writes a metadata-only template (names and placeholders). It never
 downloads remote secret values. env run overlays local values and redacts
 those values from captured output.
 `,
-  tools: `Usage: uru tools ls
-       uru tools schema <name>
-       uru tools inspect <name>
-       uru tools run <name> [--params-json|--args-json '{...}'|--params-json @file]
+  tools: `Usage: uru tools search "<task>" [--limit N] [--namespace NS] [--owner OWNER]
+       uru tools ls [--namespace NS] [--owner OWNER]
+       uru tools <partial address> --help [--match TEXT] [--limit N]
+       uru tools schema <address>
+       uru tools inspect <address>
+       uru tools run <address> -d '{...}' [--get-schema] [--dry-run] [--parallel]
+       uru tools connections
 
-Use the full platform-tool catalog directly before dedicated command UX exists.
-\`uru tools inspect\` prints name, description, and input schema.
+Every tool you can reach: platform tools, your own connections, connections you
+adopted from a workspace offer, workspace connections, and MCP servers of any type.
+
+An address is <provider>.<owner>.<connection>.<tool>, and owner is one of
+platform, personal, adopted, company. The connection type (Uru, Marketplace,
+Managed MCP, Custom MCP, Company) and its category print beside the address
+and filter with --type and --category. The flat <namespace>__<tool> wire name
+resolves to the same tool.
+
+\`--get-schema\` and \`--dry-run\` run nothing. \`--dry-run\` prints the resolved
+call and the policy answer. \`--parallel\` takes a JSON array and returns one
+result per input object. \`-d\` is the same flag as --params-json.
+
+A refusal is always named: no_match, catalog_unavailable, namespace_unavailable,
+not_connected, not_adopted, approval_required, refused_by_policy.
 `,
   operations: `Usage: uru operations ls [--family <family>]
        uru operations inspect <operation-id>
@@ -23309,7 +23519,10 @@ function adaptRegistryFamilyParams(params) {
 var REGISTRY_FAMILY_SNAKE_CASE_ALIASES = new Set([
   "automation_id",
   "dataset_ids",
+  "idempotency_key",
   "item_id",
+  "label_id",
+  "label_value",
   "max_results"
 ]);
 function canonicalCliFieldToToolProtocol(key) {
@@ -23321,54 +23534,6 @@ function canonicalCliFieldToToolProtocol(key) {
   }
   return key.replace(/[A-Z]/g, (character) => `_${character.toLowerCase()}`);
 }
-async function dispatchTools(ctx, sub, third, command) {
-  if (sub === "ls") {
-    await withWorkspace(ctx);
-    const tools = await client(ctx).listTools();
-    ctx.json ? writeJson(ctx.io, tools.map((tool) => tool.raw)) : writeText(ctx.io, formatTools(tools, visualFromTerminal(ctx.terminal, ctx.outputFormat)));
-    return;
-  }
-  if (sub === "schema") {
-    await withWorkspace(ctx);
-    const name = requireCommandValue(third, "Usage: uru tools schema <name>");
-    emitValue(ctx, await client(ctx).getToolSchema(name));
-    return;
-  }
-  if (sub === "inspect") {
-    await withWorkspace(ctx);
-    const name = requireCommandValue(third, "Usage: uru tools inspect <name>");
-    const schema = await client(ctx).getToolSchema(name);
-    const contract = toolInspectContract(name, schema);
-    emitValue(ctx, contract, formatToolContract(contract));
-    return;
-  }
-  if (sub === "run") {
-    await withWorkspace(ctx);
-    const name = requireCommandValue(third, "Usage: uru tools run <name> --params-json '{...}'");
-    const params = await paramsJson(command.slice(3), ["tools", "run"], paramsJsonOptions(ctx));
-    const operation = getPlatformOperationForToolCall(name, params);
-    if (operation !== undefined) {
-      requireOperationConfirmation(ctx, operation, params);
-    } else if (isRegisteredPlatformToolName(name)) {
-      throw new CliError(unmappedPlatformToolCallMessage(name, params));
-    }
-    emitValue(ctx, await client(ctx).runTool(name, params));
-    return;
-  }
-  throw new CliError("Usage: uru tools ls|schema|inspect|run");
-}
-function unmappedPlatformToolCallMessage(toolName, params) {
-  const op2 = typeof params["op"] === "string" ? params["op"] : undefined;
-  const normalizedTool = toolName.trim().toLowerCase();
-  const normalizedOp = op2?.trim().toLowerCase();
-  if (normalizedTool === "library_fs" && (normalizedOp === "ls" || normalizedOp === "stat" || normalizedOp === "read" || normalizedOp === "search")) {
-    return `library_fs does not serve read op=${normalizedOp}. ` + "Use library_query (or `uru library ls|stat|search|read` / " + "`uru operations run library.<op>`).";
-  }
-  if (normalizedOp !== undefined) {
-    return `No registered safety policy for ${toolName} op=${normalizedOp}. ` + "Refuse to execute. Check `uru operations search` for the supported operation id.";
-  }
-  return `No registered safety policy for ${toolName}. ` + "Refuse to execute without a mapped platform operation.";
-}
 async function dispatchLibrary(ctx, sub, args) {
   if (sub === "ls") {
     const flags = parseLocalFlags(args, ["library", "ls"]);
@@ -24084,18 +24249,6 @@ function copyOptionalFlag(flags, target, flagName, paramName) {
     target[paramName] = value;
   }
 }
-function toolInspectContract(name, schema) {
-  if (!isJsonObject2(schema)) {
-    return { name, inputSchema: {} };
-  }
-  const inputSchema = isJsonObject2(schema["inputSchema"]) ? schema["inputSchema"] : schema;
-  const description = typeof schema["description"] === "string" ? schema["description"] : undefined;
-  return {
-    name: typeof schema["name"] === "string" ? schema["name"] : name,
-    ...description === undefined ? {} : { description },
-    inputSchema
-  };
-}
 function familyPrefix(family) {
   if (family === "automations") {
     return "automation";
@@ -25126,8 +25279,275 @@ async function dispatchGemFs(ctx, verb, args, linkedProject) {
   }
 }
 
+// src/gem-git-source-commands.ts
+import { randomUUID } from "node:crypto";
+var GIT_SOURCE_PATH = "/api/v1/artifacts";
+async function dispatchGemGitSource(ctx, verb, args, linkedProject) {
+  if (verb === undefined || verb === "help") {
+    throw new CliError("Usage: uru gems source status|refresh|retry|cancel|copy|change-source|policy|disconnect <gem> ...");
+  }
+  if ((verb === "cancel" || verb === "disconnect") && !ctx.yes) {
+    throw new CliError(`${verb} is destructive. Re-run with --yes to confirm.`, {
+      errorCode: "confirmation_required",
+      confirmationRequired: true,
+      suggestedCommand: suggestCommandWithYes(ctx.argv)
+    });
+  }
+  const flags = parseLocalFlags(args, ["gems", "source", verb]);
+  const reference = await resolveArtifactReference(ctx, flags, linkedProject);
+  if (verb === "copy") {
+    const result2 = await client(ctx).api(`/api/platform/artifacts/${encodeURIComponent(reference.slug)}/clone`, { method: "POST" });
+    emitValue(ctx, result2, formatCloneResult(result2));
+    return;
+  }
+  if (verb === "status") {
+    const result2 = await client(ctx).api(`${GIT_SOURCE_PATH}/${encodeURIComponent(reference.artifactId)}/git-source`, { method: "GET" });
+    emitValue(ctx, result2, formatGitSourceState(result2));
+    return;
+  }
+  const command = commandFromFlags(verb, flags);
+  const result = await client(ctx).api(`${GIT_SOURCE_PATH}/${encodeURIComponent(reference.artifactId)}/git-source/commands`, { method: "POST", body: command });
+  emitValue(ctx, result, formatGitSourceState(result));
+}
+function commandFromFlags(verb, flags) {
+  switch (verb) {
+    case "refresh":
+      return toJsonCommand({ action: "refresh" });
+    case "retry":
+      return toJsonCommand({
+        action: "retry",
+        importId: requiredImportId(flags, "retry"),
+        idempotencyKey: flags.values["--idempotency-key"]?.trim() || randomUUID()
+      });
+    case "cancel":
+      return toJsonCommand({
+        action: "cancel",
+        importId: requiredImportId(flags, "cancel")
+      });
+    case "policy":
+    case "change-policy":
+      return toJsonCommand({
+        action: "change_policy",
+        expectedRevision: requiredInteger(flags, "--expected-revision"),
+        automaticPublishing: requiredBoolean(flags, "--automatic-publishing"),
+        previewsEnabled: requiredBoolean(flags, "--previews-enabled")
+      });
+    case "disconnect":
+      return toJsonCommand({
+        action: "disconnect",
+        expectedRevision: requiredInteger(flags, "--expected-revision")
+      });
+    case "change-source":
+    case "source-change":
+      return toJsonCommand({
+        action: "change_source",
+        expectedRevision: requiredInteger(flags, "--expected-revision"),
+        ref: requiredValue2(flags, "--ref"),
+        appDirectory: requiredValue2(flags, "--app-directory"),
+        commitSha: requiredValue2(flags, "--commit-sha")
+      });
+    default:
+      throw new CliError("Usage: uru gems source status|refresh|retry|cancel|copy|change-source|policy|disconnect <gem> ...");
+  }
+}
+async function resolveArtifactReference(ctx, flags, linkedProject) {
+  const reference = gemPathFromArgs(flags, linkedProject);
+  const inspected = await executeOperation(ctx, "gem.inspect", {
+    path: reference
+  });
+  const artifactId = (isUuid(reference) ? reference : undefined) ?? findArtifactId(inspected);
+  if (artifactId === undefined) {
+    throw new CliError(`Gem inspection did not return an artifact id for ${reference}.`);
+  }
+  return {
+    artifactId,
+    slug: findArtifactSlug(inspected) ?? artifactId
+  };
+}
+function findArtifactId(value) {
+  if (isJsonObject2(value)) {
+    const id = stringField2(value, [
+      "artifact_id",
+      "artifactId",
+      "gem_id",
+      "gemId"
+    ]);
+    if (id !== undefined && isUuid(id)) {
+      return id;
+    }
+    for (const nested of Object.values(value)) {
+      const found = findArtifactId(nested);
+      if (found !== undefined) {
+        return found;
+      }
+    }
+    return;
+  }
+  if (Array.isArray(value)) {
+    for (const nested of value) {
+      const found = findArtifactId(nested);
+      if (found !== undefined) {
+        return found;
+      }
+    }
+  }
+  return;
+}
+function isUuid(value) {
+  return /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/iu.test(value);
+}
+function findArtifactSlug(value) {
+  if (isJsonObject2(value)) {
+    const slug = stringField2(value, [
+      "artifact_slug",
+      "artifactSlug",
+      "slug"
+    ]);
+    if (slug !== undefined && !slug.includes("/")) {
+      return slug;
+    }
+    for (const nested of Object.values(value)) {
+      const found = findArtifactSlug(nested);
+      if (found !== undefined) {
+        return found;
+      }
+    }
+    return;
+  }
+  if (Array.isArray(value)) {
+    for (const nested of value) {
+      const found = findArtifactSlug(nested);
+      if (found !== undefined) {
+        return found;
+      }
+    }
+  }
+  return;
+}
+function requiredImportId(flags, verb) {
+  const importId = flags.values["--import-id"]?.trim();
+  if (!importId) {
+    throw new CliError(`Usage: uru gems source ${verb} [gem] --import-id <import-id>`);
+  }
+  return importId;
+}
+function requiredValue2(flags, token) {
+  const value = flags.values[token]?.trim();
+  if (value === undefined || value === "") {
+    throw new CliError(`Missing ${token}.`);
+  }
+  return value;
+}
+function requiredInteger(flags, token) {
+  const raw = requiredValue2(flags, token);
+  const parsed = Number(raw);
+  if (!Number.isInteger(parsed) || parsed < 0) {
+    throw new CliError(`${token} must be a non-negative integer.`);
+  }
+  return parsed;
+}
+function requiredBoolean(flags, token) {
+  const raw = requiredValue2(flags, token).toLowerCase();
+  if (raw === "true" || raw === "1" || raw === "yes" || raw === "on") {
+    return true;
+  }
+  if (raw === "false" || raw === "0" || raw === "no" || raw === "off") {
+    return false;
+  }
+  throw new CliError(`${token} must be true or false.`);
+}
+function toJsonCommand(command) {
+  switch (command.action) {
+    case "refresh":
+      return { action: "refresh" };
+    case "retry":
+      return {
+        action: "retry",
+        importId: command.importId,
+        idempotencyKey: command.idempotencyKey
+      };
+    case "cancel":
+      return { action: "cancel", importId: command.importId };
+    case "change_policy":
+      return {
+        action: "change_policy",
+        expectedRevision: command.expectedRevision,
+        automaticPublishing: command.automaticPublishing,
+        previewsEnabled: command.previewsEnabled
+      };
+    case "publish":
+      return {
+        action: "publish",
+        importId: command.importId,
+        expectedRevision: command.expectedRevision
+      };
+    case "approve_preview":
+      return {
+        action: "approve_preview",
+        previewId: command.previewId,
+        headSha: command.headSha,
+        resourcePolicyHash: command.resourcePolicyHash
+      };
+    case "expire_preview":
+      return { action: "expire_preview", previewId: command.previewId };
+    case "disconnect":
+      return {
+        action: "disconnect",
+        expectedRevision: command.expectedRevision
+      };
+    case "reconnect":
+      return {
+        action: "reconnect",
+        expectedRevision: command.expectedRevision
+      };
+    case "change_source":
+      return {
+        action: "change_source",
+        expectedRevision: command.expectedRevision,
+        ref: command.ref,
+        appDirectory: command.appDirectory,
+        commitSha: command.commitSha
+      };
+  }
+  throw new CliError("Unsupported Git source command.");
+}
+function formatGitSourceState(value) {
+  if (!isJsonObject2(value)) {
+    return JSON.stringify(value, null, 2);
+  }
+  const artifactId = stringField2(value, ["artifactId", "artifact_id"]);
+  const binding = isJsonObject2(value["binding"]) ? value["binding"] : undefined;
+  const policy = isJsonObject2(value["policy"]) ? value["policy"] : undefined;
+  const lines = [
+    artifactId === undefined ? undefined : `Artifact: ${artifactId}`,
+    binding === undefined ? "Source binding: none" : `Source binding: ${binding["active"] === true ? "active" : "inactive"}`,
+    binding === undefined ? undefined : stringField2(binding, ["ref"]) === undefined ? undefined : `Ref: ${stringField2(binding, ["ref"])}`,
+    binding === undefined ? undefined : stringField2(binding, ["currentCommitSha", "current_commit_sha"]) === undefined ? undefined : `Current commit: ${stringField2(binding, [
+      "currentCommitSha",
+      "current_commit_sha"
+    ])}`,
+    policy === undefined ? undefined : `Policy: automatic publishing ${policy["automaticPublishing"] === true ? "on" : "off"}, previews ${policy["previewsEnabled"] === true ? "on" : "off"}`
+  ].filter((line) => line !== undefined);
+  return lines.length === 0 ? JSON.stringify(value, null, 2) : lines.join(`
+`);
+}
+function formatCloneResult(value) {
+  const record2 = isJsonObject2(value) ? value : undefined;
+  const artifactId = record2 === undefined ? undefined : stringField2(record2, ["id", "artifactId", "artifact_id"]);
+  const title = record2 === undefined ? undefined : stringField2(record2, ["title"]);
+  if (artifactId === undefined && title === undefined) {
+    return JSON.stringify(value, null, 2);
+  }
+  return [
+    "Gem copied.",
+    artifactId === undefined ? undefined : `Artifact: ${artifactId}`,
+    title === undefined ? undefined : `Title: ${title}`
+  ].filter((line) => line !== undefined).join(`
+`);
+}
+
 // src/held-idempotency-keys.ts
-import { createHash as createHash3, randomUUID } from "node:crypto";
+import { createHash as createHash3, randomUUID as randomUUID2 } from "node:crypto";
 import { constants } from "node:fs";
 import { chmod, link, mkdir as mkdir3, open, readFile as readFile7, rename, rm as rm2 } from "node:fs/promises";
 import { dirname as dirname4, join as join2 } from "node:path";
@@ -25142,7 +25562,7 @@ async function holdIdempotencyKey(io, stateHome, intent, now = new Date) {
   return withHeldEntriesLock(path, async () => {
     const stored = await readHeldEntries(path);
     const existing = stored[fingerprint];
-    const owner = `${process.pid}:${randomUUID()}`;
+    const owner = `${process.pid}:${randomUUID2()}`;
     if (existing !== undefined) {
       const updated = {
         ...existing,
@@ -25154,7 +25574,7 @@ async function holdIdempotencyKey(io, stateHome, intent, now = new Date) {
         release: () => releaseHold(io, path, fingerprint, existing.key, owner)
       };
     }
-    const key = randomUUID();
+    const key = randomUUID2();
     await writeHeldEntries(path, {
       ...stored,
       [fingerprint]: { key, heldAt: now.toISOString(), owners: [owner] }
@@ -25264,7 +25684,7 @@ async function withHeldEntriesLock(path, action) {
       continue;
     }
     try {
-      const lockToken = randomUUID();
+      const lockToken = randomUUID2();
       const contents = `${process.pid}
 ${lockToken}
 `;
@@ -25347,7 +25767,7 @@ async function tryCreateHeldLock(path) {
   }
   try {
     const contents = `${process.pid}
-${randomUUID()}
+${randomUUID2()}
 `;
     await handle.writeFile(contents, "utf8");
     await handle.sync();
@@ -25406,7 +25826,7 @@ async function readHeldLockObservation(path) {
   }
 }
 async function removeHeldLockIfMatches(path, expected) {
-  const quarantinePath = `${path}.${process.pid}.${randomUUID()}.quarantine`;
+  const quarantinePath = `${path}.${process.pid}.${randomUUID2()}.quarantine`;
   try {
     await rename(path, quarantinePath);
     await syncParentDirectory(path);
@@ -25466,7 +25886,7 @@ async function writeHeldEntries(path, entries) {
   }
   const body = `${JSON.stringify(entries, null, 2)}
 `;
-  const temporaryPath = `${path}.${process.pid}.${randomUUID()}.tmp`;
+  const temporaryPath = `${path}.${process.pid}.${randomUUID2()}.tmp`;
   let handle = null;
   try {
     handle = await open(temporaryPath, constants.O_CREAT | constants.O_EXCL | constants.O_WRONLY, constants.S_IRUSR | constants.S_IWUSR);
@@ -26309,6 +26729,11 @@ async function dispatchGems(ctx, sub, args, linkedProject) {
     await dispatchGemFs(ctx, verb, rest, linkedProject);
     return;
   }
+  if (sub === "source") {
+    const [verb, ...rest] = args;
+    await dispatchGemGitSource(ctx, verb, rest, linkedProject);
+    return;
+  }
   if (await dispatchGemLifecycleResourceCommand(ctx, sub, args, linkedProject)) {
     return;
   }
@@ -26348,7 +26773,7 @@ async function dispatchGems(ctx, sub, args, linkedProject) {
     await gemWrite(ctx, args);
     return;
   }
-  throw new CliError("Usage: uru gems inspect|validate|build|deploy|verify|fs|edits|versions|releases|links|runs|capabilities|schedules|bindings|components|delegations|api|domains|analytics|power|checks|status|read|write");
+  throw new CliError("Usage: uru gems inspect|validate|build|deploy|verify|fs|edits|versions|releases|links|runs|capabilities|schedules|bindings|components|delegations|api|domains|analytics|power|checks|status|source|read|write");
 }
 async function dispatchGemOperationalResourceCommand(ctx, sub, args, linkedProject) {
   if (sub === "domains") {
@@ -27647,6 +28072,892 @@ function safeProjectPath(path) {
   return parts.join("/");
 }
 
+// src/tools-catalog.ts
+function isPlatformTool(tool) {
+  return tool.type === "platform";
+}
+var TOOL_REFUSALS = {
+  noMatch: "no_match",
+  catalogUnavailable: "catalog_unavailable",
+  namespaceUnavailable: "namespace_unavailable",
+  notConnected: "not_connected",
+  notAdopted: "not_adopted",
+  approvalRequired: "approval_required",
+  refusedByPolicy: "refused_by_policy"
+};
+function refuse(errorCode, message, suggestedCommand, cause) {
+  const wrapped = cause instanceof CliError ? cause : undefined;
+  return new CliError(message, {
+    errorCode,
+    ...suggestedCommand === undefined ? {} : { suggestedCommand },
+    ...wrapped?.errorId === undefined ? {} : { errorId: wrapped.errorId },
+    ...wrapped?.httpStatus === undefined ? {} : { httpStatus: wrapped.httpStatus },
+    ...cause === undefined ? {} : { cause }
+  });
+}
+function stringField5(row, key) {
+  const value = row[key];
+  return typeof value === "string" ? value : "";
+}
+function nullableStringField(row, key) {
+  const value = row[key];
+  return typeof value === "string" && value.trim() !== "" ? value : null;
+}
+function objectField(row, key) {
+  const value = row[key];
+  return isJsonObject(value) ? value : null;
+}
+function readCatalogRow(value) {
+  if (!isJsonObject(value)) {
+    return null;
+  }
+  const address = stringField5(value, "address");
+  const owner = stringField5(value, "owner");
+  const type = stringField5(value, "type");
+  const parsed = parseToolAddress(address);
+  if (parsed === null || !isToolOwnerClass(owner) || parsed.owner !== owner || !isToolConnectionType(type)) {
+    return null;
+  }
+  const { provider, connection, tool } = parsed;
+  const namespace = nullableStringField(value, "agentVisibleNamespace") ?? stringField5(value, "namespace");
+  const subtool = stringField5(value, "normalizedSubtoolName");
+  return {
+    address,
+    owner,
+    type,
+    typeLabel: toolConnectionTypeLabel(type),
+    provider,
+    connection,
+    tool,
+    flatName: type === "platform" ? subtool.toLowerCase() : `${namespace}__${tool}`,
+    namespace,
+    wrapperToolName: stringField5(value, "wrapperToolName"),
+    providerNativeToolName: stringField5(value, "providerNativeToolName") || subtool,
+    capabilityId: stringField5(value, "capabilityId"),
+    connectionId: stringField5(value, "connectionId"),
+    connectionLabel: stringField5(value, "displayName") || connection,
+    description: stringField5(value, "description"),
+    title: nullableStringField(value, "title"),
+    category: nullableStringField(value, "category"),
+    writeClass: stringField5(value, "classification") || "unknown",
+    enabled: value["enabled"] !== false,
+    inputSchema: objectField(value, "inputSchema") ?? {},
+    outputSchema: objectField(value, "outputSchema")
+  };
+}
+async function fetchToolCatalog(ctx) {
+  let body;
+  try {
+    body = await client(ctx).api("/api/tool-control-plane/catalog", {
+      method: "GET"
+    });
+  } catch (error2) {
+    throw refuse(TOOL_REFUSALS.catalogUnavailable, `The tool catalog could not be read: ${error2 instanceof Error ? error2.message : String(error2)}`, "uru doctor", error2);
+  }
+  if (!Array.isArray(body)) {
+    throw refuse(TOOL_REFUSALS.catalogUnavailable, "The tool catalog answered with something other than a list of tools.");
+  }
+  const tools = [];
+  for (const row of body) {
+    const tool = readCatalogRow(row);
+    if (tool !== null) {
+      tools.push(tool);
+    }
+  }
+  return tools.sort((left, right) => left.address.localeCompare(right.address));
+}
+function filterTools(tools, filters) {
+  const namespace = filters.namespace?.trim().toLowerCase();
+  const owner = filters.owner?.trim().toLowerCase();
+  const type = filters.type?.trim().toLowerCase();
+  const category = filters.category?.trim().toLowerCase();
+  return tools.filter((tool) => {
+    if (namespace !== undefined && namespace !== "") {
+      if (tool.namespace.toLowerCase() !== namespace && tool.provider.toLowerCase() !== namespace) {
+        return false;
+      }
+    }
+    if (owner !== undefined && owner !== "" && tool.owner !== owner) {
+      return false;
+    }
+    if (type !== undefined && type !== "" && tool.type !== type) {
+      return false;
+    }
+    if (category !== undefined && category !== "" && (tool.category ?? "").toLowerCase() !== category) {
+      return false;
+    }
+    return true;
+  });
+}
+function candidateNames(tool) {
+  return [
+    tool.address.toLowerCase(),
+    tool.flatName.toLowerCase(),
+    tool.wrapperToolName.toLowerCase(),
+    tool.providerNativeToolName.toLowerCase(),
+    tool.tool.toLowerCase()
+  ];
+}
+function resolveTool(tools, query) {
+  const wanted = query.trim().toLowerCase();
+  if (wanted === "") {
+    return { kind: "no_match", near: [] };
+  }
+  for (let rank = 0;rank < 5; rank += 1) {
+    const matches = tools.filter((tool) => candidateNames(tool)[rank] === wanted);
+    if (matches.length === 1) {
+      return { kind: "exact", tool: matches[0] };
+    }
+    if (matches.length > 1) {
+      return { kind: "ambiguous", matches };
+    }
+  }
+  return { kind: "no_match", near: nearAddresses(tools, wanted) };
+}
+function nearAddresses(tools, query, limit = 5) {
+  const parts = query.toLowerCase().split(/[.\s_]+/u).filter((part) => part.length > 1);
+  if (parts.length === 0) {
+    return [];
+  }
+  const scored = tools.map((tool) => {
+    const haystack = `${tool.address} ${tool.flatName}`.toLowerCase();
+    const hits = parts.filter((part) => haystack.includes(part)).length;
+    return { tool, hits };
+  }).filter((entry) => entry.hits > 0);
+  scored.sort((left, right) => right.hits - left.hits || left.tool.address.localeCompare(right.tool.address));
+  return scored.slice(0, limit).map((entry) => entry.tool);
+}
+function noMatchError(query, near) {
+  const suffix = near.length === 0 ? " Run `uru tools ls` to see every tool you can reach." : ` Did you mean: ${near.map((tool) => tool.address).join(", ")}?`;
+  return refuse(TOOL_REFUSALS.noMatch, `No tool answers ${JSON.stringify(query)}.${suffix}`, "uru tools search");
+}
+async function fetchUnadoptedOffers(ctx) {
+  let body;
+  try {
+    body = await client(ctx).api("/api/tool-control-plane/connection-offers", {
+      method: "GET"
+    });
+  } catch {
+    return [];
+  }
+  if (!Array.isArray(body)) {
+    return [];
+  }
+  const offers = [];
+  for (const row of body) {
+    if (!isJsonObject(row))
+      continue;
+    const adoption = row["currentAdoptionStatus"];
+    if (row["canAdopt"] !== true || adoption === "pending" || adoption === "approved") {
+      continue;
+    }
+    const offerId = row["id"];
+    const label = row["connectionDisplayName"];
+    const service = row["connectionServiceName"];
+    if (typeof offerId !== "string" || typeof label !== "string" || typeof service !== "string") {
+      continue;
+    }
+    offers.push({ offerId, label, service: service.toLowerCase() });
+  }
+  return offers.sort((left, right) => left.label.localeCompare(right.label));
+}
+function offersMatching(offers, query) {
+  const terms = query.toLowerCase().split(/[^a-z0-9]+/u).filter((term) => term.length > 1);
+  if (terms.length === 0) {
+    return [];
+  }
+  return offers.filter((offer) => {
+    const haystack = `${offer.service} ${offer.label}`.toLowerCase();
+    return terms.some((term) => haystack.includes(term));
+  });
+}
+function notAdoptedError(query, offers) {
+  const labels = offers.map((offer) => offer.label).join(", ");
+  return refuse(TOOL_REFUSALS.notAdopted, `No tool answers ${JSON.stringify(query)} yet. This workspace offers ` + `${labels}, and you have not adopted it. Ask the owner or an admin ` + "to approve the adoption.", "uru tools connections");
+}
+function ambiguousError(query, matches) {
+  return refuse(TOOL_REFUSALS.noMatch, `${JSON.stringify(query)} names ${String(matches.length)} tools. Use one full address: ${matches.slice(0, 5).map((tool) => tool.address).join(", ")}.`, "uru tools ls");
+}
+function searchTools(tools, query, limit, offset = 0) {
+  const scored = tools.map((tool) => ({
+    tool,
+    score: scoreToolRelevance({
+      address: tool.address,
+      tool: tool.tool,
+      title: tool.title,
+      description: tool.description,
+      category: tool.category
+    }, query)
+  })).filter((entry) => entry.score > 0);
+  scored.sort((left, right) => right.score - left.score || left.tool.address.localeCompare(right.tool.address));
+  return { hits: scored.slice(offset, offset + limit), total: scored.length, offset };
+}
+function summarizeConnections(tools) {
+  const byConnection = new Map;
+  for (const tool of tools) {
+    const key = `${tool.provider}.${tool.owner}.${tool.connection}`;
+    const existing = byConnection.get(key);
+    byConnection.set(key, {
+      connection: key,
+      owner: tool.owner,
+      provider: tool.provider,
+      type: tool.type,
+      typeLabel: tool.typeLabel,
+      label: existing?.label ?? tool.connectionLabel,
+      connectionId: existing?.connectionId ?? tool.connectionId,
+      toolCount: (existing?.toolCount ?? 0) + 1,
+      disabledToolCount: (existing?.disabledToolCount ?? 0) + (tool.enabled ? 0 : 1)
+    });
+  }
+  return [...byConnection.values()].sort((left, right) => left.connection.localeCompare(right.connection));
+}
+function addressBranches(tools, prefix) {
+  const wanted = prefix.trim().toLowerCase().replace(/\.+$/u, "");
+  const depth = wanted === "" ? 0 : wanted.split(".").length;
+  const branches = new Map;
+  for (const tool of tools) {
+    const segments = tool.address.split(".");
+    if (wanted !== "" && !tool.address.toLowerCase().startsWith(`${wanted}.`)) {
+      continue;
+    }
+    const segment = segments[depth];
+    if (segment === undefined) {
+      continue;
+    }
+    const existing = branches.get(segment);
+    branches.set(segment, {
+      count: (existing?.count ?? 0) + 1,
+      leaf: depth === segments.length - 1
+    });
+  }
+  return [...branches.entries()].map(([segment, value]) => ({
+    segment,
+    prefix: wanted === "" ? segment : `${wanted}.${segment}`,
+    toolCount: value.count,
+    leaf: value.leaf
+  })).sort((left, right) => left.segment.localeCompare(right.segment));
+}
+
+// src/tools-mcp.ts
+var MCP_PROTOCOL_VERSION = "2026-07-28";
+var PROTOCOL_VERSION_META_KEY = "io.modelcontextprotocol/protocolVersion";
+var CLIENT_CAPABILITIES_META_KEY = "io.modelcontextprotocol/clientCapabilities";
+var CLIENT_INFO_META_KEY = "io.modelcontextprotocol/clientInfo";
+function encodeMcpParamValue(value) {
+  if (/^[ -~]*$/u.test(value)) {
+    return value;
+  }
+  return `=?base64?${Buffer.from(value, "utf8").toString("base64")}?=`;
+}
+function resolveMcpUrl(args) {
+  const chosen = args.explicit?.trim() || mcpProxyUrlFromApiUrl(args.apiUrl);
+  if (chosen === undefined || chosen === "") {
+    throw new CliError(`No MCP proxy is known for ${args.apiUrl}. Pass --mcp-url <url> to name one.`, { errorCode: "namespace_unavailable" });
+  }
+  const url2 = new URL(chosen);
+  if (url2.pathname === "" || url2.pathname === "/") {
+    url2.pathname = "/mcp";
+  }
+  return url2.toString().replace(/\/$/u, "");
+}
+
+class McpCallError extends Error {
+  status;
+  data;
+  constructor(message, status, data) {
+    super(message);
+    this.name = "McpCallError";
+    this.status = status;
+    this.data = data ?? null;
+  }
+}
+function errorBodyOf(text) {
+  try {
+    const parsed = JSON.parse(text);
+    return isJsonObject(parsed) ? parsed : null;
+  } catch {
+    return null;
+  }
+}
+function parseEventStream(body) {
+  let last;
+  for (const rawEvent of body.split(/\n\n/u)) {
+    const data = rawEvent.split(`
+`).filter((line) => line.startsWith("data:")).map((line) => line.slice(5).trim()).join("");
+    if (data === "") {
+      continue;
+    }
+    last = JSON.parse(data);
+  }
+  if (last === undefined) {
+    throw new McpCallError("The MCP event stream carried no data frame.");
+  }
+  return last;
+}
+async function mcpRequest(options, method, params) {
+  const headers = {
+    "content-type": "application/json",
+    accept: "application/json, text/event-stream",
+    authorization: `Bearer ${options.token}`,
+    "mcp-protocol-version": MCP_PROTOCOL_VERSION,
+    "mcp-method": method
+  };
+  const name = params["name"];
+  if (method === "tools/call" && typeof name === "string") {
+    headers["mcp-name"] = encodeMcpParamValue(name);
+  }
+  if (options.workspaceId !== undefined && options.workspaceId !== "") {
+    headers["x-uru-workspace-id"] = options.workspaceId;
+  }
+  const timeout = AbortSignal.timeout(options.timeoutMs ?? 60000);
+  const signal = options.signal === undefined ? timeout : AbortSignal.any([options.signal, timeout]);
+  const response = await options.fetchImpl(options.url, {
+    method: "POST",
+    headers,
+    signal,
+    body: JSON.stringify({
+      jsonrpc: "2.0",
+      id: 1,
+      method,
+      params: {
+        ...params,
+        _meta: {
+          [PROTOCOL_VERSION_META_KEY]: MCP_PROTOCOL_VERSION,
+          [CLIENT_CAPABILITIES_META_KEY]: {},
+          [CLIENT_INFO_META_KEY]: { name: "uru-cli", version: "1" }
+        }
+      }
+    })
+  });
+  const text = await response.text();
+  if (!response.ok) {
+    throw new McpCallError(`MCP ${method} failed with HTTP ${String(response.status)}: ${text.slice(0, 500)}`, response.status, errorBodyOf(text));
+  }
+  const contentType = response.headers.get("content-type") ?? "";
+  const payload = contentType.includes("text/event-stream") ? parseEventStream(text) : JSON.parse(text);
+  const envelope = Array.isArray(payload) ? payload[0] : payload;
+  if (!isJsonObject(envelope)) {
+    throw new McpCallError(`MCP ${method} returned a non-object response.`);
+  }
+  const error2 = envelope["error"];
+  if (isJsonObject(error2)) {
+    const code = error2["code"];
+    const message = error2["message"];
+    const data = error2["data"];
+    throw new McpCallError(`MCP ${method} error ${typeof code === "number" ? String(code) : "unknown"}: ${typeof message === "string" ? message : "no message"}`, undefined, isJsonObject(data) ? data : null);
+  }
+  return envelope["result"] ?? null;
+}
+async function callConnectorTool(options, call) {
+  return mcpRequest(options, "tools/call", {
+    name: call.wrapperToolName,
+    arguments: {
+      tool_name: call.providerNativeToolName,
+      parameters: call.parameters
+    }
+  });
+}
+
+// src/tools-commands.ts
+var TOOLS_SUBCOMMANDS = new Set([
+  "search",
+  "ls",
+  "list",
+  "schema",
+  "inspect",
+  "run",
+  "connections",
+  "approve"
+]);
+function parseParkedCallEnvelope(value) {
+  if (!isJsonObject(value)) {
+    return null;
+  }
+  const nested = value["parked"];
+  if (isJsonObject(nested)) {
+    return parseParkedCallEnvelope(nested);
+  }
+  const read = readToolRefusalEnvelope(value);
+  return read.outcome === "envelope" ? read.envelope : null;
+}
+function parkedLines(envelope) {
+  return [
+    `Status        ${envelope.status}`,
+    `Question id   ${envelope.questionId ?? "(none — nothing to approve)"}`,
+    ...envelope.toolName === undefined ? [] : [`Tool          ${envelope.toolName}`],
+    `Write class   ${envelope.writeClass}`,
+    ...envelope.questionId === null ? [] : [
+      `Answer it     uru tools approve ${envelope.questionId} --accept`,
+      `              uru tools approve ${envelope.questionId} --decline`
+    ]
+  ];
+}
+function isToolsAddressDrillDown(command) {
+  const [first, second] = command;
+  return first === "tools" && second !== undefined && !second.startsWith("-") && !TOOLS_SUBCOMMANDS.has(second);
+}
+function limitFlag(flags, fallback) {
+  const raw = flags.values["--limit"];
+  if (raw === undefined) {
+    return fallback;
+  }
+  const parsed = Number.parseInt(raw, 10);
+  if (!Number.isInteger(parsed) || parsed < 1) {
+    throw new CliError("--limit must be a positive whole number.");
+  }
+  return parsed;
+}
+function offsetFlag(flags) {
+  const raw = flags.values["--offset"];
+  if (raw === undefined) {
+    return 0;
+  }
+  const parsed = Number.parseInt(raw, 10);
+  if (!Number.isInteger(parsed) || parsed < 0) {
+    throw new CliError("--offset must be a whole number of 0 or more.");
+  }
+  return parsed;
+}
+function ownerFlag(flags) {
+  const owner = flags.values["--owner"];
+  if (owner === undefined) {
+    return;
+  }
+  if (!TOOL_OWNER_CLASSES.includes(owner)) {
+    throw new CliError(`--owner must be one of ${TOOL_OWNER_CLASSES.join(", ")}. ` + "It says whose connection a tool runs on; use --type for what kind it is.");
+  }
+  return owner;
+}
+function typeFlag(flags) {
+  const type = flags.values["--type"];
+  if (type === undefined) {
+    return;
+  }
+  if (!TOOL_CONNECTION_TYPES.includes(type)) {
+    throw new CliError(`--type must be one of ${TOOL_CONNECTION_TYPES.join(", ")}.`);
+  }
+  return type;
+}
+function catalogFilters(flags) {
+  return {
+    namespace: flags.values["--namespace"],
+    owner: ownerFlag(flags),
+    type: typeFlag(flags),
+    category: flags.values["--category"]
+  };
+}
+async function toolParameters(ctx, flags) {
+  const raw = flags.values["--params-json"];
+  if (raw === undefined) {
+    return {};
+  }
+  const text = await readParamsJsonSource(raw, {
+    cwd: ctx.cwd,
+    ...ctx.stdin === undefined ? {} : { stdin: ctx.stdin }
+  });
+  return parseParamsJson(text, "--params-json");
+}
+function toolRow(tool) {
+  const write = tool.writeClass === "unknown" ? "?" : tool.writeClass;
+  const summary = tool.description.split(`
+`)[0]?.trim() ?? "";
+  const kind = tool.category === null ? tool.typeLabel : `${tool.typeLabel}/${tool.category}`;
+  return `  ${tool.address}  [${write}]  ${kind}  ${summary}`;
+}
+function toolJson(tool) {
+  return {
+    address: tool.address,
+    owner: tool.owner,
+    type: tool.type,
+    typeLabel: tool.typeLabel,
+    provider: tool.provider,
+    connection: tool.connection,
+    connectionLabel: tool.connectionLabel,
+    tool: tool.tool,
+    flatName: tool.flatName,
+    writeClass: tool.writeClass,
+    enabled: tool.enabled,
+    description: tool.description,
+    ...tool.title === null ? {} : { title: tool.title },
+    ...tool.category === null ? {} : { category: tool.category }
+  };
+}
+function groupedListing(tools) {
+  if (tools.length === 0) {
+    return "No tools. Connect an app in Uru, or ask for access to a workspace offer.";
+  }
+  const lines = [];
+  let currentConnection = "";
+  for (const tool of tools) {
+    const connection = `${tool.provider}.${tool.owner}.${tool.connection}`;
+    if (connection !== currentConnection) {
+      currentConnection = connection;
+      lines.push(`${connection}  ${tool.typeLabel}  (${tool.connectionLabel})`);
+    }
+    lines.push(toolRow(tool));
+  }
+  lines.push("");
+  lines.push(`${String(tools.length)} tools.`);
+  return lines.join(`
+`);
+}
+async function toolsSearch(ctx, args) {
+  const flags = parseLocalFlags(args, ["tools", "search"]);
+  const query = flags.positionals.join(" ").trim();
+  if (query === "") {
+    throw new CliError('Usage: uru tools search "<task>" [--limit N] [--offset N]');
+  }
+  const catalog = filterTools(await fetchToolCatalog(ctx), catalogFilters(flags));
+  const limit = limitFlag(flags, 20);
+  const offset = offsetFlag(flags);
+  const { hits, total } = searchTools(catalog, query, limit, offset);
+  if (total === 0) {
+    const offers = offersMatching(await fetchUnadoptedOffers(ctx), query);
+    if (offers.length > 0) {
+      throw notAdoptedError(query, offers);
+    }
+    throw noMatchError(query, []);
+  }
+  const nextOffset = offset + hits.length;
+  const hasMore = nextOffset < total;
+  emitValue(ctx, {
+    hits: hits.map((hit) => ({ ...toolJson(hit.tool), score: hit.score })),
+    total,
+    hasMore,
+    nextOffset
+  }, [
+    ...hits.map((hit) => `${toolRow(hit.tool)}  (score ${String(hit.score)})`),
+    "",
+    `${String(hits.length)} of ${String(total)} matches${offset > 0 ? `, from ${String(offset)}` : ""}.${hasMore ? ` Next page: --offset ${String(nextOffset)}.` : ""}`
+  ].join(`
+`));
+}
+async function toolsList(ctx, args) {
+  const flags = parseLocalFlags(args, ["tools", "ls"]);
+  const tools = filterTools(await fetchToolCatalog(ctx), catalogFilters(flags));
+  emitValue(ctx, tools.map(toolJson), groupedListing(tools));
+}
+async function toolsConnections(ctx, args) {
+  const flags = parseLocalFlags(args, ["tools", "connections"]);
+  const tools = filterTools(await fetchToolCatalog(ctx), {
+    owner: ownerFlag(flags),
+    type: typeFlag(flags)
+  });
+  const connections = summarizeConnections(tools);
+  emitValue(ctx, connections.map((connection) => ({ ...connection })), connections.length === 0 ? "No connections." : connections.map((connection) => `  ${connection.connection}  ${connection.typeLabel}  ${connection.label}  ${String(connection.toolCount)} tools${connection.disabledToolCount > 0 ? ` (${String(connection.disabledToolCount)} disabled)` : ""}`).join(`
+`));
+}
+async function requireTool(ctx, query) {
+  const catalog = await fetchToolCatalog(ctx);
+  const resolution = resolveTool(catalog, query);
+  if (resolution.kind === "no_match") {
+    throw noMatchError(query, resolution.near);
+  }
+  if (resolution.kind === "ambiguous") {
+    throw ambiguousError(query, resolution.matches);
+  }
+  return { tool: resolution.tool, catalog };
+}
+async function toolSchemaAnswer(ctx, tool) {
+  if (isPlatformTool(tool)) {
+    return client(ctx).getToolSchema(tool.tool);
+  }
+  return {
+    address: tool.address,
+    inputSchema: tool.inputSchema,
+    outputSchema: tool.outputSchema
+  };
+}
+async function toolsSchema(ctx, args) {
+  const flags = parseLocalFlags(args, ["tools", "schema"]);
+  const query = flags.positionals[0];
+  if (query === undefined) {
+    throw new CliError("Usage: uru tools schema <address>");
+  }
+  const { tool } = await requireTool(ctx, query);
+  emitValue(ctx, await toolSchemaAnswer(ctx, tool));
+}
+function policyAnswer(tool) {
+  return {
+    owner: tool.owner,
+    connection: `${tool.provider}.${tool.owner}.${tool.connection}`,
+    connectionLabel: tool.connectionLabel,
+    type: tool.type,
+    typeLabel: tool.typeLabel,
+    category: tool.category,
+    writeClass: tool.writeClass,
+    namespaceServing: tool.enabled,
+    execution: isPlatformTool(tool) ? "platform_execute_route" : "mcp_proxy_tools_call"
+  };
+}
+async function toolsInspect(ctx, args) {
+  const flags = parseLocalFlags(args, ["tools", "inspect"]);
+  const query = flags.positionals[0];
+  if (query === undefined) {
+    throw new CliError("Usage: uru tools inspect <address>");
+  }
+  const { tool } = await requireTool(ctx, query);
+  const answer = policyAnswer(tool);
+  emitValue(ctx, { ...toolJson(tool), policy: answer }, [
+    `Address       ${tool.address}`,
+    `Owner         ${tool.owner}`,
+    `Connection    ${tool.connectionLabel} (${tool.connection})`,
+    `Type          ${tool.typeLabel} (${tool.type})`,
+    `Category      ${tool.category ?? "-"}`,
+    `Write class   ${tool.writeClass}`,
+    `Serving       ${tool.enabled ? "yes" : "no"}`,
+    `Runs through  ${String(answer["execution"])}`,
+    `Flat name     ${tool.flatName}`,
+    "",
+    tool.description
+  ].join(`
+`));
+}
+function assertServing(tool) {
+  if (tool.enabled) {
+    return;
+  }
+  throw refuse(TOOL_REFUSALS.namespaceUnavailable, `${tool.address} is in your catalog but its connection is not serving tools right now.`, `uru tools inspect ${tool.address}`);
+}
+function connectorRefusal(tool, error2) {
+  const message = error2.message;
+  const lower = message.toLowerCase();
+  const envelope = parseParkedCallEnvelope(error2.data);
+  if (envelope !== null && envelope.questionId !== null) {
+    return refuse(envelope.status === "approval_required" ? TOOL_REFUSALS.approvalRequired : TOOL_REFUSALS.refusedByPolicy, [
+      `${tool.address} did not run: ${envelope.status}.`,
+      ...parkedLines(envelope)
+    ].join(`
+`), `uru tools approve ${envelope.questionId} --accept`);
+  }
+  if (lower.includes("approval")) {
+    return refuse(TOOL_REFUSALS.approvalRequired, `${tool.address} needs an approval before it runs: ${message}`, "uru tools inspect " + tool.address);
+  }
+  if (lower.includes("not connected") || lower.includes("missing exact connection") || lower.includes("connected_account")) {
+    return refuse(TOOL_REFUSALS.notConnected, `${tool.address} has no live connection: ${message}. Connect ${tool.provider} in Uru, then retry.`, `uru tools connections`);
+  }
+  if (error2.status === 403 || lower.includes("policy") || lower.includes("denied")) {
+    return refuse(TOOL_REFUSALS.refusedByPolicy, `${tool.address} was refused by workspace policy: ${message}`, `uru tools inspect ${tool.address}`);
+  }
+  if (error2.status === 404) {
+    return refuse(TOOL_REFUSALS.namespaceUnavailable, `${tool.address} is in your catalog but the proxy does not serve it right now: ${message}`);
+  }
+  return refuse(TOOL_REFUSALS.refusedByPolicy, message);
+}
+async function runOneCall(ctx, tool, parameters, mcpUrl) {
+  if (isPlatformTool(tool)) {
+    const operation = getPlatformOperationForToolCall(tool.tool, parameters);
+    if (operation !== undefined) {
+      requireOperationConfirmation(ctx, operation, parameters);
+    } else if (isRegisteredPlatformToolName(tool.tool)) {
+      throw new CliError(unmappedPlatformToolCallMessage(tool.tool, parameters));
+    }
+    return client(ctx).runTool(tool.tool, parameters);
+  }
+  if (ctx.token === undefined) {
+    throw new CliError("Authentication required. Run `uru login`, pass --token, or set URU_TOKEN.");
+  }
+  try {
+    return await callConnectorTool({
+      url: resolveMcpUrl({ apiUrl: ctx.apiUrl, explicit: mcpUrl }),
+      token: ctx.token,
+      workspaceId: ctx.workspace,
+      fetchImpl: ctx.fetch ?? fetch,
+      signal: ctx.abortSignal
+    }, {
+      wrapperToolName: tool.wrapperToolName,
+      providerNativeToolName: tool.providerNativeToolName,
+      parameters
+    });
+  } catch (error2) {
+    if (error2 instanceof McpCallError) {
+      throw connectorRefusal(tool, error2);
+    }
+    throw error2;
+  }
+}
+async function toolsRun(ctx, args) {
+  const flags = parseLocalFlags(args, ["tools", "run"]);
+  const query = flags.positionals[0];
+  if (query === undefined) {
+    throw new CliError("Usage: uru tools run <address> -d '{...}'");
+  }
+  const { tool } = await requireTool(ctx, query);
+  if (flags.booleans.has("--get-schema")) {
+    emitValue(ctx, await toolSchemaAnswer(ctx, tool));
+    return;
+  }
+  const parameters = await toolParameters(ctx, flags);
+  const parallel = flags.booleans.has("--parallel");
+  if (parallel && !Array.isArray(parameters)) {
+    throw new CliError("--parallel needs a JSON array of input objects.");
+  }
+  if (!parallel && !isJsonObject(parameters)) {
+    throw new CliError("-d must be a JSON object. Use --parallel for an array.");
+  }
+  if (flags.booleans.has("--dry-run")) {
+    emitValue(ctx, {
+      dryRun: true,
+      address: tool.address,
+      wrapperToolName: tool.wrapperToolName,
+      providerNativeToolName: tool.providerNativeToolName,
+      parameters,
+      policy: policyAnswer(tool)
+    }, [
+      `Dry run — nothing was executed.`,
+      `Address       ${tool.address}`,
+      `Connection    ${tool.connectionLabel} (${tool.connection})`,
+      `Write class   ${tool.writeClass}`,
+      `Serving       ${tool.enabled ? "yes" : "no"}`,
+      `Runs through  ${String(policyAnswer(tool)["execution"])}`
+    ].join(`
+`));
+    return;
+  }
+  assertServing(tool);
+  const mcpUrl = flags.values["--mcp-url"];
+  if (parallel) {
+    const inputs = parameters;
+    const results = [];
+    for (const input of inputs) {
+      if (!isJsonObject(input)) {
+        throw new CliError("--parallel needs every array entry to be an object.");
+      }
+      results.push(await runOneCall(ctx, tool, input, mcpUrl));
+    }
+    emitValue(ctx, { address: tool.address, results });
+    return;
+  }
+  const result = await runOneCall(ctx, tool, parameters, mcpUrl);
+  const parked = parseParkedCallEnvelope(result);
+  if (parked !== null) {
+    emitValue(ctx, result, [
+      `${tool.address} did not run yet.`,
+      ...parkedLines(parked)
+    ].join(`
+`));
+    return;
+  }
+  emitValue(ctx, result);
+}
+async function toolsApprove(ctx, args) {
+  const flags = parseLocalFlags(args, ["tools", "approve"]);
+  const questionId = flags.positionals[0]?.trim();
+  if (questionId === undefined || questionId === "") {
+    throw new CliError("Usage: uru tools approve <question-id> --accept | --decline");
+  }
+  const accept = flags.booleans.has("--accept");
+  const decline = flags.booleans.has("--decline");
+  if (accept === decline) {
+    throw new CliError("Choose exactly one of --accept or --decline for `uru tools approve`.");
+  }
+  const decision = accept ? "accept" : "decline";
+  const answer = await client(ctx).api(`/api/tool-approvals/${encodeURIComponent(questionId)}`, { method: "POST", body: { decision } });
+  if (!isJsonObject(answer)) {
+    throw new CliError("The approval answer route returned a non-object response.");
+  }
+  const alreadyAnswered = answer["alreadyResolved"] === true;
+  const settled = typeof answer["decision"] === "string" ? answer["decision"] : "unknown";
+  emitValue(ctx, answer, [
+    alreadyAnswered ? `This call was already answered: ${settled}.` : `Answered: ${settled}.`,
+    `Question id   ${questionId}`
+  ].join(`
+`));
+}
+async function toolsDrillDown(ctx, command) {
+  const flags = parseLocalFlags(command.slice(1), ["tools"]);
+  const prefix = flags.positionals.join(".").trim();
+  const catalog = await fetchToolCatalog(ctx);
+  const match = flags.values["--match"]?.trim().toLowerCase();
+  const resolution = resolveTool(catalog, prefix);
+  if (resolution.kind === "exact") {
+    const tool = resolution.tool;
+    emitValue(ctx, {
+      ...toolJson(tool),
+      inputSchema: tool.inputSchema,
+      outputSchema: tool.outputSchema
+    }, [
+      `${tool.address}  [${tool.writeClass}]`,
+      tool.description,
+      "",
+      "Input",
+      JSON.stringify(tool.inputSchema, null, 2),
+      "",
+      "Output",
+      JSON.stringify(tool.outputSchema ?? {}, null, 2)
+    ].join(`
+`));
+    return;
+  }
+  const branches = addressBranches(catalog, prefix).filter((branch) => match === undefined || branch.segment.toLowerCase().includes(match));
+  if (branches.length === 0) {
+    throw noMatchError(prefix, resolution.kind === "no_match" ? resolution.near : []);
+  }
+  const limited = branches.slice(0, limitFlag(flags, 50));
+  emitValue(ctx, { prefix, branches: limited.map((branch) => ({ ...branch })), total: branches.length }, [
+    `${prefix}.*`,
+    ...limited.map((branch) => `  ${branch.prefix}${branch.leaf ? "" : ".*"}  ${String(branch.toolCount)} tools`),
+    "",
+    `${String(limited.length)} of ${String(branches.length)} branches.`
+  ].join(`
+`));
+}
+async function dispatchTools(ctx, command) {
+  const sub = command[1];
+  const args = command.slice(2);
+  await withWorkspace(ctx);
+  if (sub === "search") {
+    await toolsSearch(ctx, args);
+    return;
+  }
+  if (sub === "ls" || sub === "list") {
+    await toolsList(ctx, args);
+    return;
+  }
+  if (sub === "connections") {
+    await toolsConnections(ctx, args);
+    return;
+  }
+  if (sub === "schema") {
+    await toolsSchema(ctx, args);
+    return;
+  }
+  if (sub === "inspect") {
+    await toolsInspect(ctx, args);
+    return;
+  }
+  if (sub === "run") {
+    await toolsRun(ctx, args);
+    return;
+  }
+  if (sub === "approve") {
+    await toolsApprove(ctx, args);
+    return;
+  }
+  if (isToolsAddressDrillDown(command)) {
+    await toolsDrillDown(ctx, command);
+    return;
+  }
+  throw new CliError("Usage: uru tools search|ls|schema|inspect|run|approve|connections, or `uru tools <partial address> --help`.");
+}
+function unmappedPlatformToolCallMessage(toolName, params) {
+  const op2 = typeof params["op"] === "string" ? params["op"] : undefined;
+  const mistakenOperation = typeof params["operation"] === "string" ? params["operation"] : undefined;
+  const normalizedTool = toolName.trim().toLowerCase();
+  const normalizedOp = op2?.trim().toLowerCase();
+  if (mistakenOperation !== undefined && mistakenOperation.trim() !== "" && (op2 === undefined || op2.trim() === "")) {
+    const suggested = mistakenOperation.trim();
+    return `Platform tools take \`op\`, not \`operation\` (got operation=${suggested}). ` + `Retry with op=${suggested}.`;
+  }
+  if (normalizedTool === "library_fs" && (normalizedOp === "ls" || normalizedOp === "stat" || normalizedOp === "read" || normalizedOp === "search")) {
+    return `library_fs does not serve read op=${normalizedOp}. ` + "Use library_query (or `uru library ls|stat|search|read` / " + "`uru operations run library.<op>`).";
+  }
+  if (normalizedOp !== undefined) {
+    return `No registered safety policy for ${toolName} op=${normalizedOp}. ` + "Refuse to execute. Check `uru operations search` for the supported operation id.";
+  }
+  return `No registered safety policy for ${toolName}. ` + "Refuse to execute without a mapped platform operation.";
+}
+
 // src/token-env-secret-commands.ts
 import { spawn } from "node:child_process";
 import { chmod as chmod2, mkdir as mkdir6, readFile as readFile9, writeFile as writeFile5 } from "node:fs/promises";
@@ -28349,7 +29660,7 @@ var cliCommandRuntimeBindings = {
     await dispatchUpdate(ctx, command.slice(1));
   },
   tools: async ({ ctx, command }) => {
-    await dispatchTools(ctx, command[1], command[2], command);
+    await dispatchTools(ctx, command);
   },
   init: async ({ ctx, command }) => {
     await withWorkspace(ctx);
@@ -28509,7 +29820,7 @@ async function dispatchRegistryFamilyCommand({
 // src/config.ts
 import { chmod as chmod3, mkdir as mkdir7, open as open2, readFile as readFile10, rename as rename3, rm as rm4 } from "node:fs/promises";
 import { constants as constants2 } from "node:fs";
-import { randomUUID as randomUUID2 } from "node:crypto";
+import { randomUUID as randomUUID3 } from "node:crypto";
 import { homedir as homedir2 } from "node:os";
 import { dirname as dirname7, join as join5 } from "node:path";
 function resolveConfigHome(env = process.env) {
@@ -28545,7 +29856,7 @@ function createConfigStore(path = configPath()) {
       await mkdir7(dirname7(path), { recursive: true });
       const body = `${JSON.stringify(sanitizeConfig(config2), null, 2)}
 `;
-      const temporaryPath = `${path}.${process.pid}.${randomUUID2()}.tmp`;
+      const temporaryPath = `${path}.${process.pid}.${randomUUID3()}.tmp`;
       let handle = null;
       try {
         handle = await open2(temporaryPath, constants2.O_CREAT | constants2.O_EXCL | constants2.O_WRONLY, constants2.S_IRUSR | constants2.S_IWUSR);
@@ -29153,7 +30464,8 @@ async function runCli(options) {
       writeText(io, CLI_VERSION);
       return ExitCode.Ok;
     }
-    if (parsed.flags.help || parsed.command.length === 0) {
+    const helpIsAddressDrillDown = parsed.flags.help && isToolsAddressDrillDown(parsed.command);
+    if (parsed.flags.help && !helpIsAddressDrillDown || parsed.command.length === 0) {
       const helpTerminal = detectTerminalCapabilities({
         flags: parsed.flags,
         ...options.env === undefined ? {} : { env: options.env },