caplets 0.10.0 → 0.11.0

package/dist/index.js

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 import { createRequire } from "node:module";
 import minproc, { stdin, stdout, default as process$1 } from "node:process";
-import { execFileSync } from "node:child_process";
-import minpath, { basename, dirname, extname, isAbsolute, join, parse, posix, relative, resolve, win32 } from "node:path";
+import { execFileSync, spawn } from "node:child_process";
+import minpath, { basename, delimiter, dirname, extname, isAbsolute, join, parse, posix, relative, resolve, win32 } from "node:path";
 import { accessSync, chmodSync, constants, cpSync, existsSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, renameSync, rmSync, statSync, watch, writeFileSync } from "node:fs";
 import { createInterface } from "node:readline/promises";
 import { createServer } from "node:http";
@@ -180,7 +180,7 @@ const allowsEval = /* @__PURE__ */ cached(() => {
 		return false;
 	}
 });
-function isPlainObject$6(o) {
+function isPlainObject$7(o) {
 	if (isObject(o) === false) return false;
 	const ctor = o.constructor;
 	if (ctor === void 0) return true;
@@ -191,7 +191,7 @@ function isPlainObject$6(o) {
 	return true;
 }
 function shallowClone(o) {
-	if (isPlainObject$6(o)) return { ...o };
+	if (isPlainObject$7(o)) return { ...o };
 	if (Array.isArray(o)) return [...o];
 	if (o instanceof Map) return new Map(o);
 	if (o instanceof Set) return new Set(o);
@@ -274,7 +274,7 @@ function omit(schema, mask) {
 	}));
 }
 function extend(schema, shape) {
-	if (!isPlainObject$6(shape)) throw new Error("Invalid input to extend: expected a plain object");
+	if (!isPlainObject$7(shape)) throw new Error("Invalid input to extend: expected a plain object");
 	const checks = schema._zod.def.checks;
 	if (checks && checks.length > 0) {
 		const existingShape = schema._zod.def.shape;
@@ -290,7 +290,7 @@ function extend(schema, shape) {
 	} }));
 }
 function safeExtend(schema, shape) {
-	if (!isPlainObject$6(shape)) throw new Error("Invalid input to safeExtend: expected a plain object");
+	if (!isPlainObject$7(shape)) throw new Error("Invalid input to safeExtend: expected a plain object");
 	return clone(schema, mergeDefs(schema._zod.def, { get shape() {
 		const _shape = {
 			...schema._zod.def.shape,
@@ -1904,7 +1904,7 @@ function mergeValues$1(a, b) {
 		valid: true,
 		data: a
 	};
-	if (isPlainObject$6(a) && isPlainObject$6(b)) {
+	if (isPlainObject$7(a) && isPlainObject$7(b)) {
 		const bKeys = Object.keys(b);
 		const sharedKeys = Object.keys(a).filter((key) => bKeys.indexOf(key) !== -1);
 		const newObj = {
@@ -1980,7 +1980,7 @@ const $ZodRecord = /* @__PURE__ */ $constructor("$ZodRecord", (inst, def) => {
 	$ZodType.init(inst, def);
 	inst._zod.parse = (payload, ctx) => {
 		const input = payload.value;
-		if (!isPlainObject$6(input)) {
+		if (!isPlainObject$7(input)) {
 			payload.issues.push({
 				expected: "record",
 				code: "invalid_type",
@@ -9619,7 +9619,7 @@ const { program, createCommand, createArgument, createOption, CommanderError, In
 })))(), 1)).default;
 //#endregion
 //#region package.json
-var version = "0.10.0";
+var version = "0.11.0";
 //#endregion
 //#region node_modules/.pnpm/pkce-challenge@5.0.1/node_modules/pkce-challenge/dist/index.node.js
 let crypto;
@@ -19049,6 +19049,34 @@ const capletHttpApiSchema = object$1({
 		"headers"
 	]);
 });
+const capletCliToolOutputSchema = object$1({ type: _enum(["text", "json"]).optional() }).strict();
+const capletCliToolAnnotationsSchema = object$1({
+	readOnlyHint: boolean().optional(),
+	destructiveHint: boolean().optional(),
+	idempotentHint: boolean().optional(),
+	openWorldHint: boolean().optional()
+}).strict();
+const capletCliToolActionSchema = object$1({
+	description: string().min(1).optional().describe("Action capability description."),
+	inputSchema: record(string(), unknown()).optional().describe("JSON Schema for call_tool arguments."),
+	outputSchema: record(string(), unknown()).optional().describe("JSON Schema for structuredContent returned by this action."),
+	command: string().min(1).describe("Executable command to spawn without a shell."),
+	args: array(string()).optional().describe("Arguments passed to the command."),
+	env: record(string(), string()).optional().describe("Additional environment variables."),
+	cwd: string().min(1).optional().describe("Working directory for this action."),
+	timeoutMs: number$1().int().positive().optional(),
+	maxOutputBytes: number$1().int().positive().optional(),
+	output: capletCliToolOutputSchema.optional(),
+	annotations: capletCliToolAnnotationsSchema.optional()
+}).strict();
+const capletCliToolsSchema = object$1({
+	actions: record(string().regex(SERVER_ID_PATTERN), capletCliToolActionSchema).refine((actions) => Object.keys(actions).length > 0, "CLI tools backend must define at least one action").describe("Configured CLI actions keyed by stable tool name."),
+	cwd: string().min(1).optional().describe("Default working directory for CLI actions."),
+	env: record(string(), string()).optional().describe("Default environment variables."),
+	timeoutMs: number$1().int().positive().optional(),
+	maxOutputBytes: number$1().int().positive().optional(),
+	disabled: boolean().optional().describe("When true, omit this Caplet from discovery.")
+}).strict();
 const capletFileSchema = object$1({
 	$schema: string().url().optional().describe("Optional JSON Schema URL for editor validation."),
 	name: string().trim().min(1).max(80).describe("Human-readable Caplet display name."),
@@ -19057,11 +19085,12 @@ const capletFileSchema = object$1({
 	mcpServer: capletMcpServerSchema.describe("MCP server backend configuration for this Caplet.").optional(),
 	openapiEndpoint: capletOpenApiEndpointSchema.describe("OpenAPI endpoint backend configuration for this Caplet.").optional(),
 	graphqlEndpoint: capletGraphQlEndpointSchema.describe("GraphQL endpoint backend configuration for this Caplet.").optional(),
-	httpApi: capletHttpApiSchema.describe("HTTP API backend configuration for this Caplet.").optional()
+	httpApi: capletHttpApiSchema.describe("HTTP API backend configuration for this Caplet.").optional(),
+	cliTools: capletCliToolsSchema.describe("CLI tools backend configuration for this Caplet.").optional()
 }).strict().superRefine((frontmatter, ctx) => {
-	if (Number(Boolean(frontmatter.mcpServer)) + Number(Boolean(frontmatter.openapiEndpoint)) + Number(Boolean(frontmatter.graphqlEndpoint)) + Number(Boolean(frontmatter.httpApi)) !== 1) ctx.addIssue({
+	if (Number(Boolean(frontmatter.mcpServer)) + Number(Boolean(frontmatter.openapiEndpoint)) + Number(Boolean(frontmatter.graphqlEndpoint)) + Number(Boolean(frontmatter.httpApi)) + Number(Boolean(frontmatter.cliTools)) !== 1) ctx.addIssue({
 		code: "custom",
-		message: "Caplet file must define exactly one backend: mcpServer, openapiEndpoint, graphqlEndpoint, or httpApi"
+		message: "Caplet file must define exactly one backend: mcpServer, openapiEndpoint, graphqlEndpoint, httpApi, or cliTools"
 	});
 });
 function loadCapletFiles(root) {
@@ -19070,29 +19099,35 @@ function loadCapletFiles(root) {
 	const openapiEndpoints = {};
 	const graphqlEndpoints = {};
 	const httpApis = {};
+	const cliTools = {};
 	for (const candidate of discoverCapletFiles(root)) {
-		if (servers[candidate.id] || openapiEndpoints[candidate.id] || graphqlEndpoints[candidate.id] || httpApis[candidate.id]) throw new CapletsError("CONFIG_INVALID", `Duplicate Caplet ID ${candidate.id} under ${root}`);
+		if (servers[candidate.id] || openapiEndpoints[candidate.id] || graphqlEndpoints[candidate.id] || httpApis[candidate.id] || cliTools[candidate.id]) throw new CapletsError("CONFIG_INVALID", `Duplicate Caplet ID ${candidate.id} under ${root}`);
 		const config = readCapletFile(candidate.path);
-		if (isPlainObject$5(config) && config.backend === "openapi") {
+		if (isPlainObject$6(config) && config.backend === "openapi") {
 			const { backend: _backend, ...endpoint } = config;
 			openapiEndpoints[candidate.id] = endpoint;
-		} else if (isPlainObject$5(config) && config.backend === "graphql") {
+		} else if (isPlainObject$6(config) && config.backend === "graphql") {
 			const { backend: _backend, ...endpoint } = config;
 			graphqlEndpoints[candidate.id] = endpoint;
-		} else if (isPlainObject$5(config) && config.backend === "http") {
+		} else if (isPlainObject$6(config) && config.backend === "http") {
 			const { backend: _backend, ...endpoint } = config;
 			httpApis[candidate.id] = endpoint;
+		} else if (isPlainObject$6(config) && config.backend === "cli") {
+			const { backend: _backend, ...endpoint } = config;
+			cliTools[candidate.id] = endpoint;
 		} else servers[candidate.id] = config;
 	}
 	const hasServers = Object.keys(servers).length > 0;
 	const hasOpenApi = Object.keys(openapiEndpoints).length > 0;
 	const hasGraphQl = Object.keys(graphqlEndpoints).length > 0;
 	const hasHttpApis = Object.keys(httpApis).length > 0;
-	return hasServers || hasOpenApi || hasGraphQl || hasHttpApis ? {
+	const hasCliTools = Object.keys(cliTools).length > 0;
+	return hasServers || hasOpenApi || hasGraphQl || hasHttpApis || hasCliTools ? {
 		...hasServers ? { mcpServers: servers } : {},
 		...hasOpenApi ? { openapiEndpoints } : {},
 		...hasGraphQl ? { graphqlEndpoints } : {},
-		...hasHttpApis ? { httpApis } : {}
+		...hasHttpApis ? { httpApis } : {},
+		...hasCliTools ? { cliTools } : {}
 	} : void 0;
 }
 function discoverCapletFiles(root) {
@@ -19158,6 +19193,16 @@ function capletToServerConfig(frontmatter, body, baseDir) {
 		...frontmatter.tags ? { tags: frontmatter.tags } : {},
 		body
 	};
+	if (frontmatter.cliTools) return {
+		...frontmatter.cliTools,
+		cwd: normalizeLocalPath$1(frontmatter.cliTools.cwd, baseDir),
+		actions: normalizeCliToolActions(frontmatter.cliTools.actions, baseDir),
+		backend: "cli",
+		name: frontmatter.name,
+		description: frontmatter.description,
+		...frontmatter.tags ? { tags: frontmatter.tags } : {},
+		body
+	};
 	return {
 		...frontmatter.mcpServer,
 		name: frontmatter.name,
@@ -19166,6 +19211,12 @@ function capletToServerConfig(frontmatter, body, baseDir) {
 		body
 	};
 }
+function normalizeCliToolActions(actions, baseDir) {
+	return Object.fromEntries(Object.entries(actions).map(([name, action]) => [name, {
+		...action,
+		cwd: normalizeLocalPath$1(action.cwd, baseDir)
+	}]));
+}
 function normalizeGraphQlOperations(operations, baseDir) {
 	if (!operations) return;
 	return Object.fromEntries(Object.entries(operations).map(([name, operation]) => [name, {
@@ -19200,7 +19251,7 @@ function parseFrontmatter(text, path) {
 			value: text
 		});
 		matter(file, { strip: true });
-		if (!isPlainObject$5(file.data.matter) || Object.keys(file.data.matter).length === 0) throw new Error("empty frontmatter");
+		if (!isPlainObject$6(file.data.matter) || Object.keys(file.data.matter).length === 0) throw new Error("empty frontmatter");
 		return {
 			frontmatter: file.data.matter,
 			body: String(file)
@@ -19209,7 +19260,7 @@ function parseFrontmatter(text, path) {
 		throw new CapletsError("CONFIG_INVALID", `Caplet file at ${path} has invalid YAML frontmatter`, redactSecrets(error));
 	}
 }
-function isPlainObject$5(value) {
+function isPlainObject$6(value) {
 	return Boolean(value) && typeof value === "object" && !Array.isArray(value);
 }
 function validateCapletId(id, path) {
@@ -19409,7 +19460,39 @@ const publicHttpApiSchema = object$1({
 	disabled: boolean().default(false).describe("When true, omit this HTTP API Caplet.")
 }).strict();
 const normalizedHttpApiSchema = publicHttpApiSchema.extend({ body: string().optional() });
-function configSchemaFor(serverValueSchema, openApiEndpointValueSchema, graphQlEndpointValueSchema, httpApiValueSchema) {
+const cliToolOutputSchema = object$1({ type: _enum(["text", "json"]).default("text").describe("How stdout should be represented in structuredContent.") }).strict();
+const cliToolAnnotationsSchema = object$1({
+	readOnlyHint: boolean().optional(),
+	destructiveHint: boolean().optional(),
+	idempotentHint: boolean().optional(),
+	openWorldHint: boolean().optional()
+}).strict();
+const cliToolActionSchema = object$1({
+	description: string().min(1).optional().describe("Action capability description."),
+	inputSchema: record(string(), unknown()).optional().describe("JSON Schema for call_tool arguments."),
+	outputSchema: record(string(), unknown()).optional().describe("JSON Schema for structuredContent returned by this action."),
+	command: string().min(1).describe("Executable command to spawn without a shell."),
+	args: array(string()).optional().describe("Arguments passed to the command."),
+	env: record(string(), string()).optional().describe("Additional environment variables for the command."),
+	cwd: string().min(1).optional().describe("Working directory for this action."),
+	timeoutMs: number$1().int().positive().optional().describe("Command timeout in milliseconds."),
+	maxOutputBytes: number$1().int().positive().optional().describe("Maximum combined stdout and stderr bytes to keep."),
+	output: cliToolOutputSchema.optional(),
+	annotations: cliToolAnnotationsSchema.optional()
+}).strict();
+const publicCliToolsSchema = object$1({
+	name: string().trim().min(1).max(80).describe("Human-readable CLI tools display name."),
+	description: string().describe("Capability description shown to agents before CLI actions are disclosed.").refine((value) => value.trim().length >= 10, "description must contain at least 10 non-whitespace characters").refine((value) => value.length <= 1500, "description must be at most 1500 characters"),
+	actions: record(string().regex(SERVER_ID_PATTERN), cliToolActionSchema).refine((actions) => Object.keys(actions).length > 0, "CLI tools backend must define at least one action").describe("Configured CLI actions keyed by stable tool name."),
+	cwd: string().min(1).optional().describe("Default working directory for CLI actions."),
+	env: record(string(), string()).optional().describe("Default environment variables for CLI actions."),
+	tags: array(string().trim().min(1).max(80)).optional(),
+	timeoutMs: number$1().int().positive().default(6e4).describe("Default timeout in milliseconds for CLI actions."),
+	maxOutputBytes: number$1().int().positive().default(1e6).describe("Default maximum combined stdout and stderr bytes to keep."),
+	disabled: boolean().default(false).describe("When true, omit this CLI tools Caplet.")
+}).strict();
+const normalizedCliToolsSchema = publicCliToolsSchema.extend({ body: string().optional() });
+function configSchemaFor(serverValueSchema, openApiEndpointValueSchema, graphQlEndpointValueSchema, httpApiValueSchema, cliToolsValueSchema) {
 	return object$1({
 		$schema: string().url().optional().describe("Optional JSON Schema URL for editor validation."),
 		version: literal(1).default(1).describe("Caplets config schema version."),
@@ -19418,7 +19501,8 @@ function configSchemaFor(serverValueSchema, openApiEndpointValueSchema, graphQlE
 		mcpServers: record(string().regex(SERVER_ID_PATTERN), serverValueSchema).default({}).describe("Downstream MCP servers keyed by stable server ID."),
 		openapiEndpoints: record(string().regex(SERVER_ID_PATTERN), openApiEndpointValueSchema).default({}).describe("OpenAPI endpoints keyed by stable Caplet ID."),
 		graphqlEndpoints: record(string().regex(SERVER_ID_PATTERN), graphQlEndpointValueSchema).default({}).describe("GraphQL endpoints keyed by stable Caplet ID."),
-		httpApis: record(string().regex(SERVER_ID_PATTERN), httpApiValueSchema).default({}).describe("HTTP APIs keyed by stable Caplet ID.")
+		httpApis: record(string().regex(SERVER_ID_PATTERN), httpApiValueSchema).default({}).describe("HTTP APIs keyed by stable Caplet ID."),
+		cliTools: record(string().regex(SERVER_ID_PATTERN), cliToolsValueSchema).default({}).describe("CLI tools keyed by stable Caplet ID.")
 	}).strict().superRefine((config, ctx) => {
 		if (config.defaultSearchLimit > config.maxSearchLimit) ctx.addIssue({
 			code: "custom",
@@ -19607,10 +19691,34 @@ function configSchemaFor(serverValueSchema, openApiEndpointValueSchema, graphQlE
 				"headers"
 			]);
 		}
+		for (const [server, rawValue] of Object.entries(config.cliTools)) {
+			const raw = rawValue;
+			const duplicateBackend = config.mcpServers[server] ? "mcpServers" : config.openapiEndpoints[server] ? "openapiEndpoints" : config.graphqlEndpoints[server] ? "graphqlEndpoints" : config.httpApis[server] ? "httpApis" : void 0;
+			if (duplicateBackend) ctx.addIssue({
+				code: "custom",
+				path: ["cliTools", server],
+				message: `Caplet ID ${server} is already used by ${duplicateBackend}`
+			});
+			if (!SERVER_ID_PATTERN.test(server)) ctx.addIssue({
+				code: "custom",
+				path: ["cliTools", server],
+				message: "CLI tools ID must match ^[a-zA-Z0-9_-]{1,64}$"
+			});
+			for (const actionName of Object.keys(raw.actions)) if (!SERVER_ID_PATTERN.test(actionName)) ctx.addIssue({
+				code: "custom",
+				path: [
+					"cliTools",
+					server,
+					"actions",
+					actionName
+				],
+				message: "CLI action ID must match ^[a-zA-Z0-9_-]{1,64}$"
+			});
+		}
 	});
 }
-const configFileSchema = configSchemaFor(publicServerSchema, publicOpenApiEndpointSchema, publicGraphQlEndpointSchema, publicHttpApiSchema);
-const normalizedConfigFileSchema = configSchemaFor(normalizedServerSchema, normalizedOpenApiEndpointSchema, normalizedGraphQlEndpointSchema, normalizedHttpApiSchema);
+const configFileSchema = configSchemaFor(publicServerSchema, publicOpenApiEndpointSchema, publicGraphQlEndpointSchema, publicHttpApiSchema, publicCliToolsSchema);
+const normalizedConfigFileSchema = configSchemaFor(normalizedServerSchema, normalizedOpenApiEndpointSchema, normalizedGraphQlEndpointSchema, normalizedHttpApiSchema, normalizedCliToolsSchema);
 function loadConfig(path = resolveConfigPath(), projectPath = resolveProjectConfigPath()) {
 	const hasUserConfig = existsSync(path);
 	const hasProjectConfig = existsSync(projectPath);
@@ -19621,7 +19729,7 @@ function loadConfig(path = resolveConfigPath(), projectPath = resolveProjectConf
 	if (!hasUserConfig && !hasProjectConfig && !userCaplets && !projectCaplets) throw new CapletsError("CONFIG_NOT_FOUND", `Caplets config not found at ${path} or ${projectPath}`);
 	try {
 		const config = parseConfig(mergeConfigInputs(userConfig, userCaplets, projectConfig, projectCaplets));
-		if (Object.keys(config.mcpServers).length === 0 && Object.keys(config.openapiEndpoints).length === 0 && Object.keys(config.graphqlEndpoints).length === 0 && Object.keys(config.httpApis).length === 0) throw new CapletsError("CONFIG_INVALID", "Caplets config must define at least one MCP server, OpenAPI endpoint, GraphQL endpoint, or HTTP API");
+		if (Object.keys(config.mcpServers).length === 0 && Object.keys(config.openapiEndpoints).length === 0 && Object.keys(config.graphqlEndpoints).length === 0 && Object.keys(config.httpApis).length === 0 && Object.keys(config.cliTools).length === 0) throw new CapletsError("CONFIG_INVALID", "Caplets config must define at least one MCP server, OpenAPI endpoint, GraphQL endpoint, HTTP API, or CLI tools backend");
 		return config;
 	} catch (error) {
 		if (error instanceof CapletsError) throw error;
@@ -19646,12 +19754,13 @@ function normalizeLocalPaths(input, baseDir) {
 	return stripUndefined({
 		...input,
 		openapiEndpoints: normalizeEndpointPaths(input.openapiEndpoints, baseDir, normalizeOpenApiPath),
-		graphqlEndpoints: normalizeEndpointPaths(input.graphqlEndpoints, baseDir, normalizeGraphQlPath)
+		graphqlEndpoints: normalizeEndpointPaths(input.graphqlEndpoints, baseDir, normalizeGraphQlPath),
+		cliTools: normalizeEndpointPaths(input.cliTools, baseDir, normalizeCliToolsPaths)
 	});
 }
 function normalizeEndpointPaths(endpoints, baseDir, normalize) {
 	if (!endpoints) return;
-	return Object.fromEntries(Object.entries(endpoints).map(([id, endpoint]) => [id, isPlainObject$4(endpoint) ? normalize(endpoint, baseDir) : endpoint]));
+	return Object.fromEntries(Object.entries(endpoints).map(([id, endpoint]) => [id, isPlainObject$5(endpoint) ? normalize(endpoint, baseDir) : endpoint]));
 }
 function normalizeOpenApiPath(endpoint, baseDir) {
 	return {
@@ -19660,7 +19769,7 @@ function normalizeOpenApiPath(endpoint, baseDir) {
 	};
 }
 function normalizeGraphQlPath(endpoint, baseDir) {
-	const operations = isPlainObject$4(endpoint.operations) ? Object.fromEntries(Object.entries(endpoint.operations).map(([name, operation]) => [name, isPlainObject$4(operation) ? {
+	const operations = isPlainObject$5(endpoint.operations) ? Object.fromEntries(Object.entries(endpoint.operations).map(([name, operation]) => [name, isPlainObject$5(operation) ? {
 		...operation,
 		documentPath: normalizeLocalPath(operation.documentPath, baseDir)
 	} : operation])) : endpoint.operations;
@@ -19670,6 +19779,17 @@ function normalizeGraphQlPath(endpoint, baseDir) {
 		operations
 	};
 }
+function normalizeCliToolsPaths(endpoint, baseDir) {
+	const actions = isPlainObject$5(endpoint.actions) ? Object.fromEntries(Object.entries(endpoint.actions).map(([name, action]) => [name, isPlainObject$5(action) ? {
+		...action,
+		cwd: normalizeLocalPath(action.cwd, baseDir)
+	} : action])) : endpoint.actions;
+	return {
+		...endpoint,
+		cwd: normalizeLocalPath(endpoint.cwd, baseDir),
+		actions
+	};
+}
 function normalizeLocalPath(value, baseDir) {
 	if (typeof value !== "string" || !value || isAbsolute(value) || hasEnvReference(value)) return value;
 	return join(baseDir, value);
@@ -19678,6 +19798,7 @@ function rejectUntrustedProjectExecutableBackends(input, path) {
 	if (input.openapiEndpoints && Object.keys(input.openapiEndpoints).length > 0) throw new CapletsError("CONFIG_INVALID", `Project config at ${path} cannot define openapiEndpoints; use trusted project Caplet files or user config`);
 	if (input.graphqlEndpoints && Object.keys(input.graphqlEndpoints).length > 0) throw new CapletsError("CONFIG_INVALID", `Project config at ${path} cannot define graphqlEndpoints; use trusted project Caplet files or user config`);
 	if (input.httpApis && Object.keys(input.httpApis).length > 0) throw new CapletsError("CONFIG_INVALID", `Project config at ${path} cannot define httpApis; use trusted project Caplet files or user config`);
+	if (input.cliTools && Object.keys(input.cliTools).length > 0) throw new CapletsError("CONFIG_INVALID", `Project config at ${path} cannot define cliTools; use trusted project Caplet files or user config`);
 	return input;
 }
 function mergeConfigInputs(...inputs) {
@@ -19702,6 +19823,10 @@ function mergeConfigInputs(...inputs) {
 			httpApis: {
 				...merged?.httpApis,
 				...input.httpApis
+			},
+			cliTools: {
+				...merged?.cliTools,
+				...input.cliTools
 			}
 		};
 	}
@@ -19738,6 +19863,12 @@ function parseConfig(input) {
 		server,
 		backend: "http"
 	});
+	const cliTools = {};
+	for (const [server, raw] of Object.entries(parsed.data.cliTools)) cliTools[server] = stripUndefined({
+		...raw,
+		server,
+		backend: "cli"
+	});
 	return {
 		version: parsed.data.version,
 		options: {
@@ -19747,7 +19878,8 @@ function parseConfig(input) {
 		mcpServers: servers,
 		openapiEndpoints,
 		graphqlEndpoints,
-		httpApis
+		httpApis,
+		cliTools
 	};
 }
 function validateEndpointAuthHeaders(auth, ctx, path) {
@@ -19776,10 +19908,10 @@ function interpolateConfig(value, path = []) {
 	return value;
 }
 function isPublicMetadataPath(path) {
-	if (path.length < 3 || path[0] !== "mcpServers" && path[0] !== "openapiEndpoints" && path[0] !== "graphqlEndpoints" && path[0] !== "httpApis") return false;
+	if (path.length < 3 || path[0] !== "mcpServers" && path[0] !== "openapiEndpoints" && path[0] !== "graphqlEndpoints" && path[0] !== "httpApis" && path[0] !== "cliTools") return false;
 	return NON_INTERPOLATED_SERVER_FIELDS.has(path[2] ?? "");
 }
-function isPlainObject$4(value) {
+function isPlainObject$5(value) {
 	return Boolean(value) && typeof value === "object" && !Array.isArray(value);
 }
 function hasEnvReference(value) {
@@ -19868,6 +20000,194 @@ async function maybeReadManualInput() {
 	}
 }
 //#endregion
+//#region src/cli/author.ts
+function authorCliCaplet(id, options = {}) {
+	const repo = resolve(options.repo ?? process.cwd());
+	const include = options.include !== void 0 ? parseInclude(options.include) : options.command ? /* @__PURE__ */ new Set() : new Set([
+		"git",
+		"gh",
+		"package"
+	]);
+	const actions = {};
+	if (include.has("git") || options.command === "git") Object.assign(actions, gitActions(repo));
+	if (include.has("gh") || options.command === "gh") Object.assign(actions, ghActions(repo));
+	if (include.has("package") || isPackageCommand(options.command)) Object.assign(actions, packageActions(repo, options.command));
+	if (options.command && Object.keys(actions).length === 0) actions[`${sanitizeId(options.command)}_version`] = {
+		description: `Print ${options.command} version information.`,
+		command: options.command,
+		args: ["--version"],
+		annotations: { readOnlyHint: true }
+	};
+	if (Object.keys(actions).length === 0) throw new Error("No CLI actions could be generated for the requested options");
+	const text = renderCaplet({
+		name: titleize(id),
+		description: `Curated CLI tools for ${basename(repo)} workflows.`,
+		cwd: repo,
+		actions
+	});
+	const output = options.output ?? "-";
+	if (output !== "-") {
+		writeFileSync(output, text);
+		return {
+			path: output,
+			text
+		};
+	}
+	return { text };
+}
+function parseInclude(value) {
+	if (!value) return /* @__PURE__ */ new Set();
+	return new Set(value.split(",").map((entry) => entry.trim()).filter(Boolean));
+}
+function gitActions(repo) {
+	return {
+		git_status: {
+			description: "Show concise Git working tree status.",
+			command: "git",
+			args: ["status", "--short"],
+			cwd: repo,
+			annotations: { readOnlyHint: true }
+		},
+		git_current_branch: {
+			description: "Print the current Git branch name.",
+			command: "git",
+			args: ["branch", "--show-current"],
+			cwd: repo,
+			annotations: { readOnlyHint: true }
+		},
+		git_changed_files: {
+			description: "List changed tracked and untracked files.",
+			command: "git",
+			args: [
+				"status",
+				"--porcelain=v1",
+				"--untracked-files=all"
+			],
+			cwd: repo,
+			annotations: { readOnlyHint: true }
+		}
+	};
+}
+function ghActions(repo) {
+	return {
+		gh_pr_status: {
+			description: "Show pull request status for the current branch as JSON.",
+			command: "gh",
+			args: [
+				"pr",
+				"status",
+				"--json",
+				"currentBranch"
+			],
+			cwd: repo,
+			output: { type: "json" },
+			annotations: {
+				readOnlyHint: true,
+				openWorldHint: true
+			}
+		},
+		gh_issue_list: {
+			description: "List open GitHub issues as JSON.",
+			command: "gh",
+			args: [
+				"issue",
+				"list",
+				"--json",
+				"number,title,state,url"
+			],
+			cwd: repo,
+			output: { type: "json" },
+			annotations: {
+				readOnlyHint: true,
+				openWorldHint: true
+			}
+		}
+	};
+}
+function packageActions(repo, explicitCommand) {
+	const packageJsonPath = join(repo, "package.json");
+	if (!existsSync(packageJsonPath)) return {};
+	const packageJson = JSON.parse(readFileSync(packageJsonPath, "utf8"));
+	const manager = explicitCommand && isPackageCommand(explicitCommand) ? explicitCommand : detectPackageManager(repo, packageJson);
+	const scripts = packageJson.scripts ?? {};
+	const actions = {};
+	for (const script of [
+		"test",
+		"lint",
+		"typecheck",
+		"build",
+		"verify"
+	]) {
+		if (!scripts[script]) continue;
+		actions[`package_${script}`] = {
+			description: `Run the package ${script} script.`,
+			command: manager,
+			args: ["run", script],
+			cwd: repo,
+			annotations: { readOnlyHint: false },
+			...script === "test" || script === "verify" ? { timeoutMs: 12e4 } : {}
+		};
+	}
+	return actions;
+}
+function detectPackageManager(repo, packageJson) {
+	if (packageJson.packageManager?.startsWith("pnpm@")) return "pnpm";
+	if (packageJson.packageManager?.startsWith("bun@")) return "bun";
+	if (packageJson.packageManager?.startsWith("yarn@")) return "yarn";
+	if (existsSync(join(repo, "pnpm-lock.yaml"))) return "pnpm";
+	if (existsSync(join(repo, "bun.lockb")) || existsSync(join(repo, "bun.lock"))) return "bun";
+	if (existsSync(join(repo, "yarn.lock"))) return "yarn";
+	return "npm";
+}
+function isPackageCommand(command) {
+	return command === "pnpm" || command === "npm" || command === "bun" || command === "yarn";
+}
+function renderCaplet(input) {
+	const lines = [
+		"---",
+		"$schema: https://raw.githubusercontent.com/spiritledsoftware/caplets/main/schemas/caplet.schema.json",
+		`name: ${yamlString(input.name)}`,
+		`description: ${yamlString(input.description)}`,
+		"tags:",
+		"  - cli",
+		"  - code",
+		"cliTools:",
+		`  cwd: ${yamlString(input.cwd)}`,
+		"  actions:"
+	];
+	for (const [name, action] of Object.entries(input.actions).sort(([left], [right]) => left.localeCompare(right))) {
+		lines.push(`    ${name}:`);
+		if (action.description) lines.push(`      description: ${yamlString(action.description)}`);
+		lines.push(`      command: ${yamlString(action.command)}`);
+		if (action.args?.length) {
+			lines.push("      args:");
+			for (const arg of action.args) lines.push(`        - ${yamlString(arg)}`);
+		}
+		if (action.cwd && action.cwd !== input.cwd) lines.push(`      cwd: ${yamlString(action.cwd)}`);
+		if (action.timeoutMs) lines.push(`      timeoutMs: ${action.timeoutMs}`);
+		if (action.maxOutputBytes) lines.push(`      maxOutputBytes: ${action.maxOutputBytes}`);
+		if (action.output) {
+			lines.push("      output:");
+			lines.push(`        type: ${action.output.type}`);
+		}
+		if (action.annotations) {
+			lines.push("      annotations:");
+			for (const [key, value] of Object.entries(action.annotations)) lines.push(`        ${key}: ${value ? "true" : "false"}`);
+		}
+	}
+	lines.push("---", "", `# ${input.name}`, "", input.description, "");
+	return `${lines.join("\n")}`;
+}
+function yamlString(value) {
+	return JSON.stringify(value);
+}
+function titleize(id) {
+	return id.split(/[-_]/).filter(Boolean).map((part) => `${part.slice(0, 1).toUpperCase()}${part.slice(1)}`).join(" ");
+}
+function sanitizeId(value) {
+	return value.replace(/[^a-zA-Z0-9_-]+/g, "_").slice(0, 48) || "cli";
+}
+//#endregion
 //#region src/cli/init.ts
 function initConfig(options = {}) {
 	const path = resolveConfigPath(options.path);
@@ -19919,7 +20239,9 @@ function allCaplets$1(config) {
 	return [
 		...Object.values(config.mcpServers),
 		...Object.values(config.openapiEndpoints),
-		...Object.values(config.graphqlEndpoints)
+		...Object.values(config.graphqlEndpoints),
+		...Object.values(config.httpApis),
+		...Object.values(config.cliTools)
 	];
 }
 function formatCapletList(rows) {
@@ -20159,6 +20481,14 @@ function createProgram(io = {}) {
 		});
 		for (const caplet of result.installed) writeOut(`Installed ${caplet.id} to ${caplet.destination}\n`);
 	});
+	program.command("author").description("Generate reviewable Caplet files.").command("cli").description("Generate a CLI tools Caplet.").argument("<id>", "Caplet ID/display seed").option("--repo <path>", "repository path to inspect").option("--include <items>", "comma-separated generators to include: git,gh,package").option("--command <name>", "single CLI command template to generate").option("--output <path>", "output path, or - for stdout", "-").action((id, options) => {
+		const result = authorCliCaplet(id, options);
+		if (result.path) {
+			writeOut(`Wrote CLI Caplet to ${result.path}\n`);
+			return;
+		}
+		writeOut(result.text);
+	});
 	const config = program.command("config").description("Inspect Caplets config locations.");
 	config.command("path").description("Print the effective user config path.").action(() => {
 		writeOut(`${resolveConfigPath(envConfigPath())}\n`);
@@ -25865,7 +26195,7 @@ var Protocol = class {
 		};
 	}
 };
-function isPlainObject$3(value) {
+function isPlainObject$4(value) {
 	return value !== null && typeof value === "object" && !Array.isArray(value);
 }
 function mergeCapabilities(base, additional) {
@@ -25875,7 +26205,7 @@ function mergeCapabilities(base, additional) {
 		const addValue = additional[k];
 		if (addValue === void 0) continue;
 		const baseValue = result[k];
-		if (isPlainObject$3(baseValue) && isPlainObject$3(addValue)) result[k] = {
+		if (isPlainObject$4(baseValue) && isPlainObject$4(addValue)) result[k] = {
 			...baseValue,
 			...addValue
 		};
@@ -33526,6 +33856,273 @@ const EMPTY_COMPLETION_RESULT = { completion: {
 	hasMore: false
 } };
 //#endregion
+//#region src/cli-tools.ts
+const DEFAULT_INPUT_SCHEMA$1 = {
+	type: "object",
+	additionalProperties: true
+};
+var CliToolsManager = class {
+	registry;
+	constructor(registry) {
+		this.registry = registry;
+	}
+	updateRegistry(registry) {
+		this.registry = registry;
+	}
+	invalidate(_serverId) {}
+	async checkTools(config) {
+		const startedAt = Date.now();
+		try {
+			for (const action of actionsFor(config)) {
+				const cwdTemplate = action.cwd ?? config.cwd;
+				if (cwdTemplate && !cwdTemplate.includes("$input")) {
+					if (!existsSync(interpolateRequiredString(cwdTemplate, {}, "cwd"))) throw new CapletsError("CONFIG_INVALID", `CLI cwd does not exist for ${config.server}/${action.name}`);
+				}
+				if (!action.command.includes("$input")) resolveCommandPath(action.command);
+			}
+			this.registry.setStatus(config.server, "available");
+			return {
+				server: config.server,
+				status: "available",
+				toolCount: Object.keys(config.actions).length,
+				elapsedMs: Date.now() - startedAt
+			};
+		} catch (error) {
+			const safe = toSafeError(error, "SERVER_UNAVAILABLE");
+			this.registry.setStatus(config.server, "unavailable", safe);
+			return {
+				server: config.server,
+				status: "unavailable",
+				elapsedMs: Date.now() - startedAt,
+				error: safe
+			};
+		}
+	}
+	async listTools(config) {
+		return actionsFor(config).map((action) => this.toTool(action));
+	}
+	async getTool(config, toolName) {
+		return this.toTool(getAction(config, toolName));
+	}
+	async callTool(config, toolName, args) {
+		const action = getAction(config, toolName);
+		validateInput(action, args);
+		const execution = resolveExecution(config, action, args);
+		const startedAt = Date.now();
+		const controller = new AbortController();
+		const timeout = setTimeout(() => controller.abort(), execution.timeoutMs);
+		try {
+			const result = await spawnCommand(execution, controller.signal, () => Date.now() - startedAt);
+			const structured = parseStructuredResult(action, result, result.exitCode !== 0);
+			return {
+				content: [{
+					type: "text",
+					text: JSON.stringify(structured, null, 2)
+				}],
+				structuredContent: structured,
+				isError: result.exitCode !== 0
+			};
+		} catch (error) {
+			if (isAbortError$1(error)) throw new CapletsError("TOOL_CALL_TIMEOUT", `CLI tool timed out for ${config.server}/${toolName}`);
+			if (error instanceof CapletsError) throw error;
+			throw new CapletsError("DOWNSTREAM_TOOL_ERROR", `CLI tool failed for ${config.server}/${toolName}`, toSafeError(error));
+		} finally {
+			clearTimeout(timeout);
+		}
+	}
+	compact(config, tool) {
+		return {
+			server: config.server,
+			tool: tool.name,
+			...tool.description ? { description: tool.description } : {},
+			...tool.annotations ? { annotations: tool.annotations } : {},
+			hasInputSchema: Boolean(tool.inputSchema),
+			hasOutputSchema: Boolean(tool.outputSchema)
+		};
+	}
+	search(config, tools, query, limit) {
+		const needle = query.toLocaleLowerCase();
+		return tools.filter((tool) => `${tool.name}\n${tool.description ?? ""}`.toLocaleLowerCase().includes(needle)).sort((left, right) => left.name.localeCompare(right.name)).slice(0, limit).map((tool) => this.compact(config, tool));
+	}
+	toTool(action) {
+		return {
+			name: action.name,
+			...action.description ? { description: action.description } : {},
+			inputSchema: action.inputSchema ?? DEFAULT_INPUT_SCHEMA$1,
+			...action.outputSchema ? { outputSchema: action.outputSchema } : {},
+			...action.annotations ? { annotations: action.annotations } : {}
+		};
+	}
+};
+function actionsFor(config) {
+	return Object.entries(config.actions).map(([name, action]) => ({
+		name,
+		...action
+	})).sort((left, right) => left.name.localeCompare(right.name));
+}
+function getAction(config, toolName) {
+	const actions = actionsFor(config);
+	const action = actions.find((candidate) => candidate.name === toolName);
+	if (!action) throw new CapletsError("TOOL_NOT_FOUND", `Tool ${toolName} was not found on ${config.server}`, {
+		server: config.server,
+		tool: toolName,
+		suggestions: actions.map((candidate) => candidate.name).filter((name) => name.toLocaleLowerCase().includes(toolName.toLocaleLowerCase()[0] ?? "")).slice(0, 5)
+	});
+	return action;
+}
+function resolveExecution(config, action, input) {
+	const cwd = interpolateString(action.cwd ?? config.cwd, input, "cwd");
+	if (cwd && !existsSync(cwd)) throw new CapletsError("CONFIG_INVALID", `CLI cwd does not exist for ${config.server}/${action.name}`);
+	const env = {
+		...process.env,
+		...resolveEnv(config.env, input),
+		...resolveEnv(action.env, input)
+	};
+	return {
+		command: interpolateString(action.command, input, "command") ?? action.command,
+		args: (action.args ?? []).map((arg, index) => interpolateRequiredString(arg, input, `args.${index}`)),
+		...cwd ? { cwd } : {},
+		env,
+		timeoutMs: action.timeoutMs ?? config.timeoutMs,
+		maxOutputBytes: action.maxOutputBytes ?? config.maxOutputBytes
+	};
+}
+function resolveEnv(env, input) {
+	if (!env) return {};
+	return Object.fromEntries(Object.entries(env).map(([key, value]) => [key, interpolateRequiredString(value, input, `env.${key}`)]));
+}
+function interpolateString(value, input, field) {
+	return value === void 0 ? void 0 : interpolateRequiredString(value, input, field);
+}
+function interpolateRequiredString(value, input, field) {
+	return value.replace(/\$input(?:\.([A-Za-z0-9_.-]+))?/g, (_match, path) => {
+		if (!path) throw new CapletsError("REQUEST_INVALID", `CLI ${field} cannot interpolate $input directly`);
+		const selected = valueAtPath$1(input, path);
+		if (selected === void 0 || selected === null) throw new CapletsError("REQUEST_INVALID", `CLI ${field} references missing input ${path}`);
+		if (typeof selected !== "string" && typeof selected !== "number" && typeof selected !== "boolean") throw new CapletsError("REQUEST_INVALID", `CLI ${field} input ${path} must be a string, number, or boolean`);
+		return String(selected);
+	});
+}
+function valueAtPath$1(input, path) {
+	let current = input;
+	for (const segment of path.split(".")) {
+		if (!current || typeof current !== "object" || Array.isArray(current)) return;
+		current = current[segment];
+	}
+	return current;
+}
+function validateInput(action, input) {
+	const schema = action.inputSchema;
+	if (!schema) return;
+	const required = Array.isArray(schema.required) ? schema.required : [];
+	for (const key of required) if (typeof key === "string" && (input[key] === void 0 || input[key] === null)) throw new CapletsError("REQUEST_INVALID", `CLI tool ${action.name} requires input ${key}`);
+	const properties = isPlainObject$3(schema.properties) ? schema.properties : {};
+	for (const [key, property] of Object.entries(properties)) {
+		if (input[key] === void 0 || !isPlainObject$3(property) || typeof property.type !== "string") continue;
+		if (!matchesJsonType(input[key], property.type)) throw new CapletsError("REQUEST_INVALID", `CLI tool ${action.name} input ${key} must be ${property.type}`);
+	}
+}
+function matchesJsonType(value, type) {
+	switch (type) {
+		case "string": return typeof value === "string";
+		case "number":
+		case "integer": return typeof value === "number" && (type === "number" || Number.isInteger(value));
+		case "boolean": return typeof value === "boolean";
+		case "object": return isPlainObject$3(value);
+		case "array": return Array.isArray(value);
+		case "null": return value === null;
+		default: return true;
+	}
+}
+function spawnCommand(execution, signal, elapsedMs) {
+	return new Promise((resolve, reject) => {
+		let stdout = "";
+		let stderr = "";
+		let outputBytes = 0;
+		const child = spawn(execution.command, execution.args, {
+			cwd: execution.cwd,
+			env: execution.env,
+			shell: false,
+			signal,
+			windowsHide: true
+		});
+		child.on("error", reject);
+		const append = (stream, chunk) => {
+			outputBytes += chunk.byteLength;
+			if (outputBytes > execution.maxOutputBytes) {
+				child.kill();
+				reject(new CapletsError("DOWNSTREAM_TOOL_ERROR", "CLI tool output exceeded byte limit"));
+				return;
+			}
+			if (stream === "stdout") stdout += chunk.toString("utf8");
+			else stderr += chunk.toString("utf8");
+		};
+		child.stdout?.on("data", (chunk) => append("stdout", chunk));
+		child.stderr?.on("data", (chunk) => append("stderr", chunk));
+		child.on("close", (exitCode, childSignal) => {
+			resolve({
+				exitCode,
+				signal: childSignal,
+				stdout,
+				stderr,
+				elapsedMs: elapsedMs()
+			});
+		});
+	});
+}
+function parseStructuredResult(action, result, tolerateInvalidJson = false) {
+	const structured = {
+		exitCode: result.exitCode,
+		stdout: result.stdout,
+		stderr: result.stderr,
+		elapsedMs: result.elapsedMs,
+		...result.signal ? { signal: result.signal } : {}
+	};
+	if (action.output?.type === "json" && result.stdout.trim()) try {
+		structured.json = JSON.parse(result.stdout);
+	} catch (error) {
+		if (tolerateInvalidJson) {
+			structured.jsonParseError = toSafeError(error);
+			return structured;
+		}
+		throw new CapletsError("DOWNSTREAM_PROTOCOL_ERROR", `CLI tool ${action.name} stdout was not valid JSON`, toSafeError(error));
+	}
+	return structured;
+}
+function resolveCommandPath(command) {
+	if (isAbsolute(command) || /[\\/]/.test(command)) {
+		assertExecutable(command);
+		return command;
+	}
+	for (const directory of (process.env.PATH ?? "").split(delimiter)) {
+		if (!directory) continue;
+		const candidate = join(directory, command);
+		if (isExecutable(candidate)) return candidate;
+		if (process.platform === "win32") for (const ext of (process.env.PATHEXT ?? ".EXE;.CMD;.BAT").split(";")) {
+			const windowsCandidate = join(directory, `${command}${ext.toLowerCase()}`);
+			if (isExecutable(windowsCandidate)) return windowsCandidate;
+		}
+	}
+	throw new CapletsError("SERVER_UNAVAILABLE", `CLI command ${command} was not found on PATH`);
+}
+function assertExecutable(path) {
+	if (!isExecutable(path)) throw new CapletsError("SERVER_UNAVAILABLE", `CLI command ${path} is not executable`);
+}
+function isExecutable(path) {
+	try {
+		accessSync(path, constants.X_OK);
+		return true;
+	} catch {
+		return false;
+	}
+}
+function isAbortError$1(error) {
+	return error instanceof Error && error.name === "AbortError";
+}
+function isPlainObject$3(value) {
+	return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+//#endregion
 //#region node_modules/.pnpm/@modelcontextprotocol+sdk@1.29.0_zod@4.4.3/node_modules/@modelcontextprotocol/sdk/dist/esm/experimental/tasks/client.js
 /**
 * Experimental client task features for MCP SDK.
@@ -61265,7 +61862,7 @@ function openApiCacheKey(endpoint) {
 //#endregion
 //#region src/capability-description.mjs
 function capabilityDescription(server) {
-	const backendName = server.backend === "mcp" ? "MCP server" : server.backend === "openapi" ? "OpenAPI endpoint" : server.backend === "graphql" ? "GraphQL endpoint" : "HTTP API";
+	const backendName = server.backend === "mcp" ? "MCP server" : server.backend === "openapi" ? "OpenAPI endpoint" : server.backend === "graphql" ? "GraphQL endpoint" : server.backend === "http" ? "HTTP API" : "CLI tools";
 	const checkOperation = server.backend === "mcp" ? "check_mcp_server" : "check_backend";
 	const hint = [
 		`Use this Caplet to inspect and call tools from its ${backendName} backend.`,
@@ -61295,7 +61892,7 @@ var ServerRegistry = class {
 		return this.allCaplets().filter((server) => !server.disabled);
 	}
 	get(serverId) {
-		const server = this.config.mcpServers[serverId] ?? this.config.openapiEndpoints[serverId] ?? this.config.graphqlEndpoints[serverId] ?? this.config.httpApis[serverId];
+		const server = this.config.mcpServers[serverId] ?? this.config.openapiEndpoints[serverId] ?? this.config.graphqlEndpoints[serverId] ?? this.config.httpApis[serverId] ?? this.config.cliTools[serverId];
 		return server?.disabled ? void 0 : server;
 	}
 	require(serverId) {
@@ -61346,7 +61943,8 @@ var ServerRegistry = class {
 			...Object.values(this.config.mcpServers),
 			...Object.values(this.config.openapiEndpoints),
 			...Object.values(this.config.graphqlEndpoints),
-			...Object.values(this.config.httpApis)
+			...Object.values(this.config.httpApis),
+			...Object.values(this.config.cliTools)
 		];
 	}
 };
@@ -61372,6 +61970,13 @@ function backendDetail(server) {
 		requestTimeoutMs: server.requestTimeoutMs,
 		configuredActions: Object.keys(server.actions).length
 	};
+	if (server.backend === "cli") return {
+		type: "cli",
+		disabled: server.disabled,
+		timeoutMs: server.timeoutMs,
+		maxOutputBytes: server.maxOutputBytes,
+		configuredActions: Object.keys(server.actions).length
+	};
 	return {
 		type: "mcp",
 		transport: server.transport,
@@ -61503,7 +62108,7 @@ const operations = [
 const generatedToolInputDescriptions = {
 	operation: [
 		"Caplets wrapper operation to perform for this configured Caplet backend.",
-		"Use get_caplet to read the full Caplet card, check_backend to check any backend, check_mcp_server to check an MCP backend, list_tools or search_tools to discover downstream tools, get_tool to read a downstream input schema, and call_tool to run one downstream tool or OpenAPI operation.",
+		"Use get_caplet to read the full Caplet card, check_backend to check any backend, check_mcp_server to check an MCP backend, list_tools or search_tools to discover downstream tools, get_tool to read a downstream input schema, and call_tool to run one downstream tool, operation, action, or CLI command.",
 		"For call_tool, pass downstream inputs only inside the top-level \"arguments\" object."
 	].join(" "),
 	query: "Required only for search_tools. Example: {\"operation\":\"search_tools\",\"query\":\"web search\",\"limit\":5}. Do not use query for call_tool; put downstream query values under arguments.query.",
@@ -61520,16 +62125,16 @@ const generatedToolInputSchema = object$1({
 	arguments: record(string(), unknown()).optional().describe(generatedToolInputDescriptions.arguments),
 	fields: array(string().min(1)).min(1).optional().describe(generatedToolInputDescriptions.fields)
 }).strict();
-async function handleServerTool(server, request, registry, downstream, openapi, graphql, http) {
+async function handleServerTool(server, request, registry, downstream, openapi, graphql, http, cli) {
 	const parsed = validateOperationRequest(request, registry.config.options.maxSearchLimit);
 	switch (parsed.operation) {
 		case "get_caplet": return jsonResult(registry.detail(server));
-		case "check_backend": return jsonResult(await backendFor(server, downstream, openapi, graphql, http).check(server));
+		case "check_backend": return jsonResult(await backendFor(server, downstream, openapi, graphql, http, cli).check(server));
 		case "check_mcp_server":
 			if (server.backend !== "mcp") throw new CapletsError("REQUEST_INVALID", "check_mcp_server is only valid for MCP-backed Caplets; use check_backend");
 			return jsonResult(await downstream.checkServer(server));
 		case "list_tools": {
-			const backend = backendFor(server, downstream, openapi, graphql, http);
+			const backend = backendFor(server, downstream, openapi, graphql, http, cli);
 			const tools = await backend.listTools(server);
 			return jsonResult({
 				server: server.server,
@@ -61537,7 +62142,7 @@ async function handleServerTool(server, request, registry, downstream, openapi,
 			});
 		}
 		case "search_tools": {
-			const backend = backendFor(server, downstream, openapi, graphql, http);
+			const backend = backendFor(server, downstream, openapi, graphql, http, cli);
 			const tools = await backend.listTools(server);
 			const limit = parsed.limit ?? registry.config.options.defaultSearchLimit;
 			return jsonResult({
@@ -61547,14 +62152,14 @@ async function handleServerTool(server, request, registry, downstream, openapi,
 			});
 		}
 		case "get_tool": {
-			const tool = await backendFor(server, downstream, openapi, graphql, http).getTool(server, parsed.tool);
+			const tool = await backendFor(server, downstream, openapi, graphql, http, cli).getTool(server, parsed.tool);
 			return jsonResult({
 				server: server.server,
 				tool
 			});
 		}
 		case "call_tool": {
-			const backend = backendFor(server, downstream, openapi, graphql, http);
+			const backend = backendFor(server, downstream, openapi, graphql, http, cli);
 			if (parsed.fields === void 0) return backend.callTool(server, parsed.tool, parsed.arguments);
 			if (server.backend === "graphql") throw new CapletsError("REQUEST_INVALID", "call_tool.fields is not supported for GraphQL-backed Caplets; select fields in the GraphQL operation document instead");
 			const tool = await backend.getTool(server, parsed.tool);
@@ -61647,7 +62252,7 @@ function projectCallToolResult(result, outputSchema, fields) {
 function isPlainObject(value) {
 	return Boolean(value) && typeof value === "object" && !Array.isArray(value);
 }
-function backendFor(server, downstream, openapi, graphql, http) {
+function backendFor(server, downstream, openapi, graphql, http, cli) {
 	if (server.backend === "mcp") return {
 		check: (...args) => downstream.checkServer(...args),
 		listTools: (...args) => downstream.listTools(...args),
@@ -61678,6 +62283,17 @@ function backendFor(server, downstream, openapi, graphql, http) {
 			search: (...args) => http.search(...args)
 		};
 	}
+	if (server.backend === "cli") {
+		if (!cli) throw new CapletsError("INTERNAL_ERROR", "CLI tools manager is not configured");
+		return {
+			check: (...args) => cli.checkTools(...args),
+			listTools: (...args) => cli.listTools(...args),
+			getTool: (...args) => cli.getTool(...args),
+			callTool: (...args) => cli.callTool(...args),
+			compact: (...args) => cli.compact(...args),
+			search: (...args) => cli.search(...args)
+		};
+	}
 	if (!openapi) throw new CapletsError("INTERNAL_ERROR", "OpenAPI manager is not configured");
 	return {
 		check: (...args) => openapi.checkEndpoint(...args),
@@ -61697,6 +62313,7 @@ var CapletsRuntime = class {
 	openapi;
 	graphql;
 	http;
+	cli;
 	tools = /* @__PURE__ */ new Map();
 	paths;
 	watchDebounceMs;
@@ -61718,6 +62335,7 @@ var CapletsRuntime = class {
 		this.openapi = new OpenApiManager(this.registry, selectAuthOptions(options.authDir));
 		this.graphql = new GraphQLManager(this.registry, selectAuthOptions(options.authDir));
 		this.http = new HttpActionManager(this.registry, selectAuthOptions(options.authDir));
+		this.cli = new CliToolsManager(this.registry);
 		this.server = options.server ?? new McpServer({
 			name: "caplets",
 			version
@@ -61794,6 +62412,7 @@ var CapletsRuntime = class {
 		this.openapi.updateRegistry(nextRegistry);
 		this.graphql.updateRegistry(nextRegistry);
 		this.http.updateRegistry(nextRegistry);
+		this.cli.updateRegistry(nextRegistry);
 		let invalidated = true;
 		try {
 			await this.invalidateChangedBackends(previousConfig, nextConfig);
@@ -61852,7 +62471,7 @@ var CapletsRuntime = class {
 	}
 	async handleTool(serverId, request) {
 		try {
-			return await handleServerTool(this.registry.require(serverId), request, this.registry, this.downstream, this.openapi, this.graphql, this.http);
+			return await handleServerTool(this.registry.require(serverId), request, this.registry, this.downstream, this.openapi, this.graphql, this.http, this.cli);
 		} catch (error) {
 			return errorResult(error);
 		}
@@ -61869,6 +62488,7 @@ var CapletsRuntime = class {
 			if (before?.backend === "openapi" || after?.backend === "openapi" || !after) this.openapi.invalidate(serverId);
 			if (before?.backend === "graphql" || after?.backend === "graphql" || !after) this.graphql.invalidate(serverId);
 			if (before?.backend === "http" || after?.backend === "http" || !after) this.http.invalidate(serverId);
+			if (before?.backend === "cli" || after?.backend === "cli" || !after) this.cli.invalidate(serverId);
 		}
 	}
 	resetWatchers() {
@@ -61961,14 +62581,15 @@ function allCaplets(config) {
 		...Object.values(config.mcpServers),
 		...Object.values(config.openapiEndpoints),
 		...Object.values(config.graphqlEndpoints),
-		...Object.values(config.httpApis)
+		...Object.values(config.httpApis),
+		...Object.values(config.cliTools)
 	];
 }
 function nextEnabledServers(config) {
 	return allCaplets(config).filter((server) => !server.disabled);
 }
 function capletById(config, serverId) {
-	return config.mcpServers[serverId] ?? config.openapiEndpoints[serverId] ?? config.graphqlEndpoints[serverId] ?? config.httpApis[serverId];
+	return config.mcpServers[serverId] ?? config.openapiEndpoints[serverId] ?? config.graphqlEndpoints[serverId] ?? config.httpApis[serverId] ?? config.cliTools[serverId];
 }
 function serializeCaplet(caplet) {
 	return JSON.stringify(caplet ?? null);