siclaw 0.1.0

package/dist/tools/tool-render.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tool-render.js","sourceRoot":"","sources":["../../src/tools/tool-render.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,IAAI,EAAE,MAAM,sBAAsB,CAAC;AAE5C,MAAM,aAAa,GAAG,CAAC,CAAC;AAExB;;;;GAIG;AACH,MAAM,SAAS,GAAG,IAAI,CAAC;AACvB,MAAM,UAAU,GAAG,IAAI,CAAC;AACxB,MAAM,UAAU,GAAG,IAAI,CAAC;AAExB,8DAA8D;AAC9D,4CAA4C;AAC5C,MAAM,OAAO,GAAG,0KAA0K,CAAC;AAE3L,4EAA4E;AAC5E,4CAA4C;AAC5C,MAAM,OAAO,GAAG,mCAAmC,CAAC;AAEpD;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,IAAY;IACzC,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;AACxD,CAAC;AAED;;GAEG;AACH,SAAS,YAAY,CAAC,IAAY;IAChC,MAAM,EAAE,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC1C,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,iBAAiB,EAAE,MAAM,CAAC,CAAC;IACnE,EAAE,CAAC,aAAa,CAAC,QAAQ,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;IAC1C,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAAY;IAC5C,MAAM,KAAK,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;IACnC,IAAI,KAAK,CAAC,MAAM,IAAI,SAAS;QAAE,OAAO,KAAK,CAAC;IAE5C,MAAM,QAAQ,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC;IACrC,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC;IACxC,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,UAAU,CAAC,CAAC;IACtC,MAAM,UAAU,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC;IAC5C,OAAO,GAAG,IAAI,YAAY,UAAU,yDAAyD,QAAQ,QAAQ,IAAI,EAAE,CAAC;AACtH,CAAC;AAED,gDAAgD;AAChD,MAAM,CAAC,MAAM,cAAc,GAAG,iBAAiB,CAAC;AAEhD;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAC9B,MAAW,EACX,OAAY,EACZ,KAAU;IAEV,MAAM,UAAU,GAAG,CAAC,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,MAAM,CAC9C,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM,CAC9B,CAAC;IACF,MAAM,MAAM,GAAW,UAAU;SAC9B,GAAG,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC;SAC7B,IAAI,CAAC,IAAI,CAAC;SACV,IAAI,EAAE,CAAC;IACV,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,IAAI,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;IAEvC,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACjC,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAS,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,CAAC;IAEnE,IAAI,OAAO,CAAC,QAAQ,IAAI,KAAK,CAAC,MAAM,IAAI,aAAa,EAAE,CAAC;QACtD,OAAO,IAAI,IAAI,CAAC,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;IAClD,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,aAAa,CAAC,CAAC;IAC7C,MAAM,OAAO,GAAG,KAAK,CAAC,MAAM,GAAG,aAAa,CAAC;IAC7C,MAAM,IAAI,GAAG,KAAK,CAAC,EAAE,CACnB,OAAO,EACP,QAAQ,OAAO,mCAAmC,CACnD,CAAC;IACF,OAAO,IAAI,IAAI,CAAC,IAAI,GAAG,IAAI,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;AACjE,CAAC"}

package/dist/tools/update-skill.d.ts

@@ -0,0 +1,2 @@
+import type { ToolDefinition } from "@mariozechner/pi-coding-agent";
+export declare function createUpdateSkillTool(): ToolDefinition;

package/dist/tools/update-skill.js

@@ -0,0 +1,169 @@
+import { Type } from "@sinclair/typebox";
+import { skillExistsInBundle } from "./script-resolver.js";
+export function createUpdateSkillTool() {
+    return {
+        name: "update_skill",
+        label: "Update Skill",
+        description: `Update an existing Siclaw skill definition.
+This tool outputs a structured skill update that the user can preview and confirm. It does NOT persist anything — the user must confirm via the UI.
+
+Use this tool (NOT create_skill) when the user asks to modify, update, change, or fix an existing skill. This includes:
+- When the user message contains [Editing Skill: <name> (id:<id>)] context from the UI
+- When the user asks to change a skill that was created earlier in the conversation
+- When the user asks to modify or replace an existing skill
+
+**IMPORTANT — Identify the target skill FIRST**:
+Before calling this tool, you MUST know the exact name of the skill to update. Check the Skill Scripts Reference in your context for existing skills. If the user's request is ambiguous (e.g. "update that skill", "update it"), ASK the user to clarify which skill they mean. Never guess — a wrong target will corrupt the wrong skill.
+
+Do NOT use read, edit, write, or bash on files under .siclaw/skills/ — the filesystem is read-only. Always use this tool instead.
+
+**Approval required**: When scripts are changed, the update enters a "staged" review state and requires admin approval before the new version becomes active. The old version of the skill remains usable during review. After updating, do NOT attempt to test the new version — it will not take effect until an admin approves it. Inform the user that the update is pending review.
+
+Parameters:
+- id: The skill ID from [Editing Skill: ... (id:<id>)] context, OR the skill's kebab-case name (for name-based lookup).
+- name: the skill name in kebab-case (cannot be changed after creation).
+- description: one-line summary
+- type: category (Monitoring, Network, Security, Database, Core, Utility, Automation, Custom)
+- specs: full updated SKILL.md content (complete, not a diff)
+- scripts: the COMPLETE list of scripts the skill should have after the update. **Only include scripts the skill actually needs.** Scripts NOT in this list will be DELETED from disk.
+  - Changed script: { name: "run.sh", content: "#!/bin/bash\\n..." }
+  - Unchanged script: { name: "run.sh" } (name only, server preserves original)
+  - To remove a script: simply omit it from the array — it will be deleted
+
+## Script Execution Modes
+
+When a skill includes scripts, you MUST choose the correct execution tool based on WHERE the script needs to run:
+
+| Tool | Runs where | When to use |
+|------|-----------|-------------|
+| \`run_skill\` | Local (AgentBox) | Scripts that call kubectl from outside the cluster (most common) |
+| \`node_script\` | On a K8s node (host namespaces) | Scripts needing host tools, filesystem, /proc, /sys, devices |
+| \`pod_script\` | Inside a pod (kubectl exec) | Scripts running diagnostics inside a running pod |
+| \`pod_netns_script\` | Node + pod's network namespace | Network diagnostics needing host tools + pod's network view |
+
+In the SKILL.md, document the tool in a "## Tool" section. Examples:
+
+### run_skill (local execution, calls kubectl)
+\`\`\`
+## Tool
+run_skill: skill="find-node", script="find-node.sh", args="<keyword>"
+\`\`\`
+
+### node_script (execute on node)
+\`\`\`
+## Tool
+Use the \`node_script\` tool:
+node_script: node="<node>", skill="node-logs", script="get-node-logs.sh", args="--unit containerd"
+\`\`\`
+
+### pod_script (execute inside pod)
+\`\`\`
+## Tool
+Use the \`pod_script\` tool:
+pod_script: pod="<pod>", namespace="<ns>", skill="pod-diagnose", script="check.sh"
+\`\`\`
+
+### pod_netns_script (pod network namespace + host tools)
+\`\`\`
+## Tool
+Use the \`pod_netns_script\` tool:
+pod_netns_script: pod="<pod>", namespace="<ns>", skill="pod-ping-gateway", script="ping-gateway.sh", args="--interface net1"
+\`\`\``,
+        parameters: Type.Object({
+            id: Type.Optional(Type.String({
+                description: "Skill ID or kebab-case name for lookup.",
+            })),
+            name: Type.String({
+                description: "Skill name in kebab-case (e.g. 'check-pod-oom')",
+            }),
+            description: Type.String({
+                description: "One-line description of what the skill does",
+            }),
+            type: Type.Optional(Type.String({
+                description: "Category: Monitoring, Network, Security, Database, Core, Utility, Automation, Custom",
+            })),
+            specs: Type.String({
+                description: "Full updated SKILL.md content (markdown with YAML frontmatter)",
+            }),
+            scripts: Type.Optional(Type.Array(Type.Object({
+                name: Type.String({
+                    description: "Script filename (e.g. 'run.sh', 'diagnose.py')",
+                }),
+                content: Type.Optional(Type.String({
+                    description: "Updated script content. If omitted, the server preserves the existing file.",
+                })),
+            }), {
+                description: "Scripts for the skill. Provide content for changed scripts, name-only for unchanged. Omit to delete.",
+            })),
+            labels: Type.Optional(Type.Array(Type.String(), { description: "Labels/tags for the skill (e.g. ['gpu', 'network', 'monitoring'])" })),
+        }),
+        async execute(_toolCallId, rawParams) {
+            const params = rawParams;
+            if (!params.name?.trim()) {
+                return {
+                    content: [
+                        {
+                            type: "text",
+                            text: JSON.stringify({ error: "Skill name is required." }),
+                        },
+                    ],
+                    details: { error: true },
+                };
+            }
+            if (!params.specs?.trim()) {
+                return {
+                    content: [
+                        {
+                            type: "text",
+                            text: JSON.stringify({
+                                error: "Skill specs (SKILL.md content) is required.",
+                            }),
+                        },
+                    ],
+                    details: { error: true },
+                };
+            }
+            const skillName = params.name.trim();
+            // Reject if the target skill doesn't exist in the bundle (personal/team)
+            if (!skillExistsInBundle(skillName)) {
+                return {
+                    content: [
+                        {
+                            type: "text",
+                            text: JSON.stringify({
+                                error: `Skill '${skillName}' not found. Cannot update a skill that doesn't exist. Use 'create_skill' to create a new skill, or check the skill name.`,
+                            }),
+                        },
+                    ],
+                    details: { error: true },
+                };
+            }
+            const hasScripts = params.scripts && params.scripts.length > 0;
+            const labels = params.labels?.map(l => l.trim()).filter(Boolean);
+            const result = {
+                skillId: params.id?.trim() || "",
+                skill: {
+                    name: params.name.trim(),
+                    description: params.description?.trim() || "",
+                    type: params.type?.trim() || "Custom",
+                    specs: params.specs,
+                    scripts: params.scripts?.map((s) => ({
+                        name: s.name,
+                        content: s.content,
+                    })) || [],
+                    labels: labels && labels.length > 0 ? labels : undefined,
+                },
+                summary: `Updated skill definition '${params.name.trim()}'. Please review and click Update.`
+                    + (hasScripts ? ' Script changes will be staged for admin review. The old version remains active until approved. Do NOT attempt to test the new version until approved.' : ''),
+                reviewNote: hasScripts
+                    ? "This update contains scripts and will enter STAGED review status. The OLD version of the skill remains active and usable, but the new version will NOT take effect until an admin approves it. Please inform the user that the update is awaiting admin approval."
+                    : undefined,
+            };
+            return {
+                content: [{ type: "text", text: JSON.stringify(result) }],
+                details: {},
+            };
+        },
+    };
+}
+//# sourceMappingURL=update-skill.js.map

package/dist/tools/update-skill.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"update-skill.js","sourceRoot":"","sources":["../../src/tools/update-skill.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,mBAAmB,CAAC;AAEzC,OAAO,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAY3D,MAAM,UAAU,qBAAqB;IACnC,OAAO;QACL,IAAI,EAAE,cAAc;QACpB,KAAK,EAAE,cAAc;QACrB,WAAW,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAgEV;QACH,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC;YACtB,EAAE,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC;gBAC5B,WAAW,EAAE,yCAAyC;aACvD,CAAC,CAAC;YACH,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC;gBAChB,WAAW,EAAE,iDAAiD;aAC/D,CAAC;YACF,WAAW,EAAE,IAAI,CAAC,MAAM,CAAC;gBACvB,WAAW,EAAE,6CAA6C;aAC3D,CAAC;YACF,IAAI,EAAE,IAAI,CAAC,QAAQ,CACjB,IAAI,CAAC,MAAM,CAAC;gBACV,WAAW,EACT,sFAAsF;aACzF,CAAC,CACH;YACD,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC;gBACjB,WAAW,EAAE,gEAAgE;aAC9E,CAAC;YACF,OAAO,EAAE,IAAI,CAAC,QAAQ,CACpB,IAAI,CAAC,KAAK,CACR,IAAI,CAAC,MAAM,CAAC;gBACV,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC;oBAChB,WAAW,EAAE,gDAAgD;iBAC9D,CAAC;gBACF,OAAO,EAAE,IAAI,CAAC,QAAQ,CACpB,IAAI,CAAC,MAAM,CAAC;oBACV,WAAW,EACT,6EAA6E;iBAChF,CAAC,CACH;aACF,CAAC,EACF;gBACE,WAAW,EACT,sGAAsG;aACzG,CACF,CACF;YACD,MAAM,EAAE,IAAI,CAAC,QAAQ,CACnB,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,EAAE,WAAW,EAAE,mEAAmE,EAAE,CAAC,CAChH;SACF,CAAC;QACF,KAAK,CAAC,OAAO,CAAC,WAAW,EAAE,SAAS;YAClC,MAAM,MAAM,GAAG,SAA8B,CAAC;YAE9C,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC;gBACzB,OAAO;oBACL,OAAO,EAAE;wBACP;4BACE,IAAI,EAAE,MAAM;4BACZ,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,yBAAyB,EAAE,CAAC;yBAC3D;qBACF;oBACD,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE;iBACzB,CAAC;YACJ,CAAC;YACD,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC;gBAC1B,OAAO;oBACL,OAAO,EAAE;wBACP;4BACE,IAAI,EAAE,MAAM;4BACZ,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gCACnB,KAAK,EAAE,6CAA6C;6BACrD,CAAC;yBACH;qBACF;oBACD,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE;iBACzB,CAAC;YACJ,CAAC;YAED,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;YAErC,yEAAyE;YACzE,IAAI,CAAC,mBAAmB,CAAC,SAAS,CAAC,EAAE,CAAC;gBACpC,OAAO;oBACL,OAAO,EAAE;wBACP;4BACE,IAAI,EAAE,MAAM;4BACZ,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gCACnB,KAAK,EAAE,UAAU,SAAS,2HAA2H;6BACtJ,CAAC;yBACH;qBACF;oBACD,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE;iBACzB,CAAC;YACJ,CAAC;YAED,MAAM,UAAU,GAAG,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC;YAC/D,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YACjE,MAAM,MAAM,GAAG;gBACb,OAAO,EAAE,MAAM,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE;gBAChC,KAAK,EAAE;oBACL,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE;oBACxB,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,IAAI,EAAE,IAAI,EAAE;oBAC7C,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,QAAQ;oBACrC,KAAK,EAAE,MAAM,CAAC,KAAK;oBACnB,OAAO,EACL,MAAM,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;wBAC1B,IAAI,EAAE,CAAC,CAAC,IAAI;wBACZ,OAAO,EAAE,CAAC,CAAC,OAAO;qBACnB,CAAC,CAAC,IAAI,EAAE;oBACX,MAAM,EAAE,MAAM,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS;iBACzD;gBACD,OAAO,EAAE,6BAA6B,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,oCAAoC;sBACxF,CAAC,UAAU,CAAC,CAAC,CAAC,wJAAwJ,CAAC,CAAC,CAAC,EAAE,CAAC;gBAChL,UAAU,EAAE,UAAU;oBACpB,CAAC,CAAC,mQAAmQ;oBACrQ,CAAC,CAAC,SAAS;aACd,CAAC;YAEF,OAAO;gBACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC;gBACzD,OAAO,EAAE,EAAE;aACZ,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC"}

package/package.json

@@ -0,0 +1,106 @@
+{
+  "name": "siclaw",
+  "version": "0.1.0",
+  "description": "AI-powered SRE copilot for Kubernetes diagnostics via natural language",
+  "type": "module",
+  "bin": {
+    "siclaw": "./siclaw.mjs"
+  },
+  "files": [
+    "dist/",
+    "siclaw.mjs",
+    "skills/",
+    "settings.example.json"
+  ],
+  "license": "Apache-2.0",
+  "publishConfig": {
+    "access": "public"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/scitix/siclaw.git"
+  },
+  "homepage": "https://github.com/scitix/siclaw#readme",
+  "bugs": {
+    "url": "https://github.com/scitix/siclaw/issues"
+  },
+  "keywords": [
+    "sre",
+    "kubernetes",
+    "k8s",
+    "ai",
+    "copilot",
+    "diagnostics",
+    "claude",
+    "agent"
+  ],
+  "engines": {
+    "node": ">=22.12.0"
+  },
+  "dependencies": {
+    "@anthropic-ai/claude-agent-sdk": "^0.1.58",
+    "@anthropic-ai/sdk": "^0.71.2",
+    "@kubernetes/client-node": "^1.4.0",
+    "@mariozechner/pi-coding-agent": "^0.55.3",
+    "@modelcontextprotocol/sdk": "^1.27.1",
+    "@sinclair/typebox": "^0.34.0",
+    "diff": "^8.0.3",
+    "drizzle-orm": "^0.45.1",
+    "js-yaml": "^4.1.1",
+    "markdown-it": "^14.1.0",
+    "mysql2": "^3.16.3",
+    "node-forge": "^1.3.3",
+    "sql.js": "^1.12.0",
+    "sqlite-vec": "^0.1.7-alpha.2",
+    "ws": "^8.18.0",
+    "zod": "^3.24.0"
+  },
+  "optionalDependencies": {
+    "@aws-sdk/client-s3": "^3.984.0",
+    "@larksuiteoapi/node-sdk": "^1.56.1",
+    "@slack/bolt": "^4.6.0",
+    "@slack/web-api": "^7.14.1",
+    "dingtalk-stream-sdk-nodejs": "^2.0.4",
+    "discord.js": "^14.16.0",
+    "grammy": "^1.41.1"
+  },
+  "devDependencies": {
+    "@types/diff": "^7.0.2",
+    "@types/js-yaml": "^4.0.9",
+    "@types/markdown-it": "^14.1.2",
+    "@types/node": "^22.19.8",
+    "@types/node-forge": "^1.3.14",
+    "@types/react-router-dom": "^5.3.3",
+    "@types/sql.js": "^1.4.9",
+    "@types/ws": "^8.5.0",
+    "autoprefixer": "^10.4.24",
+    "clsx": "^2.1.1",
+    "drizzle-kit": "^0.31.8",
+    "framer-motion": "^12.31.0",
+    "lucide-react": "^0.563.0",
+    "postcss": "^8.5.6",
+    "react-router-dom": "^7.13.0",
+    "tailwind-merge": "^3.4.0",
+    "tailwindcss": "^4.1.18",
+    "tsx": "^4.21.0",
+    "typescript": "^5.9.0",
+    "vitest": "^3.0.0"
+  },
+  "scripts": {
+    "build": "tsc && npm run copy:web",
+    "build:web": "cd src/gateway/web && npm install && npm run build",
+    "copy:web": "node -e \"const fs=require('fs');const p=require('path');const s=p.join('src','gateway','web','dist');const d=p.join('dist','gateway','web','dist');if(fs.existsSync(s)){fs.cpSync(s,d,{recursive:true});console.log('Copied web UI to '+d)}\"",
+    "prepublishOnly": "npm run build:web && npm run build",
+    "dev": "tsx src/cli-main.ts",
+    "dev:gateway": "npm run build:web && tsx src/gateway-main.ts",
+    "dev:agentbox": "tsx src/agentbox-main.ts",
+    "start": "node siclaw-tui.mjs",
+    "start:gateway": "node siclaw-gateway.mjs",
+    "start:agentbox": "node dist/agentbox-main.js",
+    "test": "vitest run",
+    "docker:build:gateway": "docker build -f Dockerfile.gateway -t siclaw-gateway:latest .",
+    "docker:build:agentbox": "docker build -f Dockerfile.agentbox -t siclaw-agentbox:latest .",
+    "docker:push:gateway": "docker push siclaw-gateway:latest",
+    "docker:push:agentbox": "docker push siclaw-agentbox:latest"
+  }
+}

package/settings.example.json

@@ -0,0 +1,74 @@
+{
+  "_comment": "Copy this file to .siclaw/config/settings.json and fill in your API key. Or run: npx tsx src/cli-main.ts --setup",
+  "providers": {
+    "default": {
+      "_comment": "Option 1: OpenAI",
+      "baseUrl": "https://api.openai.com/v1",
+      "apiKey": "sk-YOUR-OPENAI-KEY",
+      "api": "openai-completions",
+      "authHeader": true,
+      "models": [
+        {
+          "id": "gpt-4o",
+          "name": "GPT-4o",
+          "reasoning": false,
+          "input": ["text"],
+          "cost": { "input": 0, "output": 0, "cacheRead": 0, "cacheWrite": 0 },
+          "contextWindow": 128000,
+          "maxTokens": 16384,
+          "compat": {
+            "supportsDeveloperRole": true,
+            "supportsUsageInStreaming": true,
+            "maxTokensField": "max_tokens"
+          }
+        }
+      ]
+    },
+    "_anthropic_example": {
+      "_comment": "Option 2: Anthropic — rename this key to 'default' to use",
+      "baseUrl": "https://api.anthropic.com/v1",
+      "apiKey": "sk-ant-YOUR-ANTHROPIC-KEY",
+      "api": "anthropic",
+      "authHeader": true,
+      "models": [
+        {
+          "id": "claude-sonnet-4-20250514",
+          "name": "Claude Sonnet 4",
+          "reasoning": true,
+          "input": ["text"],
+          "cost": { "input": 0, "output": 0, "cacheRead": 0, "cacheWrite": 0 },
+          "contextWindow": 200000,
+          "maxTokens": 16000,
+          "compat": {
+            "supportsDeveloperRole": false,
+            "supportsUsageInStreaming": true,
+            "maxTokensField": "max_tokens"
+          }
+        }
+      ]
+    },
+    "_compatible_example": {
+      "_comment": "Option 3: OpenAI-compatible API (Qwen, DeepSeek, Ollama, vLLM, etc.) — rename to 'default' to use",
+      "baseUrl": "https://dashscope.aliyuncs.com/compatible-mode/v1",
+      "apiKey": "sk-YOUR-KEY",
+      "api": "openai-completions",
+      "authHeader": true,
+      "models": [
+        {
+          "id": "qwen-plus",
+          "name": "Qwen Plus",
+          "reasoning": false,
+          "input": ["text"],
+          "cost": { "input": 0, "output": 0, "cacheRead": 0, "cacheWrite": 0 },
+          "contextWindow": 131072,
+          "maxTokens": 8192,
+          "compat": {
+            "supportsDeveloperRole": true,
+            "supportsUsageInStreaming": true,
+            "maxTokensField": "max_tokens"
+          }
+        }
+      ]
+    }
+  }
+}

package/siclaw.mjs

@@ -0,0 +1,48 @@
+#!/usr/bin/env node
+
+import fs from "node:fs";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+const pkg = JSON.parse(fs.readFileSync(path.join(__dirname, "package.json"), "utf-8"));
+
+const args = process.argv.slice(2);
+const subcommand = args[0];
+
+function printHelp() {
+  console.log(`siclaw v${pkg.version}
+
+Usage: siclaw [command] [options]
+
+Commands:
+  (default)    Start interactive TUI session
+  local        Start local gateway with web UI
+
+Options:
+  --prompt <text>   Run in non-interactive print mode
+  --continue        Continue the most recent session
+  --debug           Enable debug logging
+  --setup           Force provider setup wizard
+  --help, -h        Show this help
+  --version, -v     Show version
+`);
+}
+
+if (args.includes("--help") || args.includes("-h")) {
+  printHelp();
+  process.exit(0);
+}
+
+if (args.includes("--version") || args.includes("-v")) {
+  console.log(pkg.version);
+  process.exit(0);
+}
+
+if (subcommand === "local") {
+  // Remove "local" from argv so gateway-main doesn't see it as an unknown arg
+  process.argv.splice(2, 1);
+  await import("./dist/gateway-main.js");
+} else {
+  await import("./dist/cli-main.js");
+}

package/skills/core/cluster-events/SKILL.md

@@ -0,0 +1,150 @@
+---
+name: cluster-events
+description: >-
+  Analyze cluster-wide Kubernetes events to identify issues and patterns.
+  Aggregates Warning events, detects high-frequency patterns, and correlates related events.
+---
+
+# Cluster Events Analysis
+
+Use this flow to analyze cluster-wide events for identifying issues, patterns, and correlations across resources.
+
+**Scope:** This skill is for **analysis and diagnosis only**. It helps you understand what is happening across the cluster by examining events. Do NOT attempt to fix issues directly — identify root causes and either use a specific diagnostic skill or report findings to the user.
+
+## Diagnostic Flow
+
+### 1. Get recent events
+
+Get all events sorted by time, focusing on Warning events:
+
+```bash
+kubectl get events -A --sort-by='.lastTimestamp' --field-selector type=Warning
+```
+
+If you need all event types for context:
+
+```bash
+kubectl get events -A --sort-by='.lastTimestamp'
+```
+
+For events in a specific namespace:
+
+```bash
+kubectl get events -n <ns> --sort-by='.lastTimestamp'
+```
+
+### 2. Identify high-frequency events
+
+Look for events with high `COUNT` values — these indicate repeated occurrences and often point to persistent issues.
+
+For a structured view:
+
+```bash
+kubectl get events -A --field-selector type=Warning -o custom-columns='LAST SEEN:.lastTimestamp,COUNT:.count,KIND:.involvedObject.kind,NAME:.involvedObject.name,NAMESPACE:.involvedObject.namespace,REASON:.reason,MESSAGE:.message'
+```
+
+### 3. Correlate events by resource
+
+When you find Warning events, check if the same resource has related events that tell a more complete story:
+
+```bash
+kubectl get events -n <ns> --field-selector involvedObject.name=<resource-name>
+```
+
+### 4. Match event patterns and recommend next steps
+
+Match the Warning events against the patterns below. For each matched pattern, recommend the appropriate diagnostic skill or action.
+
+---
+
+#### `FailedScheduling` — Pod cannot be scheduled
+
+The scheduler cannot place a pod on any node.
+
+**Next step:** Use the `pod-pending-debug` skill to diagnose the specific pod.
+
+---
+
+#### `BackOff` / `Back-off restarting failed container` — Container crash loop
+
+A container is repeatedly crashing and restarting.
+
+**Next step:** Use the `pod-crash-debug` skill to diagnose the specific pod.
+
+---
+
+#### `Failed` / `ErrImagePull` / `ImagePullBackOff` — Image pull failure
+
+The container image cannot be pulled.
+
+**Next step:** Use the `image-pull-debug` skill to diagnose the specific pod.
+
+---
+
+#### `FailedMount` / `FailedAttachVolume` — Volume mount failure
+
+A volume (PVC, ConfigMap, Secret, or other) cannot be mounted.
+
+Check the specific error message:
+- `not found` — the referenced ConfigMap/Secret/PVC does not exist
+- `already attached` — the volume is stuck on another node (common with RWO PVs)
+- `timed out waiting` — the storage provisioner is slow or failing
+
+---
+
+#### `Unhealthy` — Probe failure
+
+A liveness or readiness probe is failing.
+
+Check which probe is failing from the event message:
+- **Liveness probe failed** — the container will be restarted, may lead to CrashLoopBackOff
+- **Readiness probe failed** — the container is removed from service endpoints but not restarted
+- **Startup probe failed** — the container is killed during startup
+
+Advise the user to check probe configuration (endpoint, port, timing parameters).
+
+---
+
+#### `NodeNotReady` — Node became unhealthy
+
+A node transitioned to NotReady state, which may affect all pods on that node.
+
+**Next step:** Use the `node-health-check` skill to diagnose the specific node.
+
+---
+
+#### `Evicted` — Pod was evicted
+
+A pod was evicted from a node, typically due to resource pressure (DiskPressure, MemoryPressure).
+
+Check which node evicted the pod and investigate node health:
+
+```bash
+kubectl get pod <pod> -n <ns> -o jsonpath='{.status.reason} {.status.message}'
+```
+
+---
+
+#### `FailedCreate` — Controller cannot create pods
+
+A ReplicaSet, Job, or other controller cannot create pods. Common causes: resource quota exceeded, admission webhook rejection.
+
+Check the controller's events:
+
+```bash
+kubectl describe rs <replicaset> -n <ns>
+```
+
+---
+
+#### `OOMKilling` — Kernel OOM killer invoked
+
+The kernel killed a process due to memory exhaustion. This may affect containers on the node.
+
+**Next step:** Use the `pod-crash-debug` skill for the affected pod, or `node-health-check` for the node.
+
+## Notes
+
+- Kubernetes events have a default TTL of 1 hour. For older events, check monitoring/logging systems.
+- Events with `count > 1` show the first and last timestamp — the actual frequency may be higher than it appears.
+- When multiple Warning events appear simultaneously across different resources, look for a common cause (e.g., a node going down affects all pods on that node).

package/skills/core/deep-investigation/SKILL.md

@@ -0,0 +1,87 @@
+---
+name: deep-investigation
+description: >-
+  Structured hypothesis-driven investigation for complex infrastructure issues.
+  Triggered by /dp command or [Deep Investigation] UI toggle.
+---
+
+# Deep Investigation
+
+A structured workflow for deep-diving into complex issues using hypothesis-driven
+validation. When the user explicitly activates Deep Investigation mode (toggle, /dp,
+Ctrl+I), follow this recommended structure. Outside of DP mode, use these tools
+adaptively based on the situation.
+
+## When to Use
+
+- Complex issues requiring hypothesis-driven investigation with multiple potential root causes
+- Issues involving RDMA/RoCE, network, or hardware that need systematic validation
+- When the user explicitly requests deep investigation (toggle, /dp, Ctrl+I)
+- When initial triage reveals multiple possible root causes
+
+## When NOT to Use
+
+- Simple questions answerable with 1-2 kubectl commands
+- When the issue is already clear from initial triage
+
+## Recommended Workflow (4 phases)
+
+The following phases are a recommended structure. You may skip or merge phases
+when the situation calls for it — e.g., skip straight to deep_search if the user
+gives a clear direction, or end after triage if the answer is already apparent.
+
+### Phase 1: Quick Triage
+
+Gather environment context and confirm the problem exists.
+
+1. Call `manage_checklist` to mark `triage` as `in_progress`.
+2. Run targeted kubectl / diagnostic commands to confirm the symptom.
+3. Call `manage_checklist` to mark `triage` as `done` with a brief summary.
+
+### Phase 2: Propose Hypotheses
+
+Formulate 3-5 ranked hypotheses based on triage findings.
+
+1. Call `manage_checklist` to mark `hypotheses` as `in_progress`.
+2. Call `propose_hypotheses` tool with your formatted hypothesis list.
+3. In DP mode, this is a good point to pause for user input — the user may want
+   to adjust hypotheses before committing to an expensive deep_search.
+   If the user is actively engaged, wait for their confirmation.
+   If the user gave a clear directive, you may proceed directly.
+
+### Phase 3: Deep Search Validation
+
+Validate hypotheses using parallel sub-agents.
+
+1. Call `manage_checklist` to mark `deep_search` as `in_progress`.
+2. Call `deep_search` tool with triageContext and the hypotheses.
+3. When deep_search completes, call `manage_checklist` to mark `deep_search` as `done`.
+
+### Phase 4: Present Findings
+
+Synthesize the deep_search results into a conclusion.
+
+1. Call `manage_checklist` to mark `conclusion` as `in_progress`.
+2. Write a clear conclusion with root cause analysis and recommendations.
+3. Call `manage_checklist` to mark `conclusion` as `done`.
+
+## Available Tools
+
+| Tool | Purpose |
+|------|---------|
+| `manage_checklist` | Update checklist progress (items: triage, hypotheses, deep_search, conclusion) |
+| `propose_hypotheses` | Present hypotheses to the user — a communication tool for aligning investigation direction |
+| `deep_search` | Launch parallel sub-agent validation of hypotheses |
+| `end_investigation` | End early — auto-skips remaining phases |
+
+## Guidelines
+
+1. **Use propose_hypotheses for communication**: Always use the tool (not plain text) to present hypotheses — it renders a proper UI card. Think of it as a way to align with the user on investigation direction, not as a mandatory gate.
+2. **Be cost-aware with deep_search**: It launches parallel sub-agents consuming 30-60 tool calls. When the investigation direction is uncertain, use propose_hypotheses to get alignment first.
+3. **Avoid redundant validation**: Let deep_search handle hypothesis validation with its parallel sub-agents. Running the same checks manually is inefficient.
+4. **Use DP-specific tools during DP mode**: Prefer `manage_checklist` over `task_plan` during deep investigation to keep the checklist UI consistent.
+
+## Early Exit
+
+- If triage alone is sufficient to answer the question, present your findings and ask the user before ending.
+- Call `end_investigation` to cleanly exit — it marks all remaining items as skipped.

package/skills/core/deep-investigation/default-memory.md

@@ -0,0 +1,8 @@
+## Investigation Patterns (learned)
+
+- User is actively discussing (asking questions, giving feedback) → use propose_hypotheses to align direction before committing to deep_search
+- User gives an open-ended request ("help me look into X") → do triage first, then communicate your findings and proposed direction before going deep
+- User gives a specific directive ("validate H1 and H3") → execute immediately, no need to re-confirm
+- deep_search fails or returns insufficient results → discuss with the user and adjust hypotheses before retrying; do not repeatedly call deep_search autonomously
+- Simple issue becomes apparent during triage → present findings directly, suggest ending investigation early rather than forcing the full workflow
+- propose_hypotheses is a communication tool, not a gate → use it whenever presenting investigation thinking to the user, regardless of whether DP mode is active