Hematite CLI Documentation

What this project is

Hematite is a local AI coding harness and natural-language Senior SysAdmin, Network Admin, Data Analyst, and Software Engineer built in Rust. It runs on your machine and uses any OpenAI-compatible local model server. The default target is LM Studio on localhost:1234, but the endpoint is configurable. The terminal TUI is one interface layer of the product, not the whole product. The main engineering target is a single-GPU consumer Windows setup, especially RTX 4070-class hardware. The codebase itself follows an AI-Native philosophy: source files are optimized for signal density and "Clippy-Clean" standards to minimize token overhead when reasoning about the architecture. It features a high-fidelity integrated host inspection suite covering 128+ read-only diagnostic topics for precision triage and a Scientific Mandate that enforces verifiable computation for all mathematical and physical derivations.

Hematite supports two model protocol paths:

Gemma 4 native — Gemma 4 family models; native tool markup auto-enabled by model name (gemma_native_auto: true by default)
Standard OpenAI-compatible — all other models; plain tool format; tested primary target is Qwen/Qwen3.5-9B Q4_K_M
Ollama — supported as a local runtime when api_url points at an Ollama-compatible endpoint such as http://localhost:11434/v1

Build and Run

cargo build
cargo run
cargo run -- --no-splash
cargo run -- --rusty
cargo run -- --yolo
cargo run -- --brief
cargo run -- --stats
cargo run -- --teleported-from <path>
pwsh ./clean.ps1

Core Protocol: Teleportation & Handshake

Workspace Teleportation: When diving into a new directory, Hematite spawns a fresh terminal session pre-navigated to the target. The new window opens at the same pixel size and position as the originating window, and launches with --no-splash for a seamless transition.
Self-Destruct: The original terminal session performs a clean exit after the handoff to ensure workstation hygiene. A background watcher detects when Hematite exits and kills the originating cmd.exe. Windows Terminal tabs are explicitly excluded (killing WindowsTerminal.exe would close all tabs).
Teleportation Handshake: New sessions arriving via teleportation (flagged by --teleported-from) display a specialized greeting confirming the origin and intent.
OS Shortcut Directory Guard: Teleporting to or launching from Desktop, Downloads, Documents, Pictures, Videos, or Music does not create a local .hematite/ folder there. All runtime state (settings, vein, session, logs, scratch) routes to ~/.hematite/ instead, keeping OS directories clean. Real project directories are unaffected.
Local Search Stack: When auto_start_searx is enabled, Hematite scaffolds and boots a private SearXNG stack under ~/.hematite/searxng-local when the configured searx_url is local and Docker Desktop is available. If SearXNG is already reachable, Hematite reuses it instead of restarting it. If Docker is missing or the daemon is stopped, Hematite surfaces a compact startup note with the fix instead of silently failing. Set HEMATITE_SEARX_ROOT to relocate the stack; auto_stop_searx only stops the instance Hematite started in the current session. The default scaffold now favors a safer technical-source engine pool instead of the older broad 12-engine mix.

Important: cargo build / cargo run only update target/debug/hematite.exe. If you run Hematite from the portable dist (dist\windows\Hematite-X.Y.Z-portable\hematite.exe) — which is what end-users have on their PATH — you must rebuild the portable bundle after any code change:
pwsh ./scripts/package-windows.ps1
cargo run is the fastest loop during development. Run the package script before testing with the portable binary or before committing/tagging a release.

Agent rule: if you are operating this repo through an external harness with sandboxed tools, do not start local Windows build/package/install steps in the sandbox. cargo build --release, pwsh ./scripts/package-windows.ps1, installer generation, and -AddToPath can touch the local ORT cache in AppData, release sidecars, dist/, and the real user PATH. Treat those as unrestricted local-machine operations first; use sandboxed runs for source inspection, read-only analysis, and isolated code execution.

Hotkeys and Commands

ESC: cancel the current task and copy the session transcript to the clipboard
Ctrl+Q / Ctrl+C: exit Hematite and copy the session transcript
Ctrl+T: toggle voice
Ctrl+O: open file picker to attach a document (PDF/markdown/txt) for the next turn
Ctrl+I: open file picker to attach an image for the next turn (vision path)
Ctrl+Z: undo last file edit (ghost backup restore)
@ in input: opens live file autocomplete — scans workspace, filters as you type, optimized with Smart Splicing for Path Aliases (e.g. @DESKTOP); Tab/Enter/Mouse-click inserts the path
/read <text>: speaks text aloud directly through the TTS engine, bypassing the model — ESC stops playback
Y / N: approve or skip a diff preview modal when the model proposes an edit
/voice: list all available TTS voices with numbers
/voice N or /voice <id>: select a voice by number or ID — saves to .hematite/settings.json and takes effect immediately
/attach <path>: attach a PDF, markdown, or text file as context for the next message then clear
/image <path>: attach an image for the next message — passed to the model via the vision path
/detach: drop any pending document or image attachment without sending
/copy: copy the session transcript manually
/clear: clear visible dialogue and side-panel session state
/forget: purge saved conversation memory and wipe visible session state
/new: reset session history while keeping project memory
/compact: immediately compact history in place — summarizes older turns, frees context, preserves active task and working set; safer than /new because nothing is lost
/budget: show the context budget ledger for the last completed turn — total tokens consumed, per-tool result costs, prior history size, and context fill percentage; also appears automatically in the SPECULAR panel after every turn
/fix: run verify_build immediately, stream the current error, then load it as a focused FIX MODE intervention that fires on the next turn — the model sees only the error and is instructed to fix it before doing anything else; /fix --test targets tests instead of build
/cd <path>: teleport to any directory — opens a fresh Hematite session there and closes this one. Supports bare tokens like downloads, desktop, docs, pictures, videos, music, home, temp, bare ~, aliases like @DESKTOP/project, .., and absolute paths. If you want a numbered picker, run /ls desktop first and then /ls <N>.
/ls: show a numbered navigation map — common OS locations + subdirectories of the current directory. Type /ls <N> to teleport directly to entry N. /ls <path> lists subdirectories of any path.
/ask [prompt]: sticky read-only analysis mode
/code [prompt]: sticky implementation mode
/architect [prompt]: sticky plan-first mode that persists a reusable handoff
/implement-plan: execute the saved architect handoff in /code
/read-only [prompt]: sticky hard no-mutation mode
/teach [prompt]: sticky teacher mode — inspects real machine state first, then delivers a grounded numbered walkthrough for any admin/config/system task; does not execute write operations itself
/auto: return to the narrowest-effective workflow mode
/chat [prompt]: sticky conversational mode — lighter prompt, no coding scaffolding, tools still available
/agent: alias for returning to the full coding agent mode from chat
/think [prompt]: enable extended reasoning (thinking tokens) for the next turn or sticky
/no_think [prompt]: disable thinking tokens — faster, lower token cost
/gemma-native: toggle Gemma 4 native tool markup on/off manually (auto-detected by default)
/swarm: trigger parallel worker agents
/worktree [branch]: create or switch to a git worktree for isolated branch work
/lsp: show LSP server status and active language server diagnostics
/reroll: hatch a new companion soul mid-session (soul/personality reroll)
/rules [view|edit]: view status, inspect content, or edit project guidelines (.hematite/rules.md)
/provider [status|lmstudio|ollama|clear|URL]: show the active provider/session endpoint, reachable alternatives, or save a workspace provider override to .hematite/settings.json
/runtime: show the configured provider, live session provider/endpoint, coding model, embedding state, reachable alternatives, and shortest fix path
/runtime fix: run the shortest safe runtime recovery step without silently changing provider settings
/runtime-refresh: force a resync of the active provider model profile and context window size
/triage [preset]: run zero-latency deterministic IT triage (e.g. /triage network, /triage security)
/health: run zero-latency diagnostic health check
/fix : generate a deterministic fix plan for a specific system issue
/inspect : run a specific diagnostic topic from the 128+ available (e.g. /inspect storage)
/query : natural-language query routed to the right inspect_host topics and run without a model (e.g. /query why is my PC slow)
/inventory: show the full list of 128+ available diagnostic topics
/help: show categorized TUI help (IT, Agent, Navigation, etc.)
/model [status|list [available|loaded]|load <id> [--ctx N]|unload [id|current|all]|prefer <id>|clear]: inspect, list, load, unload, or save the preferred coding model from inside Hematite (--ctx uses LM Studio context length or Ollama num_ctx)
/embed [status|load <id>|unload [id|current]|prefer <id>|clear]: inspect, load, unload, or save the preferred embedding model for semantic search
Bottom status badges now include RT:* for the primary runtime issue: MOD (no model), NET (provider/connectivity), EMP (empty replies), CTX (context ceiling), or WAIT (boot/recovery)
/vein-inspect: inspect indexed Vein memory, hot files, and active room bias
/vein-reset: wipe the Vein index and rebuild from scratch on the next turn
/workspace-profile: inspect the auto-generated workspace profile
/rules: show which behavioral rule files exist and their load status
/rules view: display combined content of all active rule files (CLAUDE.md, SKILLS.md, .hematite/rules.md, etc.)
/rules edit: open .hematite/rules.local.md in the system editor (private, gitignored)
/rules edit shared: open .hematite/rules.md in the system editor (shared, committed with the repo)
/skills: show the discovered Agent Skills catalog from .agents/skills/ and .hematite/skills/
/skill <name>: explicitly load a named skill's full body into the system prompt for the next turn — shows available skills on name mismatch
/skill new <name>: scaffold a new skill directory with a SKILL.md template at .agents/skills/<name>/
/task: show the current task list
/task add <text>: add a task to the persistent task list — injected into the system prompt every turn so the model always knows what's pending
/task done <N>: mark task N complete
/task remove <N>: remove task N from the list
/task clear: wipe all tasks
Task list persists across /new (context resets) but is cleared by /forget (full wipe)
Rule files are injected into the system prompt every turn automatically — no restart needed after editing
.hematite/instructions/: drop any <topic>.md file here for topic-scoped rules that only inject when the turn context mentions that topic name (e.g. authentication.md injects only when the user's message references authentication)
SKILLS.md / SKILL.md: optional root-level workspace guidance files for project conventions, domain recipes, and repo-specific operating patterns; they are additive to the built-in workflow engine, not a replacement for .hematite/PLAN.md or .hematite/TASK.md
.agents/skills/ / .hematite/skills/: directory-based Agent Skills. Each skill lives in its own folder with a SKILL.md file plus optional scripts/, references/, and assets/; skills auto-activate when their name appears in the query or their triggers patterns match files being discussed
AGENTS.md / agents.md: Codex CLI / Gemini CLI compatible instruction files — read automatically alongside CLAUDE.md and HEMATITE.md
/diff: show a diff of the last file edit made this session
/undo: undo the last file edit by restoring from the ghost backup
/health: run a quick workstation health check via inspect_host(topic: "health_report")
/diagnose: staged triage (TUI) — harness runs health_report first, identifies which areas are flagged (disk, RAM, event log errors, security, etc.), then hands the agent a pre-built instruction naming exactly which topics to investigate; agent synthesizes a grounded numbered fix plan from real tool output; skips dev-environment "not installed" warnings (those are not system health issues)
/export: generate a self-contained diagnostic report covering System Health, Hardware, Storage, Network, Security, and Toolchains — includes a health score (A–F) and action plan at the top — saves to .hematite/reports/health-YYYY-MM-DD_HH-MM.<ext> and copies the path to clipboard; /export json for JSON, /export html for a double-clickable self-contained HTML file anyone can open in a browser
/explain [prompt]: explain the current file or selection in plain English
/version: show the running Hematite release version plus build state
/about: show author, repo, and product info
hematite --version: print the same build report from the CLI
hematite --report: headless diagnostic report to stdout — includes health score (A–F) and action plan at the top, then raw section data; no TUI, pipeable: hematite --report > health.md; --report-format json for JSON, --report-format html for a self-contained HTML file; add --open to save and launch the file immediately
hematite --triage: IT-first-look — no TUI, no model required; runs five fixed checks in one pass: health_report, security, connectivity, identity_auth, updates; applies fix recipes to the combined output; saves to .hematite/reports/triage-DATE.md and prints the path; add --open to launch immediately; --report-format html saves a double-clickable HTML file (triage-DATE.html). The "sit-down command" for IT techs — covers OS health, security posture, internet reachability, M365 identity state, and pending updates in under a minute with no model loaded.
hematite --triage <preset>: named triage presets — same flags as plain --triage but focused on a specific domain. Presets: network (connectivity, wi-fi, latency, DNS, VPN, proxy, active connections), security (security posture, BitLocker, TPM, local policy, SMB shares, Print Spooler), performance (resource load, thermal, CPU power, top processes, page file, startup items), storage (storage, disk health, shadow copies, Storage Spaces, BitLocker), apps (browser health, Outlook, Teams, installer health, OneDrive). Examples: hematite --triage network --report-format html --open, hematite --triage performance
hematite --fix "<issue>": targeted fix plan — no model required; describe the problem in plain English and Hematite keyword-matches it to the right inspect_host topics, runs them, filters fix recipes against the real output, and saves a step-by-step fix plan to .hematite/reports/fix-DATE.md. Add --report-format html --open for a double-clickable HTML report. Examples: hematite --fix "PC running slow", hematite --fix "can't connect to internet" --report-format html --open, hematite --fix "BSOD after update". Routes 48 issue categories via pure keyword matching to the right inspect_host topics — no model, no cloud, no LM Studio required. Coverage includes: performance, network, disk, crashes, updates, security, audio, bluetooth, camera, Teams, Outlook, browser, sign-in, USB devices, display, overheating, RAM, BitLocker, domain/GPO, Hyper-V, WSL, Docker, SSH, git, Python/Node toolchains, and more.
hematite --fix "<issue>" --execute: after generating the fix plan, offer to run safe auto-fixes (DNS flush, service restarts, clock sync, etc.) immediately. Prompts Y/n before applying.
hematite --fix "<issue>" --execute --yes: same as --execute but skips the Y/n prompt — applies auto-fixes immediately. Use in scripts and scheduled tasks.
hematite --fix "<issue>" --execute --report-format json: apply safe auto-fixes automatically (no Y/n prompt) and emit a structured JSON result: {"issue": "...", "fixes_applied": [{"label", "status", "verified_resolved"}]}. Designed for CI pipelines and automation consumers.
hematite --fix "<issue>" --dry-run: preview which inspect_host topics would be inspected for a given issue without running any checks. Useful for confirming routing before committing to the full run.
hematite --diagnose: headless staged triage — no TUI, no model required; runs health_report, triages which topics need deeper investigation, runs targeted follow-up inspections, saves a self-contained fix plan to .hematite/reports/diagnosis-DATE.md and prints the path; add --open to launch the file immediately after saving; --report-format html saves a double-clickable self-contained HTML file instead (diagnosis-DATE.html)
hematite --diagnose --dry-run: preview the 6 phase-1 topics and the dynamic phase-2 logic without running any checks.
hematite --triage --dry-run / hematite --triage <preset> --dry-run: preview which topics a triage run would inspect without executing. Useful before scheduling or scripting.
hematite --fix-all: maintenance sweep — checks every safe auto-fix topic, skips what is healthy, runs what needs fixing, and verifies each fix resolved. No model required. Saves a sweep report to .hematite/reports/sweep-DATE.md.
hematite --fix-all --only "<label>": run a single named fix from the sweep instead of all. Example: hematite --fix-all --only "Flush DNS Cache". Use --fix-all --only list to print all available fix labels.
hematite --fix-all --dry-run: preview what the sweep would run (with --only filter applied) without executing any fix commands.
hematite --fix-all --quiet: suppress all output when the sweep finds nothing to fix (exit 0). Prints only on unresolved issues (exit 1). Designed for Windows Task Scheduler silent runs.
hematite --fix-all --schedule [CADENCE]: register a Windows Task Scheduler task for the sweep. CADENCE: weekly (Sunday 03:00, default), daily (03:00), remove, status. Combine with --fix-all to schedule the maintenance sweep; combine with --triage to schedule the IT triage instead. Example: hematite --fix-all --schedule weekly.
hematite --inventory: lists all 128+ available inspect_host topics categorized by domain. No model, no TUI. Pipe to grep to find a topic. Add --report-format json for a structured machine-readable catalog.
hematite --inspect <topic[,topic2,...]>: runs any inspect_host topic directly to stdout. No model, no TUI. Comma-separate for multi-topic runs. Add --open to save and launch the output file. Add --report-format json for structured JSON output. Example: hematite --inspect wifi,latency,dns_cache
hematite --inspect <topic> --snapshot <name>: saves inspect output to .hematite/snapshots/<name>.txt instead of printing, for later use with --diff --from. Example: hematite --inspect thermal --snapshot before-update
hematite --query "<text>": natural-language query routed to the right inspect_host topics via keyword detection. No model, no TUI. Add --report-format json for structured JSON. Example: hematite --query "why is my PC slow"
hematite --watch <topic[,topic2,...]>: continuously polls topic(s) every N seconds (default 5, --watch-interval N to override), clears the terminal between runs, timestamps each cycle. No model or internet required. Press Ctrl+C to stop. Example: hematite --watch resource_load,thermal --watch-interval 10
hematite --watch <topic> --count N: stop after N poll cycles instead of running until Ctrl+C. Example: hematite --watch resource_load --count 5
hematite --watch <topic> --alert <pattern>: alert mode — silent heartbeat when output does not contain the pattern; rings bell and prints full output when it does. Case-insensitive. Add --notify to fire a Windows toast on match. Example: hematite --watch thermal --alert throttl
hematite --watch <topic> --report-format json: NDJSON streaming — emits one JSON line per cycle: {"timestamp","cycle","topics","alert_matched","output"}. Pipe to jq or another JSON consumer.
hematite --watch <topic> --output <file>: append each cycle's output to a log file instead of only printing to terminal. In JSON mode, appends NDJSON lines; in plain-text mode, appends timestamped cycle blocks. Example: hematite --watch resource_load --output logs/resource.ndjson --report-format json
hematite --diff <topic[,topic2,...]>: takes two snapshots separated by --diff-after seconds (default 30) and shows a colored unified diff. Add --report-format json for a structured JSON diff with before, after, diff_lines, and changed fields. Example: hematite --diff processes --diff-after 60
hematite --diff <topic> --from <name>: loads snapshot A from .hematite/snapshots/<name>.txt instead of running a live capture, then diffs against a fresh live run. Snapshot age is shown in the diff header. Example: hematite --diff thermal --from before-update
hematite --compare <name1>,<name2>: diff two saved snapshots against each other without a live run. Add --report-format json for a structured diff with snapshot_a, snapshot_b, changed, diff_lines, before, and after fields. Example: hematite --compare before-update,after-update
hematite --snapshots: lists all saved snapshots in .hematite/snapshots/ with name, size, and age. Add --report-format json for a structured listing with name, size_bytes, and age_secs fields. Example: hematite --snapshots
hematite --audit-start <name>: start a change audit session — takes a baseline snapshot of key system topics (services, startup_items, ports, scheduled_tasks, shares, firewall_rules, processes, connections). Saves to .hematite/snapshots/<name>_before.txt. Use --audit-topics <topics> to override the default topic set. Example: hematite --audit-start pre-patch
hematite --audit-end <name>: end a change audit session — re-runs the baseline topics, diffs against the saved baseline, and saves a report to .hematite/reports/audit-<name>-DATE.md. Add --report-format html --open for a browser-ready report. Example: hematite --audit-end pre-patch --report-format html --open
hematite --alert-rule-add <TOPIC:PATTERN>: add a persistent alert rule. Format: TOPIC:PATTERN where TOPIC is any inspect_host topic and PATTERN is a case-insensitive substring to match in the output. Add --alert-rule-label "Name" to give it a human-readable name. Add --alert-rule-negate to fire when the pattern is ABSENT (e.g. detect when antivirus stops running). Example: hematite --alert-rule-add thermal:throttl --alert-rule-label "CPU Throttling"
hematite --alert-rules: list all saved alert rules with ID, label, topic, pattern, and negate flag.
hematite --alert-rule-remove <ID>: remove an alert rule by its ID.
hematite --alert-rule-run: evaluate all saved alert rules against live machine data and fire a Windows toast notification for every match. Add --schedule hourly or --schedule daily to register a Task Scheduler task for automated evaluation. Example: hematite --alert-rule-run --schedule hourly
hematite --timeline-capture: take today's machine state snapshot (health_report, startup_items, ports, services) and append it to the timeline index. Skips if today's entry already exists (idempotent — safe to run daily). Add --schedule daily to register a Windows Task Scheduler task that captures automatically at 03:00. Add --yes to overwrite an existing entry. Example: hematite --timeline-capture --schedule daily
hematite --timeline: show the full machine state timeline — all captured daily entries with date, health grade (A–F), and summary. Answers "when did this start?" for any system health question.
hematite --timeline-diff <DATE>: diff a timeline entry against its previous entry — shows exactly what changed on that day. Use DATE1,DATE2 to diff any two specific dates. Example: hematite --timeline-diff 2025-05-10 or hematite --timeline-diff 2025-05-08,2025-05-10
hematite --timeline-trend: ASCII health grade trend chart from all captured timeline entries — colored bar chart (A=green █████████████████████████████ to F=red ██████), Unicode sparkline (█▆▄▂▁), worst/best/latest grade summary, and trajectory analysis (↑ improving / ↓ degraded / → stable) with a recent-7-entry trend. Answers "is my machine getting worse over time?" at a glance.
hematite --diagnose-why "<symptom>": symptom-driven cross-topic root-cause diagnosis — describe the problem in plain English (e.g. "PC is slow and freezing", "blue screen", "no internet"). Keyword-matches the symptom to a curated topic group (25 categories), runs all relevant inspect_host topics, applies fix-recipe matching to the combined output, and returns ranked probable causes with evidence excerpts and fix steps. No model required. Saves to .hematite/reports/diagnose-why-DATE.md. Supports --report-format html --open. Routes categories: Performance/Sluggishness, Crash/BSOD, No Internet, Slow Internet, Slow Boot, Overheating, No Sound, Printing, High Disk, Updates Failing, Sign-In, Malware, Low Memory, Battery, Display, Hardware Error, Network Share, Microsoft Teams, Outlook/Email, Bluetooth, Camera/Webcam, USB/Device, Sleep/Wake, App/Program Crashing. Examples: hematite --diagnose-why "my PC is slow", hematite --diagnose-why "blue screen" --report-format html --open
--field <pattern>: with --inspect, --query, --watch, --diff, and --compare — filter output to only lines containing PATTERN. Case-insensitive. Example: hematite --watch resource_load --field cpu
--output <path>: save report output to an explicit file path instead of the auto-dated .hematite/reports/ directory. Works with --triage, --diagnose, --fix, --fix-all, --inspect, --query, --diff, --snapshots, --inventory, and --report. Example: hematite --inspect wifi --output /tmp/wifi.txt
--clipboard: copy output to clipboard after the command completes. Works with --triage, --diagnose, --fix, --fix-all, --inspect, --query, --report, and --watch (json mode). Example: hematite --triage --clipboard
--notify: show a native Windows desktop toast notification when the command finishes. On --watch --alert pattern match, fires instead of only ringing the bell. Works on Windows 10/11 only. Example: hematite --fix-all --notify
--quiet: suppress output when the result is healthy (exit 0). Only prints when issues are found (exit 1). Works with --triage, --diagnose, --fix, and --fix-all. Designed for cron jobs and scheduled tasks that should be silent on success.
--open: works with --report, --diagnose, --triage, --fix, --fix-all, and --inspect — saves the output file and opens it in the default application (browser for HTML, editor for Markdown). hematite --diagnose --report-format html --open is the one-shot USB-drive path: runs full staged triage, saves an HTML report, and opens it in the browser immediately.
hematite --fix-all --only list --report-format json: emit the sweep fix catalog as a JSON array of {label, verify_topic, verify_gone} objects for CI enumeration. Supports --output to write the list to a file.
hematite --fix-all --report-format json: run the maintenance sweep and emit structured JSON execution results: {"generated", "host", "hematite_version", "checks_run", "applied", "verified", "unresolved", "summary", "checks": [{label, status}]}. Status values: healthy (skipped — already OK), fixed (applied and verified), done (applied, no verify), unresolved (applied but issue persists), failed (command error). Saves to .hematite/reports/sweep-DATE.json.
--report-format <fmt>: output format for all report commands. md (default), json, or html. JSON produces structured output with health grade, action items, and per-section data. All headless commands (--triage, --diagnose, --fix, --fix-all, --report, --inspect, --query, --diff, --compare, --snapshots, --inventory) support JSON format for scripting and CI integration. --fix --execute --report-format json emits {"issue", "fixes_applied": [{label, status, verified_resolved}]} without a Y/n prompt.
HTML report UX: all HTML outputs use the dark-theme template from src/agent/html_template.rs — consistent look across all saved pages; includes a "Copy report for AI" button that copies the full action plan + diagnostic data as plain text so the user can paste directly into Claude or ChatGPT without manual text selection; fix recipe hints use plain English (Run hematite --diagnose for a deeper investigation) not internal tool references
Shared HTML template: src/agent/html_template.rs owns the CSS, JS, and build_html_shell(title, version, content_html) function — any feature that saves an HTML file should call this instead of building its own document from scratch; he() HTML escaping and markdown_to_html() are also exported from here
/save-html [optional title]: saves the last Hematite response as a polished dark-theme HTML page — converts markdown to HTML, wraps in the shared template, saves to .hematite/reports/research-DATE.html, copies path to clipboard, and opens in the browser immediately; use after any research turn to keep a permanent shareable record
/copy: copy the session transcript manually
/copy-clean: copy the transcript with tool calls stripped — prose only
/copy-last: copy only the last assistant response
/clear: clear visible dialogue and side-panel session state
/cd <path>: teleport to any directory — opens a fresh Hematite session there and closes this one. Supports bare tokens like downloads, desktop, docs, pictures, videos, music, home, temp, bare ~, aliases like @DESKTOP/project, .., and absolute paths. If you want a numbered picker, run /ls desktop first and then /ls <N>.
/attach <path>: attach a PDF, markdown, or text file as context for the next message then clear
/attach-pick: open a file picker to select a document attachment
/image <path>: attach an image for the next message via the vision path
/image-pick: open a file picker to select an image attachment
/detach: drop any pending document or image attachment without sending

Requires a local OpenAI-compatible runtime running with a model loaded. LM Studio on port 1234 is the default path; Ollama on http://localhost:11434/v1 is also supported when api_url points there. If the configured provider is offline or reachable without a loaded coding model, Hematite should surface the shortest setup path and mention any reachable local alternative runtime it detects.

Practical rule: the version/build label is compile-time metadata. A new commit or tag does not change what the already-built binary reports. Rebuild the binary or rerun pwsh ./scripts/package-windows.ps1 -AddToPath if you want hematite --version, /version, and the startup banner to reflect the latest commit, tag, or dirty/clean state.

Attribution rule: authorship and identity questions should resolve from Hematite's fixed app metadata, not from model improvisation. /about is the operator-facing path, and prompts like who created you or who engineered Hematite should answer with Ocean Bennett as the creator and maintainer.

Package naming rule: the crates.io package is hematite-cli, but the executable name stays hematite. Keep that split so the package namespace is distinct while the operator command stays short.

Crates.io publish order: publish hematite-kokoros first, then publish hematite-cli. The main package depends on the forked voice crate by published package name while keeping the source-level crate path as kokoros.

Crates.io compatibility rule: the default published/source build does not embed the large Kokoro voice assets. Packaged releases and local packaging scripts must build with --features embedded-voice-assets so the shipped Windows/macOS/Linux bundles keep the baked-in voice engine.

Crates.io update rule: in normal use, almost every public tagged Hematite release should republish hematite-cli. Republish hematite-kokoros only when the vendored fork itself changes. Do not bump the voice fork just because the main app shipped a new release.

Host Inspection Priority: For all diagnostic questions (load, network, processes, log-checks), the agent MUST prefer inspect_host over raw shell.
Native Diagnostic Lane: For all hardware intensity, throughput, or disk benchmarking tasks, the agent MUST use inspect_host(topic: "disk_benchmark").
Auto-Fallback Robustness: If a requested target binary (e.g. .hematite/hematite.exe) is not found, the disk_benchmark tool will automatically pivot to benchmarking the current running executable. Do not fail if a path is missing—run the benchmark on the current binary to provide data.
Redirection Discipline: Common diagnostic commands and read-only metadata checks (e.g. arp -a, Get-Process, Get-Item, Test-Path, Select-Object) are silently redirected or whitelisted. These are safe operations.
Telemetry Whitelisting: get-counter, Get-Item, Test-Path, and Select-Object are whitelisted in guard.rs to reduce operator approval friction during system audits.
Harness Pre-Run: When the user asks about 2+ inspection topics in one message, Hematite executes all queries before the model turn begins. Results are injected into the conversation history as simulated turns (assistant calls + tool results). This ensures the model "sees" the data in the official transcript, which prevents redundant tool calls or orchestration loops.
Multi-Topic Rule: Never collapse multiple distinct topics into a single generic topic like "network". Each topic must be called separately. Example: "show route table, ARP, DNS cache, and traceroute" → four separate inspect_host calls (or one harness pre-run covering all four).
Storage Inspection: Use topic: "storage" for all-drives capacity with ASCII bar charts, developer cache directory sizing, and Real-time Disk Intensity (Average Disk Queue Length).
Deep Storage Analysis: Use topic: "storage_deep" (aliases: disk_deep, where_is_space) for a full storage breakdown — drive overview, top space consumers by directory (Downloads, Videos, Temp, browser caches, Teams cache, Docker, WSL VHD), developer artifact discovery (node_modules, target/, .venv, dist/, .next across common project roots), and per-entry fix commands. Routed automatically for queries like "where did my disk space go", "what's eating my storage", "find large files", "help me clean up my C drive". This is Hematite's TreeSize-equivalent but with AI-guided cleanup steps.
Hardware Inventory: Use topic: "hardware" for full hardware DNA — CPU model/cores/clock, RAM total/speed/sticks, GPU name/driver/resolution, motherboard/BIOS manufacturer/version, and Virtualization Health (Hypervisor status and SLAT/VT-x capability).
Session Audit: Use topic: "sessions" for active and disconnected user logon sessions.
Health Report: Use topic: "health_report" (or alias "system_health") for a tiered plain-English verdict (ALL GOOD / WORTH A LOOK / ACTION REQUIRED) across disk, RAM, tools, and recent error events.
Windows Update: Use topic: "updates" for last install date, pending update count, and Windows Update service state.
Security Status: Use topic: "security" for Defender real-time protection, last scan age, signature freshness, firewall profile states, Windows activation, and UAC state.
Pending Reboot: Use topic: "pending_reboot" to check if a restart is queued (Windows Update, CBS, file rename operations) and why.
Drive SMART Health: Use topic: "disk_health" for physical drive health via Get-PhysicalDisk and SMART failure prediction.
Battery: Use topic: "battery" for charge level, status, estimated runtime, and wear level — reports no battery gracefully on desktops.
Crash History: Use topic: "recent_crashes" for BSOD/unexpected shutdown events and application crash/hang events from the Windows event log.
Application Crashes: Use topic: "app_crashes" for detailed application crash and hang triage — faulting application name, version, faulting module, exception code, crash frequency, WER archive count. Accepts optional process arg to filter by app name (e.g. process: "chrome.exe"). Use recent_crashes for BSOD/kernel panics instead.
Device Health: Use topic: "device_health" for precision detection of malfunctioning hardware (PnP "Yellow Bangs") via ConfigManager error codes.
Drivers: Use topic: "drivers" for a comprehensive audit of active system drivers and their operational states.
Peripherals: Use topic: "peripherals" for a deep-dive into USB controllers, HID devices (Keyboard/Mouse), and connected monitors.
Scheduled Tasks: Use topic: "scheduled_tasks" for all non-disabled scheduled tasks with name, path, last run time, and executable.
Thermal Health: Use topic: "thermal" for real-time telemetry — CPU temp, thermal margins, ACPI fallback sensing, and active throttling indicators.
Windows Activation: Use topic: "activation" for license state, genuine status, and Product ID/Key metadata.
Patch History: Use topic: "patch_history" for Windows HotFix and KB update audit (last 48h focus).
Repo Doctor: Use topic: "repo_doctor" to inspect workspace health — git status, uncommitted changes, and build-file presence.
Disk Benchmark: Use topic: "disk_benchmark" for sequential read/write throughput and latency measurements.
Dev Conflicts: Use topic: "dev_conflicts" for cross-tool environment conflict detection — Node.js version managers, Python 2/3 ambiguity, conda shadowing, Rust toolchain path conflicts, Git identity/signing, and duplicate PATH entries.
Connectivity Check: Use topic: "connectivity" to test internet reachability and DNS resolution — reports REACHABLE/UNREACHABLE with DNS pass/fail and gateway/VPN context.
Wi-Fi Status: Use topic: "wifi" for wireless adapter state, SSID, signal strength (RSSI/quality), band, channel, and negotiated speed.
Active TCP Connections: Use topic: "connections" for active/established TCP connections — remote address, port, process name, and connection state.
VPN Status: Use topic: "vpn" to detect active VPN adapters, tunnel IPs, and any recognized VPN client services.
Proxy Settings: Use topic: "proxy" for WinHTTP system proxy, Internet Options proxy, and environment variable proxy config.
Firewall Rules: Use topic: "firewall_rules" for non-default enabled Windows Firewall rules — direction, action (Allow/Block), and profile.
BitLocker: Use topic: "bitlocker" for drive encryption status — BitLocker volume status, protection state (ON/OFF), and encryption percentage.
RDP Status: Use topic: "rdp" for Remote Desktop configuration — enabled state, port (default 3389), NLA requirements, firewall rule check, and active RDP sessions.
Shadow Copies: Use topic: "shadow_copies" for Volume Shadow Copies (VSS) — lists snapshot history, storage allocation, and recent system restore points.
Page File: Use topic: "pagefile" for virtual memory configuration — page file paths, allocated size, current usage, and peak usage relative to RAM.
Windows Features: Use topic: "windows_features" for enabled Windows optional features — lists all ON features and flags notable ones (IIS, Hyper-V, WSL).
Printers: Use topic: "printers" for installed printers — printer name, driver, port, status, and active print job queue.
WinRM: Use topic: "winrm" for Windows Remote Management — service state, listeners, PS Remoting status (WS-Man test), and TrustedHosts list.
Network Stats: Use topic: "network_stats" for adapter-level throughput analytics — TX/RX bytes (MB), packet errors, and discarded/dropped packets since boot.
UDP Listeners: Use topic: "udp_ports" for active UDP listeners — local address, port, PID, process name, and annotations for well-known ports (DNS, DHCP, NTP).
Group Policy (GPO): Use topic: "gpo" for applied Group Policy Objects — shows applied computer-scope GPOs and filtering status. Requires Administrator elevation on Windows.
Certificates: Use topic: "certificates" for local personal certificates — lists subjects, thumbprints, and expiry dates (flags those expiring within 30 days).
Integrity: Use topic: "integrity" for Windows component store health — checks SFC/DISM status (Corrupt/AutoRepairNeeded) via registry and log visibility.
Share Access: Use topic: "share_access" for readability and connectivity testing for specific network shares and UNC paths.
Directory Audit: Use topic: "directory", "desktop", or "downloads" for directory listing and file metadata.
Traceroute: Use topic: "traceroute" to trace the network path to a host (default 8.8.8.8). Accepts optional host arg. Uses tracert on Windows, traceroute/tracepath on Linux/macOS.
DNS Cache: Use topic: "dns_cache" to inspect locally cached DNS entries — hostname, record type, resolved address, and TTL.
ARP Table: Use topic: "arp" for the ARP neighbor table — IP-to-MAC mappings for devices on the local network.
Route Table: Use topic: "route_table" for the system routing table — destination prefixes, next hops, metrics, and interface names.
Heuristic Command Sanitizer: Hematite enforces a hard gate that blocks tool calls containing natural language sentences in command arguments. Never pass conversational "overthinking" into shell tools; use surgical, machine-readable commands only.
Proactive Research Priority: When answering technical questions about API versions, library changes, or news since 2024, the agent MUST prefer research_web over internal knowledge. Verifying technical uncertainty is a core behavioral requirement.
Environment Variables: Use topic: "env" to inspect environment variables — shows developer/tool vars (CARGO_HOME, JAVA_HOME, GOPATH, etc.) and redacts secret-shaped values (KEY, TOKEN, PASSWORD) to presence-only.
Hosts File: Use topic: "hosts_file" to read /etc/hosts (Windows: drivers\etc\hosts) — active entries, custom non-loopback entries flagged, full file content shown.
Docker: Use topic: "docker" for Docker daemon state, running containers, local images, Compose projects, and active context. Reports gracefully if Docker is not installed or daemon is not running.
Docker Filesystems: Use topic: "docker_filesystems" for bind mounts, named volumes, per-container mount summaries, and Docker Desktop disk-image growth. Output is shaped as finding -> impact -> fix.
WSL: Use topic: "wsl" for Windows Subsystem for Linux — installed distros, running state, WSL version. Windows-only; reports gracefully on Linux/macOS.
WSL Filesystems: Use topic: "wsl_filesystems" for WSL rootfs usage, host-side ext4.vhdx growth, and /mnt/c bridge health without starting stopped distros.
LAN Discovery: Use topic: "lan_discovery" for neighborhood, NAS/printer visibility, NetBIOS/SMB browse evidence, mDNS/SSDP/UPnP listener surface, gateway/device-discovery hints, and a plain-English diagnosis path for discovery failures.
Audio: Use topic: "audio" for Windows Audio service health, playback and recording endpoint inventory, speaker and microphone path triage, and Bluetooth-audio crossover.
Bluetooth: Use topic: "bluetooth" for radio presence, Bluetooth service health, paired-device inventory, reconnect and pairing issues, and headset-role diagnostics.
Camera: Use topic: "camera" for PnP camera/webcam device inventory, Windows camera privacy registry state, Windows Hello biometric camera detection, and plain-English diagnosis for "camera not working / blocked by privacy settings".
Sign-In / Windows Hello: Use topic: "sign_in" for Windows Hello and biometric service state (WBioSrvc), recent logon failure events (EventID 4625), enrolled credential providers, and plain-English diagnosis for "PIN/fingerprint not working / can't sign in".
Installer Health: Use topic: "installer_health" for Windows Installer (msiserver), AppX/Store install services, winget/Desktop App Installer presence, Microsoft Store package health, reboot or in-progress installer blockers, and recent MSI/AppX failure evidence.
OneDrive: Use topic: "onedrive" for client install/running state, configured accounts, sync-root existence, policy blockers, and Known Folder Backup/Desktop/Documents/Pictures redirection state.
Browser Health: Use topic: "browser_health" for Edge/Chrome/Firefox inventory, default browser and protocol associations, WebView2 runtime health, browser proxy/policy overrides, profile/cache pressure, and recent browser crash evidence.
Identity Auth: Use topic: "identity_auth" for Microsoft 365 token-broker and Web Account Manager health, AAD Broker Plugin presence, dsregcmd device registration state, Office/Teams/OneDrive account mismatch clues, WebView2 auth dependency state, and recent auth-related events.
Outlook: Use topic: "outlook" for classic Outlook and new Outlook for Windows install inventory, running process state and RAM usage, mail profile count, OST and PST file discovery with sizes, add-in inventory with load behavior and resiliency-disabled items, authentication and token broker cache state, and recent Outlook crash evidence from the Application event log.
Teams: Use topic: "teams" for classic Teams and new Teams (MSTeams MSIX) install inventory, running process state and RAM usage, cache directory sizing (the #1 Teams fix), WebView2 runtime dependency check, account and sign-in state from registry, audio/video device binding from config files, and recent Teams crash evidence from the Application event log.
Windows Backup: Use topic: "windows_backup" for File History service state and last backup date/target drive, Windows Backup (wbadmin) last successful backup and scheduled tasks, System Restore enabled state and most recent restore point, OneDrive Known Folder Move per-account protection state, and recent backup failure events from the Application event log.
Event Query: Use topic: "event_query" for targeted Windows Event Log filtering by Event ID, source/provider, log name, severity level, and time window. Supports prompts like "System errors in the last 4 hours", Event ID 4625 failed-logon review, 7034 service crash search, and 41 unexpected-shutdown triage.
Search Index: Use topic: "search_index" for Windows Search (WSearch) service state, indexer registry configuration, indexed locations, recent indexer errors, and plain-English diagnosis for "search not finding files / indexer stopped".
Display Config: Use topic: "display_config" for active monitor resolution, refresh rate, DPI/scaling, video adapter driver version, and connected monitor names — answers "what refresh rate / how many monitors / is my DPI correct".
NTP / Time Sync: Use topic: "ntp" for Windows Time service (W32Time) health, NTP source and last sync via w32tm, configured NTP peers, and plain-English diagnosis for clock drift or sync failure.
CPU Power: Use topic: "cpu_power" for active power plan, processor min/max state, turbo boost mode, current CPU clock and load, thermal zone temperatures, and diagnosis for "CPU stuck slow / boost disabled / power plan capping frequency".
Credentials: Use topic: "credentials" for Windows Credential Manager vault summary, credential target inventory, type counts, and hygiene warnings without ever exposing secret values.
TPM / Secure Boot: Use topic: "tpm" for TPM presence/readiness/spec version, Secure Boot state, firmware mode (UEFI vs legacy BIOS), and plain-English diagnosis for Windows 11 or BitLocker security posture.
SSH: Use topic: "ssh" for SSH client version, sshd service state, ~/.ssh directory inventory (known_hosts count, authorized_keys count, private key files), and ~/.ssh/config host entries.
Installed Software: Use topic: "installed_software" for installed programs — winget list on Windows (registry fallback), dpkg/rpm/pacman on Linux, brew + mas on macOS.
Git Config: Use topic: "git_config" for global git configuration audit — user identity, core settings, signing config, push/pull defaults, credential helper, branch defaults, local repo config, and git aliases.
Databases: Use topic: "databases" to detect running local database engines — PostgreSQL, MySQL/MariaDB, MongoDB, Redis, SQLite, SQL Server, CouchDB, Cassandra, Elasticsearch — via CLI version check, TCP port probe, and OS service state. No credentials required.
Overclocker Telemetry: Use topic: "overclocker" for precision silicon performance — NVIDIA clocks, fans, board power and power-cap context (W), explicit GPU-voltage availability reporting, firmware-reported CPU voltage when WMI exposes it, root-cause throttle decoding (Power vs Thermal), and session history trends (Temp/Clock drift anomalies).
Hyper-V: Use topic: "hyperv" for Hyper-V role state (VMMS service, feature installed), VM inventory (name, state, CPU%, RAM, uptime), VM network switches (External/Internal/Private with bound NIC), VM checkpoint listing (flags excessive checkpoints), and host RAM overcommit detection. Reports gracefully if Hyper-V is not installed.
MDM / Intune Enrollment: Use topic: "mdm_enrollment" for Intune/MDM enrollment state — dsregcmd AAD and MDM join flags, registry enrollment accounts (UPN, enrollment type, server URL), Intune Management Extension service health, recent MDM event log errors, and plain-English findings for enrolled/unenrolled/stalled states. Enterprise support lane for managed Windows fleets and Autopilot deployments.
Storage Spaces / Windows RAID: Use topic: "storage_spaces" for Windows Storage Spaces pool inventory — pool name, health, operational status, resiliency tier (Simple/Mirror/Parity), virtual disk health, physical disk member count and media type. Linux fallback reads /proc/mdstat and lvs for software RAID and LVM. Reports gracefully if no pools exist.
Defender Quarantine / Threat History: Use topic: "defender_quarantine" for Windows Defender threat detection history — threat name, severity, action taken (Quarantine/Remove/Allow), detection timestamp, affected path, and current remediation status. Also includes recent real-time protection and scan activity from Get-MpComputerStatus. Linux fallback checks ClamAV quarantine log.
Domain Health / DC Connectivity: Use topic: "domain_health" for domain controller discovery (nltest /dsgetdc), LDAP/LDAPS/Kerberos/GC port tests to the DC, dsregcmd AAD and domain join state, and GPO last machine refresh time. Use this for "can my machine reach its DC?", "are LDAP ports open?", "is Kerberos working?", and GPO refresh triage. Distinct from domain (basic join status) — domain_health actively tests DC reachability.
Service Dependencies: Use topic: "service_dependencies" for the service dependency graph — which services require which other services to run, and which services will break if you stop a given one. Essential for restart cascade planning. Linux fallback uses systemctl list-dependencies.
WMI Health: Use topic: "wmi_health" for WMI repository integrity — queries Win32_OperatingSystem as a live test, runs winmgmt /verifyrepository, checks the winmgmt service state, and reports repository size. Includes recovery steps if corrupt. WMI corruption causes cascading failures across many tools and is a classic hidden root cause on Windows.
Local Security Policy: Use topic: "local_security_policy" for local account and password policy (net accounts — minimum/maximum age, lockout threshold, observation window), LAN Manager / NTLM authentication level (LmCompatibilityLevel — flags if below 3), and UAC enabled state and admin prompt behavior. Useful for security baseline audits and compliance checks.
USB Device History: Use topic: "usb_history" for USB storage device connection history from the USBSTOR registry key — lists unique device friendly names of all USB storage devices ever connected to this machine. Useful for security/forensics audits. Requires elevation for full history. Linux fallback queries journalctl for USB kernel events.
Print Spooler / PrintNightmare: Use topic: "print_spooler" for Print Spooler service state, PrintNightmare (CVE-2021-34527) hardening check (RpcAuthnLevelPrivacyEnabled and Point and Print driver installation policy), and pending print queue. Flags unmitigated PrintNightmare configurations. Linux fallback checks CUPS via lpstat.
User Accounts: Use topic: "user_accounts" for local user accounts (name, enabled state, last logon, password required), Administrators group members, active logon sessions, and whether the current process is running elevated.
Audit Policy: Use topic: "audit_policy" for Windows audit policy (auditpol /get /category:*) — shows which event categories are logging Success/Failure. Flags if no categories are enabled. Requires Administrator elevation on Windows; falls back to auditd on Linux.
Shares: Use topic: "shares" for SMB shares this machine is exposing (flags custom non-admin shares), SMB server security settings (SMB1/SMB2 state, signing required, encryption), and mapped network drives. Warns if SMB1 is enabled.
DNS Servers: Use topic: "dns_servers" for the DNS resolvers configured per network adapter (not cache — the actual configured nameservers), annotated with well-known providers (Google, Cloudflare, Quad9, OpenDNS), DoH configuration, and DNS search suffix list.
Latency: Use topic: "latency" for ping RTT (min/avg/max) and packet loss to the default gateway, Cloudflare DNS (1.1.1.1), and Google DNS (8.8.8.8) — findings for unreachable targets, high packet loss (≥25%), and elevated average RTT (>150ms).
Network Adapter: Use topic: "network_adapter" for NIC inventory (link speed, MAC, driver version), offload settings (LSO/RSS/TCP checksum offload/jumbo frames) per adapter, error and discard counters, and wake-on-LAN / power management state; findings for adapter errors and half-duplex mismatches.
DHCP Lease: Use topic: "dhcp" for DHCP lease details per adapter — server IP, lease obtained time, lease expires time, subnet mask, DNS servers assigned by DHCP; findings for expired or imminently-expiring leases.
MTU: Use topic: "mtu" for per-adapter IPv4/IPv6 MTU and path MTU discovery (DF-bit ping test to 8.8.8.8 at 1472/1400/1280/576 bytes); findings for restricted MTU, VPN fragmentation issues, or ICMP-blocked paths.
IPv6: Use topic: "ipv6" for per-adapter IPv6 addresses (global/link-local/ULA) with prefix origin (SLAAC/DHCPv6/static), IPv6 default gateway, DHCPv6 lease assignments, privacy extension state (RFC 4941), and tunnel adapter inventory (Teredo/6to4/ISATAP); findings for no global address or missing IPv6 gateway.
TCP Parameters: Use topic: "tcp_params" for TCP autotuning level, congestion provider (CUBIC/NewReno), initial congestion window, scaling heuristics, dynamic port range, chimney offload state, and ECN capability; findings for disabled autotuning or non-standard congestion provider.
WLAN Profiles: Use topic: "wlan_profiles" for saved wireless profiles with authentication type (WPA2/WPA3/WEP/Open), cipher, connection mode, and auto-connect state; currently connected SSID, BSSID, signal, and radio type; findings for profiles using weak/open authentication.
IPSec: Use topic: "ipsec" for enabled IPSec connection security rules, active main-mode and quick-mode SAs with local/remote address pairs, IKE Policy Agent service state; findings for active tunnels.
NetBIOS: Use topic: "netbios" for NetBIOS over TCP/IP state per adapter (enabled/disabled/DHCP), WINS server configuration, nbtstat registered names and active NetBIOS sessions; findings for enabled NetBIOS and configured WINS servers.
NIC Teaming: Use topic: "nic_teaming" for LBFO team inventory (mode, load-balancing algorithm, status), team member operational state; findings for degraded teams or inactive members.
SNMP: Use topic: "snmp" for Windows SNMP agent service state, community string presence audit (values redacted), permitted manager list, SNMP Trap service state; findings flag running agents and the 'public' community string as a risk.
Port Test: Use topic: "port_test" with host and port args to test TCP port reachability — returns OPEN/CLOSED/FILTERED with ICMP result, source address, and interface. Example: inspect_host(topic: "port_test", host: "192.168.1.1", port: 443).
Network Profile: Use topic: "network_profile" for Windows network location profile per interface (Public/Private/DomainAuthenticated), IPv4/IPv6 connectivity state; findings flag Public-category interfaces.
DNS Lookup: Use topic: "dns_lookup" with a required name arg for active DNS resolution of a specific hostname — returns A, AAAA, MX, TXT, SRV, or any record type; use type arg to specify (default: A). Example: inspect_host(topic: "dns_lookup", name: "example.com", type: "A").
IP Config: Use topic: "ip_config" for full adapter IP detail equivalent to ipconfig /all — DHCP enabled state, IP addresses, gateway, DNS servers per adapter; useful when you need a complete adapter inventory without DHCP lease timing.
Summary: Use topic: "summary" (the default when no topic is given) for a general host overview — OS, hostname, uptime, CPU/RAM snapshot, disk health flag, and active network adapters.
Toolchains: Use topic: "toolchains" for installed developer tools — detects Rust, Node, Python, Go, Java, Docker, Git, and other common toolchain binaries with versions.
Prompt Synchronicity Rule: Any addition of an inspect_host topic or a new tool MUST be reflected in src/agent/prompt.rs and the CAPABILITIES.md competency matrix. This ensures the agent uses high-precision tools instead of falling back to raw shell.
Topic Registration: When adding a topic to host_inspect.rs, synchronize its keywords in routing.rs and its mandatory instruction in prompt.rs in the same PR.
Cross-Platform Parameter Integrity: When modifying shared tool signatures (especially in host_inspect.rs), ensure all parameters are either used on all platforms or explicitly silenced in non-target #[cfg] blocks using the let _ = param; pattern. This prevents "blindspot" build failures in CI (e.g., breaking Windows by renaming a parameter to satisfy a Unix warning).
PATH: Use topic: "path" for PATH entry analysis — lists all entries, flags duplicates, missing directories, and shadowed binaries.
Environment Doctor: Use topic: "env_doctor" for a full developer environment health check — PATH sanity, package manager conflicts, toolchain version mismatches, and missing expected tools.
Fix Plan: Use topic: "fix_plan" for a grounded, step-by-step remediation plan for a reported issue. Pass issue arg with the problem description; the harness inspects relevant machine state and returns an actionable numbered plan.
Network Overview: Use topic: "network" for a general network snapshot — adapter list, IP addresses, default gateway, and active connection count.
Processes: Use topic: "processes" for running processes ranked by CPU/RAM with PID, name, memory MB, CPU %, and real-time I/O R/W operation counts.
Services: Use topic: "services" for Windows/Linux service states — name, status (Running/Stopped), startup type, and description.
Ports: Use topic: "ports" for listening TCP/UDP ports — local address, port number, owning process name and PID.
Log Check: Use topic: "log_check" for recent system error/warning events from the Windows Event Log or journald — application and system log tails with severity.
Startup Items: Use topic: "startup_items" (aliases: startup, boot, autorun) for programs and scripts that run at login — registry run keys, startup folder entries, and scheduled task autorun items.
OS Config: Use topic: "os_config" for OS-level configuration — Windows edition, build, activation status, power plan, UAC level, and system locale.
Resource Load: Use topic: "resource_load" (aliases: performance, system_load) for live CPU and RAM utilization with top resource consumers by process.
Repo Doctor: Use topic: "repo_doctor" to inspect workspace health — git status, uncommitted changes, branch state, remote tracking, and basic build-file presence (Cargo.toml, package.json, etc.).
Disk Benchmark: Use topic: "disk_benchmark" (aliases: stress_test, io_intensity) for sequential read/write throughput and latency measurements on the workspace drive. Accepts optional path arg; falls back to the running binary's drive if the path is not found.
Desktop / Downloads: Use topic: "desktop" or topic: "downloads" to list files in the user's Desktop or Downloads directory — names, sizes, and modification dates.
Disk: Use topic: "disk" with a path arg to inspect a specific disk path — free space, filesystem type, and usage.
Directory: Use topic: "directory" with a required path arg to list any arbitrary directory — file names, sizes, and modification dates.
Teacher Mode (/teach): Activates a grounded walkthrough mode for write/admin tasks Hematite cannot safely execute itself. Protocol: (1) call inspect_host with the relevant topic(s) to observe actual machine state, (2) deliver a numbered step-by-step tutorial referencing real observed state — exact commands, exact paths, exact values. Does NOT execute write operations. Covers:
SysAdmin Diagnostics: inspect_host (topic=network, services, processes, ports, log_check, startup_items, storage, hardware, updates, security, pending_reboot, disk_health, battery, recent_crashes, scheduled_tasks, connections, etc.)
Hardware Diagnostic Suite: topic=device_health (PnP errors), topic=drivers (active audit), topic=peripherals (USB/HID tree).
Deep System Visibility: topic=sessions (Logon sessions), topic=hardware (BIOS/Virtualization DNA), topic=processes (Real-time I/O tracking), topic=thermal (Thermal/Throttling), topic=activation (Licensing), topic=patch_history (KB Audit), topic=overclocker (Precision Silicon Historian). matching grounded walkthrough. New lanes: driver_install, group_policy, firewall_rule, ssh_key, wsl_setup, service_config, windows_activation, registry_edit, scheduled_task_create, disk_cleanup. Each lane inspects real machine state first, then delivers machine-specific numbered steps.

Research & Technical Verification

Hematite includes a privacy-first, unlimited research engine powered by a local SearXNG instance.

research_web: Search the internet via a local self-healing SearXNG backend. Privacy-first (no identity tracking), unlimited volume (no cloud API rate limits). Use this for technical news, library versions, API updates, and verifying technical claims.
fetch_docs: Fetch and convert a URL into a local markdown-ready document for analysis.
Proactive Verification: Hematite is instructed to identify its own knowledge gaps. If a technical fact is not absolute (e.g., "what is the latest version of X"), the agent should use research_web to verify before answering.
Search Intent Disambiguation: Queries mentioning "function," "logic," or "repository" are routed to the internal Vein/codebase index. Queries mentioning "latest," "version," "news," or "research" are routed to the web research tool.

Product Boundary

Hematite is not trying to outscale cloud agents. It is optimized for local GPU task execution.

Primary target: one RTX 4070-class GPU with roughly 12 GB VRAM
Main engineering constraints: limited local context, open-model inconsistency, and VRAM pressure under long sessions
Design response: stronger tooling, grounded traces, compaction, retrieval, and operator workflow instead of pretending the model is smarter than it is

Behavioral Guidelines

These core guidelines help minimize common LLM coding mistakes. They prioritize caution and precision over speed.

Think Before Coding: Explicitly state assumptions. Surface tradeoffs and ask for clarification if anything is unclear.
Simplicity First: Write the minimum code necessary. Avoid speculative abstractions or "future-proofing" that wasn't requested.
Surgical Changes: Touch only what is necessary. Match existing style and refactor only what is broken. Clean up any artifacts (unused imports/variables) created by your change.
Goal-Driven Execution: Define clear success criteria (e.g., reproduction tests) and verify every step.
No Mojibake: Always check for and prevent garbled character regressions (e.g., — instead of —). This is a common AI error when handling UTF-8 characters like em-dashes, arrows, and smart quotes. Before submitting any documentation or UI changes, verify that no character encoding errors have been introduced. If you encounter mojibake in existing files, fix it immediately.

Product Direction

Hematite should behave like a high-agency coding partner with bounded autonomous lanes.

That means:

the model handles intent, code judgment, wording, and local reasoning between steps
the harness handles deterministic workflow structure, recovery, context control, and verification
autonomy is earned per workflow, not assumed globally

In practice, the product should keep leaning into micro-workflows for recurring task classes:

startup and UI wording changes
read-before-edit refactors
proof-before-edit debugging
verify-after-mutation coding tasks

When a local model gets uncertain, the answer is usually not "give it more freedom." The answer is tighter scaffolding: narrower tools, better owner-file locking, exact-window inspection, explicit recovery ladders, and honest operator-visible failure states.

Large-file edit discipline: Before editing files over ~500 lines (inference.rs, conversation.rs, tui.rs, and similar large modules), recommend /architect or a read-only inspection pass first unless the user has already provided a clear plan or target line range. Direct /code on large files without orientation leads to missed context and off-target edits on 9B models. This applies to any large codebase the user runs Hematite against, not just Hematite's own source.

Math, Science & Data Analysis CLI

Hematite includes a comprehensive offline math/science/data toolkit — no model, no cloud, no internet required. All commands run instantly from the CLI.

Pure-Rust math (sub-millisecond):

hematite --matrix 'det [[1,2],[3,4]]' — linear algebra: det, inv, solve, mul, transpose, eigen, rank, LU, QR, SVD, Cholesky, pseudoinverse
hematite --symbolic 'diff x^3 + sin(x)' — symbolic calculus: differentiate, integrate, simplify, evaluate
hematite --finance 'npv 8% -100 30 40 50' — financial math: NPV, IRR, loan, bond, Black-Scholes
hematite --logic 'A and (B or not C)' — propositional logic: truth table, SAT, tautology, CNF/DNF
hematite --graph 'shortest A D\nA B 2\nB D 3' — graph theory: BFS/DFS/Dijkstra/centrality/PageRank/clustering/diameter
hematite --signal 'dft 1,0,-1,0,1,0,-1,0' — DSP: DFT, FIR filter design, convolution, waveform gen
hematite --interpolate 'spline 0,0 1,1 2,4 3,9 at 1.5' — interpolation: linear, cubic spline, Lagrange
hematite --units '100 km to miles' — unit conversion: 14 categories, 130+ units, broadcast mode
hematite --ode 'dy/dt = -y y0=1 t=5' — ODE solver: Euler/RK4/RK45, Lotka-Volterra, SIR, logistic
hematite --optimize 'min x^2-4*x+3 a=0 b=5' — optimization: golden section, Nelder-Mead, gradient descent, root finder
hematite --probability 'normal mean=0 sd=1 x=1.96' — probability distributions: normal, binomial, Poisson, t, chi2, exponential, uniform, geometric
hematite --bitwise '0xFF AND 0x3C' — bitwise calculator: AND/OR/XOR/NOT/shifts/rotates/IEEE754 float breakdown
hematite --set '{1,2,3} union {3,4,5}' — set theory: union, intersection, difference, power set, Cartesian product
hematite --cipher 'caesar 13 Hello World' — classical ciphers: ROT13, Atbash, Caesar, Vigenère, Rail Fence, Columnar, Morse
hematite --text-stats 'Paste any text here...' — readability: Flesch-Kincaid, Gunning Fog, SMOG, word/letter frequency
hematite --levenshtein 'kitten vs sitting' — string distance: Levenshtein, Damerau-Levenshtein, Hamming, Jaro-Winkler, LCS
hematite --number-format 1234567890 — number representations: thousands, scientific, engineering, SI prefix, hex/bin/oct, English words
hematite --sort-viz '5,3,8,1,9,2' — sorting visualizer: bubble/insertion/selection/merge/quick/heap with ASCII bar charts
hematite --checksum 'Hello, World!' — checksums: CRC-32/16, Adler-32, FNV-1a, DJB2, SDBM, XOR, sum
hematite --validate '4532015112830366' — validation: Luhn/credit card, ISBN-10/13, EAN-13, IBAN, UUID

Python-sandbox data analysis (no external libs, uses Python stdlib only):

hematite --sample data.csv --sample-n 100 — random sampling, train/test split
hematite --correlate data.csv — Pearson/Spearman correlation matrix with heatmap
hematite --timeseries data.csv — trend, seasonality, moving averages, change points
hematite --fourier data.csv — FFT frequency analysis
hematite --cluster data.csv --cluster-k 3 — k-means clustering
hematite --normalize data.csv — feature scaling: z-score, min-max, robust, L2
hematite --pca data.csv --pca-components 3 — principal component analysis
hematite --hypothesis '2.1,2.8,3.2' --hypothesis-test one-t --hypothesis-mu 2.0 — hypothesis tests: t-tests, chi-square, ANOVA, Mann-Whitney, Pearson, proportion z-test, CI
hematite --polyfit data.csv --polyfit-x col1 --polyfit-y col2 --polyfit-degree 2 — polynomial curve fitting: R², RMSE, MAE, ASCII scatter with fit curve

Other instant utilities:

hematite --periodic Au — periodic table element lookup
hematite --random password --length 24 — cryptographic random values
hematite --compute '2^10 + factorial(20)' — arbitrary precision arithmetic

MCP Server Mode

Hematite can run as an MCP server, exposing its 128+ host inspection tools to any MCP-capable agent over the stdio transport.

hematite --mcp-server

This starts a JSON-RPC 2.0 newline-delimited stdio server. No TUI launches. Protocol stays on stdout; all logging goes to stderr.

Claude Desktop configuration (~/.claude/claude_desktop_config.json):

{
  "mcpServers": {
    "hematite": {
      "command": "hematite",
      "args": ["--mcp-server"]
    }
  }
}

Tool exposed: inspect_host — all 128+ topics, same as the TUI. Claude and Codex CLI are the primary MCP clients; any MCP-capable client can call it directly and get grounded machine state with no cloud, no API key, and no prompt guessing.

Implementation: src/agent/mcp_server.rs — stdio reader loop, JSON-RPC dispatch, delegates to crate::tools::host_inspect::inspect_host().

Edge Redaction (Tier 1 — Regex)

Add --edge-redact to strip sensitive identifiers before any response leaves the machine:

hematite --mcp-server --edge-redact

Patterns sanitized before the cloud agent sees the output:

Usernames in file paths (C:\Users\<name>\ → C:\Users\[USER]\)
MAC addresses → [MAC]
Hardware / disk serial numbers → [SERIAL]
Hostnames and computer names → [HOSTNAME]
AWS access key IDs → [AWS-KEY]
Credential-shaped env values (API keys, tokens, passwords) → [REDACTED]

Every response includes a receipt header the cloud model can read:

[edge-redact: 4 substitution(s) — username-path ×4 — values replaced before leaving this machine]

Use case: enterprises and security-conscious operators who want frontier model reasoning (Claude Desktop, OpenClaw) without raw machine identifiers crossing the wire. The local machine provides grounded observations; the cloud model reasons about them — but never sees the raw identity data.

Implementation: src/agent/edge_redact.rs — lazy_static! compiled regex patterns, redact() returns count by category, apply() prepends the receipt header.

Semantic Redaction (Tier 2 — Local Model Summarizer)

Add --semantic-redact and --semantic-model to route inspect_host output through a dedicated local model before any data leaves the machine:

hematite --mcp-server --semantic-redact --semantic-model bonsai-8b

The summarizer model receives raw diagnostic output and produces an anonymous diagnostic summary — stripping usernames, hostnames, MACs, local IPs, serial numbers, org names, and credentials while preserving diagnostic value (versions, error codes, metrics, findings, time deltas). Tier 1 regex runs after the semantic pass as a final safety net to catch anything the model missed.

--semantic-model specifies which model in LM Studio handles privacy summarization. This is separate from the main reasoning model — it only activates during MCP calls with --semantic-redact. The main TUI model (Qwen etc.) is never involved in privacy filtering. When multiple models are loaded in LM Studio, this flag is required.

--semantic-url (optional) points the summarizer at a different server endpoint entirely — useful if running the privacy model on a separate llama.cpp instance or a second LM Studio installation. If omitted, the summarizer uses the same port as --url (default: http://localhost:1234/v1). All three models (main + embed + summarizer) can share port 1234 in LM Studio's multi-model mode.

Choosing a summarizer model: any instruction-following model works. Smaller is better for constrained setups since the summarizer runs alongside your main model:

RTX 4070 (12 GB): Bonsai 8B Q1_0 at 1.16 GB — verified. Fits with Qwen3.5 9B + nomic-embed, 8.22 GB total.
RTX 4080/4090 (16–24 GB): any 8B Q4_K_M model at 5–6 GB — better summarization quality.
Workstation / multi-GPU: 70B-class models — near-perfect identity stripping.

The summarizer does not need to be good at code or reasoning. Benchmark scores for instruction-following and summarization matter; coding benchmarks do not.

Fail-safe: if the local model is unreachable, the tool call returns an error — raw data is never sent to the cloud model.

Jailbreak resistance: the summarizer prompt is injected by Hematite and wraps system data in <diagnostic_data> tags explicitly marked as untrusted. Unknown MCP arguments are stripped before tool dispatch. Model refusals are detected and treated as errors.

Audit trail: every tool call is logged to ~/.hematite/redact_audit.jsonl with metadata only (topic, mode, substitution counts, input/output size, shrink ratio). Raw output and original values never appear in the audit log.

Implementation: src/agent/semantic_redact.rs — HTTP to LM Studio /v1/chat/completions, temperature=0, max_tokens capped at 1.5× input length. src/agent/redact_audit.rs — JSONL appender, no external deps.

Redaction Policy File

Create .hematite/redact_policy.json (workspace) or ~/.hematite/redact_policy.json (global) to control per-topic behavior:

{
  "blocked_topics": ["user_accounts", "credentials", "audit_policy"],
  "allowed_topics": [],
  "topic_redaction_level": {
    "network": "semantic",
    "hardware": "regex"
  },
  "default_redaction_level": "regex"
}

blocked_topics — MCP returns an error for these topics; the inspection never runs
allowed_topics — if non-empty, only these topics are served (whitelist mode)
topic_redaction_level — override redaction level per topic: "none", "regex", or "semantic"
default_redaction_level — fallback when no per-topic override exists

See .hematite/redact_policy.example.json for a full template. Workspace config overrides global.

Implementation: src/agent/redact_policy.rs — loaded once at MCP server startup.

MCP Configuration

Hematite loads stdio MCP servers from:

~/.hematite/mcp_servers.json
.hematite/mcp_servers.json

Workspace config overrides global config by server name. On Windows, wrapper launchers such as npx, npm, .cmd, and .bat are resolved automatically.

LLM Provider Configuration

Hematite defaults to LM Studio on http://localhost:1234/v1. To use a different OpenAI-compatible server (Ollama, vllm, a remote machine, etc.), set api_url in .hematite/settings.json:

"api_url": "http://localhost:11434/v1"

This overrides the --url CLI flag. The value must be the base /v1 path — Hematite appends /chat/completions, /models, and /embeddings automatically.

Common values:

LM Studio (default): http://localhost:1234/v1
Ollama: http://localhost:11434/v1
Remote machine: http://192.168.x.x:1234/v1

Global settings fallback. Hematite merges two config files at startup: the workspace-level .hematite/settings.json (inside the project root) and the global ~/.hematite/settings.json (in the user's home directory). Workspace values always win; global fills in any fields not set by the workspace. This means api_url, model, voice, and other preferences set globally apply in every directory — including non-project launches from the desktop or home folder. The workspace config is created automatically on first run in a new directory.

Workspace profile. Hematite writes workspace_profile.json into the active runtime-state directory on startup. In normal project workspaces that is .hematite/workspace_profile.json; in OS shortcut directories such as Desktop or Downloads it falls back to ~/.hematite/workspace_profile.json so no local .hematite/ folder is created there. The file is auto-generated and gitignored when local. It contains detected stack/package-manager hints, important folders, ignored noise folders, and build/test suggestions. The prompt can use it as lightweight grounding before the model starts guessing about repo shape. Use /workspace-profile to inspect the current generated profile in the TUI.

Model Compatibility Notes

Jinja template fix — | safe filter error: Some bartowski quantizations (e.g. qwen_qwen3.6-35b-a3b IQ2_XXS) ship with a broken Jinja chat template that LM Studio cannot render. Symptom: Unknown StringValue filter: safe channel errors after the first tool call.

Fix: In LM Studio, open the model → Prompt Template → Template (Jinja) tab. Find this line:

{%- set args_value = args_value | string if args_value is string else args_value | tojson | safe %}

Change it to:

{%- set args_value = args_value | string if args_value is string else args_value | tojson %}

Save. The model will work correctly after this one-character fix.

Primary target model: Qwen/Qwen3.5-9B Q4_K_M on LM Studio. Larger models at extreme quantizations (IQ2_XXS) often have worse effective instruction-following than the 9B at Q4_K_M and are not recommended for Hematite's tool-routing patterns.

API Configuration

Hematite uses Jina Reader/Search for web research. You can run without a key on the public tier, but a key is recommended for stability.

Get a key at jina.ai.
Set JINA_API_KEY.
Or create a local .env file with JINA_API_KEY=....

Architecture

src/
  main.rs               Entry point. Wires channels, spawns tasks, launches the TUI.
  agent/
    inference.rs        InferenceEngine: HTTP to LM Studio, streaming, tool calls.
    conversation.rs     ConversationManager: turn loop, tool dispatch, prompt assembly.
    swarm.rs            SwarmCoordinator: parallel worker agents.
    specular.rs         Watcher and side-panel event source.
    mcp.rs              MCP transport and framing.
    mcp_manager.rs      MCP server lifecycle and discovery.
    prompt.rs           System prompt builder and workspace rule injection.
    parser.rs           Tool call parsing.
    transcript.rs       Session transcript serialization.
    git.rs              Git helpers.
    config.rs           Runtime config loading.
    compaction.rs       Context compaction and summarization helpers.
  tools/
    mod.rs              Tool registry and dispatch.
    file_ops.rs         File listing, reading, writing, project mapping.
    file_edit.rs        Targeted editing helpers.
    shell.rs            Shell execution.
    git.rs              Git tool implementations.
    lsp.rs / lsp_tools.rs  LSP startup and language-aware tooling.
    verify_build.rs     Build validation tool.
    guard.rs            Safety checks for risky actions.
  ui/
    tui.rs              Main TUI loop, rendering, input handling.
    voice.rs            VoiceManager and local TTS pipeline.
    gpu_monitor.rs      Background VRAM polling.
    modal_review.rs     Swarm diff review modal.
    hatch.rs            Rusty personality generation.
  memory/
    vein.rs             Vein RAG: SQLite FTS5 BM25 + semantic embedding retrieval.
    repo_map.rs         PageRank-powered structural overview of the codebase.
    deep_reflect.rs     Idle-triggered session memory synthesis.
libs/
  kokoros/              Vendored voice synthesis library.

Voice Engine

Hematite ships a fully self-contained TTS pipeline using the vendored Kokoro engine. No cloud, no separate install, no Python — everything is baked into the binary at compile time.

How it works:

The Kokoro ONNX model (kokoro-v1.0.onnx, 311 MB) and voice styles (voices.bin, 27 MB) are embedded in the binary via include_bytes! at compile time
ONNX Runtime 1.24.2 is statically linked via ort's download-binaries feature — the system onnxruntime.dll is never used, eliminating DLL version conflicts
DirectML.dll (GPU inference on Windows) ships alongside the binary — copied to target/debug/ by the build, bundled in portable releases
54 voices are available across English (American/British), Spanish, French, Hindi, Italian, Japanese, and Chinese — all baked in, no downloads at runtime
Voice ID, speed (0.5–2.0×), and volume (0.0–3.0×) are configurable via /voice or settings.json

First-start note: ONNX graph optimization runs on first load, which takes 10–30 seconds on an RTX 4070-class system. Subsequent starts reuse the optimized graph. During loading, incoming speech tokens buffer (1024 capacity) so no audio is lost.

Why static linking matters: Windows ships onnxruntime.dll 1.17 in System32. Kokoro's ONNX model uses opsets not supported by 1.17. Dynamic loading would silently crash inside C code before any Rust error handler could catch it. Static linking with 1.24.2 sidesteps this entirely — the binary carries the exact runtime it was built against.

Runtime DLL footprint: only DirectML.dll is needed alongside the binary. It ships with Windows 10 1903+ and is also bundled in the Hematite portable release.

Key Concepts

InferenceEvent: the enum flowing from agent to TUI over mpsc
Thought routing: model reasoning is routed to the side panel instead of the main chat
SPECULAR panel: shows live reasoning, recent reasoning trace, and watcher events
ACTIVE CONTEXT: shows the current working file set
Ghost system: .hematite/ghost/ stores pre-edit backups
Hardware guard: gpu_monitor.rs watches VRAM and can force brief mode or reduce swarm fanout
Startup greeting prints active endpoint (Endpoint: http://localhost:1234/v1) so misconfigured providers are immediately visible

The Vein — Local RAG

The Vein is Hematite's retrieval-augmented generation layer. At the start of each turn it indexes any changed files and queries for context relevant to the user's message. Results are injected into the system prompt so the model starts with the right code already in view, reducing tool calls.

Per-workspace database: stored in the active runtime-state directory as vein.db. In normal project workspaces that means .hematite/vein.db; in OS shortcut directories it falls back to ~/.hematite/vein.db. Each real project folder still gets its own index. The Vein learns from files on disk and local session artifacts, not from cloud state.

Non-project directories: when Hematite is launched outside a real project (no Cargo.toml, package.json, go.mod, etc. found walking up from the launch directory), it skips the source-file walk but still keeps The Vein active in docs-only mode. docs/, imported chats in imports/, and recent local session reports in the active runtime-state directory remain searchable, and the status badge shows VN:DOC. A bare .git alone does not count as a project workspace.

Auxiliary local memory inputs: besides project source, The Vein also indexes:

.hematite/docs/ for permanent local reference material
the runtime-state reports/ directory for recent local session reports, chunked by exchange pair (user + assistant) and capped to the last 5 sessions / 50 turns per session
.hematite/imports/ for imported chat exports (Claude Code JSONL, Codex CLI JSONL, simple role/content JSON, ChatGPT-style mapping exports, or > transcripts), also chunked as session memory without inflating source/doc status counts

Two retrieval modes, hybrid-merged:

BM25 (always available) — SQLite FTS5 full-text search with Porter stemming. Fast, zero GPU cost, works even when no embedding model is loaded.
Semantic (optional, higher quality) — Calls the active provider's embedding endpoint (/v1/embeddings on LM Studio, /api/embed on Ollama) to embed each chunk using the preferred embedding model. Understands synonyms and concept-level matches; finds "what renders on startup" even when no file uses the word "banner". Vectors are stored in SQLite so they survive restarts without re-embedding.

To enable semantic search: load or prefer an embedding model alongside your main coding model. LM Studio is still the recommended default; on Ollama you can use an embedding model such as embeddinggemma, qwen3-embedding, or all-minilm and save it with /embed prefer <id>. Status bar shows VN:SEM (green) when active, VN:FTS (yellow) for BM25-only project/docs indexing, and VN:DOC when only docs/session memory are active outside a project.

Automatic backfill: if the embedding model is loaded after initial indexing, Hematite detects unembedded chunks and fills them gradually (20 per turn) without needing a reset or file-touch.

How hybrid ranking works: semantic hits score 1.0–2.0 (preferred), BM25 fills to 0.0–1.0 for paths not already covered. Results are deduplicated by file path and capped at 1500 chars total.

Active-room bias: file edit heat is tracked per path. The hottest subsystem room gets a small retrieval boost, and a compact hot-files block grouped by room is injected into the prompt so the model stays oriented toward the part of the codebase you're actively editing.

L1 hot-files context: the top 8 hottest files (by edit count) are grouped by room and injected as a compact block near the top of the system prompt every turn. This gives the model immediate structural orientation — which subsystems are active — before it reads any retrieval results or repo map output. Returns None and injects nothing on a fresh project with no heat records.

PageRank Repo Maps: at startup and after every file edit, Hematite builds a tree-sitter definition/reference graph across all source files and runs PageRank (via petgraph) to rank files by structural importance. The ranked map is injected into the system prompt so the model immediately knows which files are architecturally central — no tool calls needed for basic orientation. Hot-file personalization uses heat-weighted scores from The Vein: the hottest file gets a 100× boost; others scale proportionally (e.g. half the edits → 50× boost). This means files that are both architecturally central and actively edited float to the top.

Ranking cues: reranking adds small boosts for exact quoted phrases, standout tokens such as filenames/commands/tool IDs, "what did we decide earlier" style prompts that should prefer session/import memory over generic source overlap, and time-anchored memory prompts such as explicit dates, "yesterday", or "last week" so the right session period outranks stale matches.

Room taxonomy: room detection is also rule-based across path segments and filenames now, so runtime/config/release/integration/doc files do not all collapse into generic folder labels.

Memory-type tagging: session-room chunks (local session reports and imported chat exports) are classified by detect_memory_type(text) — a zero-cost regex pass in src/memory/vein.rs that tags each chunk as decision, problem, milestone, preference, or "". The tag is stored in chunks_meta.memory_type. QuerySignals::from_query sets query_memory_type by detecting intent words in the query. During retrieval, matching chunks receive a +0.35 score boost via retrieval_signal_boost. This lets session memory surface by intent (an architectural decision vs. a reported bug vs. a style preference) without the operator using special syntax.

Operator inspection: /vein-inspect prints a compact report of the current Vein state: workspace mode, indexed source/docs/session counts, embedding availability, active room bias, and the current hot files grouped by room. Use it when you want to inspect what memory Hematite is actually carrying.

Incremental indexing: files are re-indexed only when their mtime changes. BM25 runs on every changed file; embeddings are generated for the same files so the vector store stays in sync.

Chunking strategy: Rust files are split at symbol boundaries (fn/impl/struct/enum boundaries), keeping doc-comments with their item. Other files split at paragraph breaks. Oversized blocks fall back to a sliding window. This ensures each retrieved chunk is a coherent, complete code unit.

Resetting the index: /vein-reset wipes all three tables and resets the status badge to VN:--. The next turn rebuilds from scratch. pwsh ./clean.ps1 -Deep also deletes the DB file.

File size limit: 512 KB per file. Large files like tui.rs, inference.rs, and conversation.rs are indexed in full. Files over 512 KB are skipped.

BM25 query shape: stopwords are stripped and tokens are OR-joined in the FTS5 query. This prevents conversational queries like "how does the specular panel work" from returning zero results due to FTS5 implicit AND semantics.

Backfill ordering: .rs files are embedded first so the most relevant source files get semantic vectors before documentation or config files.

Model Behavior Notes

Some local models omit an opening reasoning tag; the streamer handles this
Some local servers return tool_calls: [] instead of null; Hematite filters this
Conversation history slices must start with a user message for LM Studio/Jinja alignment
Tool hallucination guards block fake tool names such as thought or reasoning
Gemma 4: tool results are wrapped in <|tool_response>response:{name}{...}<tool_response|> native markup; controlled by gemma_native_auto / gemma_native_formatting config
Gemma 4: messages are wrapped with <|turn> markup before sending; non-Gemma models must NOT receive this wrapping
Standard models (Qwen, etc.): tool results use plain content; no model-specific markup applied
Standard models (Qwen, etc.): jinja templates require exactly one system role message — a second system message causes a 400 Channel Error; loop_intervention is merged into history[0] instead of appended
Turn-level transient retry budget (3 per turn) caps runaway retry loops on Channel Errors; budget resets on successful inference
Repeat guard: if the same (tool_name, args) is called 3+ times in a turn, a hard stop intervention is injected; verify_build and git tools are exempt (fix-verify loops are legitimate)
Naked reasoning prose leaked without <think> tags is stripped from visible output before it reaches chat; stray </think>, </function>, </tool_call>, and similar XML artifacts are also stripped
edit_file and multi_search_replace normalize CRLF → LF before matching so model search strings (always LF) work correctly on Windows files; on exact-match failure, Hematite escalates through: (1) rstrip-only match — strips trailing whitespace, preserves indentation; (2) full-strip match — strips all surrounding whitespace; if both fail, scans up to 100 workspace source files for the search string and names the matching file in the error message (cross-file hint); on any fuzzy match, replace-string indentation is delta-corrected automatically
Diff preview: before edit_file, patch_hunk, or multi_search_replace is applied, a coloured before/after diff modal is shown in the TUI; user presses Y to apply or N to skip; model is told "Edit declined by user." on N; bypassed in --yolo mode
Tool output overflow: when a tool result exceeds 8 KB, cap_output_for_tool writes the full text to .hematite/scratch/<tool>_<timestamp>.txt inside the active runtime-state directory and returns a truncation notice with the scratch path; the model recovers the full content with read_file without repeating the original tool call; large read_file results under compact-context mode follow the same scratch path
read_file satisfies the line-inspection grounding check so the model can go read_file → edit_file without a separate inspect_lines call
Context compaction warnings fire as visible System messages at 70% and 90% context fill; the warning resets below 60% so it only fires once per pressure band
Embed model load/unload is detected mid-session: when the active provider swaps the embedding model (or unloads it), Hematite fires a System message in the TUI immediately so the operator knows semantic search state changed
Startup CWD guard: if Hematite is launched from an inaccessible system folder (e.g. via a Windows shortcut pointing to a system path), it silently relocates to the user's home directory before any workspace detection runs, preventing a hung startup

Commit Style

Use lowercase conventional commits:

feat: add X
fix: correct Y
refactor: restructure Z
chore: update deps / clean repo
docs: update README

Session Economics and Reporting

Hematite tracks token usage and session cost in real time.

Exit (Ctrl+C) and cancel (ESC) flows copy the session transcript to the clipboard
Session reports are written to reports/session_YYYY-MM-DD_HH-MM-SS.json under the active runtime-state directory on every exit and cancel
Report includes: session start timestamp, duration, model, context length, total tokens, estimated cost, turn count, and full transcript
The runtime-state reports/ directory is gitignored when local — reports are local runtime artifacts
The Vein indexes recent reports as local retrieval memory by exchange pair, capped to the last 5 sessions and 50 turns per session, tagged as session room memory so they do not pollute normal source-file status counts
.hematite/imports/ is the manual cross-tool memory lane: drop useful exported chats there and Hematite will index them automatically as imported session exchanges on the next pass

Sandboxed Code Execution

Hematite exposes a run_code tool that lets the model write and run JavaScript/TypeScript or Python in a restricted subprocess. This is real execution — the model gets actual output, not training-data approximations.

Deno sandbox (JS/TS):

Flags: --deny-net --deny-env --deny-sys --deny-run --deny-ffi --allow-read=. --allow-write=. --no-prompt
Code fed via stdin — no temp file created or cleaned up
NO_COLOR=true set so output is clean

Python sandbox:

env_clear() + blocked socket, os.system, os.popen, and dangerous module imports (subprocess, urllib, requests, etc.) via a custom __import__ wrapper
Note: Python sandboxing is best-effort (no OS-level permission flags like Deno)

Both runtimes:

Hard timeout: 10 seconds default, up to 60 seconds if the model passes timeout_seconds
16 KB output cap (8 KB stdout + 8 KB stderr)
Clear error message if the runtime is not installed — no silent failure

Runtime detection order for Deno: ~/.lmstudio/.internal/utils/deno.exe (LM Studio's bundled copy, present for all LM Studio users) → system deno on PATH. Since Hematite requires LM Studio, JS/TS execution works with zero install for every user.

Runtime detection for Python: python3 → python on PATH. Python 3 ships with Windows 11 and most machines.

To install Deno system-wide (optional, for use outside Hematite): winget install DenoLand.Deno.

Computation Integrity Routing: Hematite automatically detects when a query requires precise numeric computation and nudges the model to reach for run_code instead of answering from training-data memory. Detection categories: checksums/hashes (SHA, MD5, CRC), financial/percentage calculations, statistical analysis (mean, std dev, regression), unit conversions (bytes, temperature, distance, weight), date/time arithmetic (days between dates, Unix timestamps), algorithmic verification (prime checks, sorting, factorial), and any explicit "run this code" request. When detected, a pre-turn COMPUTATION INTEGRITY NOTICE is injected so the model computes the real result rather than guessing. Two harness-level recovery paths back this up: if the model attempts shell for sandbox-style execution, it is blocked and forced to retry with run_code; if the model writes Python without specifying language: "python" and Deno rejects the syntax, the harness detects the parse error and forces a corrective retry with the correct language. The routing logic lives in src/agent/routing.rs (needs_computation_sandbox); the recovery interventions live in the tool result handler in src/agent/conversation.rs.

Document and Image Attachments

Hematite supports attaching files to any conversation turn via hotkeys or slash commands.

Document attachment (Ctrl+O / /attach <path>):

Supported types: PDF (text-based), markdown, plain text
PDF extraction is best-effort using pure-Rust pdf-extract — works for standard PDFs (Word exports, LaTeX, API docs); rejects with a clear error if words are smashed together or text is too short (common with academic publisher PDFs using custom embedded fonts like EBSCO, Elsevier, Springer)
Size feedback: after loading, Hematite estimates the token cost (chars/4) and warns if the attachment exceeds 40% of the active context window (yellow warning) or 75% (red warning), so the operator knows before sending
Permanent indexing: drop files in .hematite/docs/ and the Vein indexes them alongside source code — hybrid BM25+semantic retrieval, no separate step required
One-shot: /attach injects content as a context prefix on the next message then clears

Image attachment (Ctrl+I / /image <path>):

Supported types: PNG, JPG, JPEG, GIF, WebP
Encoded as a base64 data URL and passed to the model via the multimodal vision path
Works with any vision-capable model loaded in LM Studio
Useful for: screenshots of bugs, UI mockups, architecture diagrams, scanned documents that PDF extraction can't handle

Clearing attachments:

/detach drops any pending document or image before sending
Attachments are cleared automatically after the next turn

Versioning Policy

Hematite follows Semantic Versioning (MAJOR.MINOR.PATCH).

Bump	When
`PATCH` (0.1.1)	Bug fixes, doc updates, internal refactors with no user-visible change
`MINOR` (0.2.0)	New user-visible features, meaningful UX improvements, new tools
`MAJOR` (1.0.0)	Breaking config/API changes, or the first stable public release

Pre-1.0 rule: while the version is 0.x.y, minor bumps are used freely for new features. Don't stay on a patch version just because the change feels small — if a user would notice it, it's a minor bump.

When to bump:

Never bump mid-development. Version numbers live in Cargo.toml and are baked into the binary at compile time.
Cargo.toml is the Rust package manifest and the release version source of truth. Other release surfaces are updated to match it.
For unreleased work, validate the change in a rebuilt local portable first: pwsh ./scripts/package-windows.ps1 -AddToPath, restart the terminal, and test the live behavior.
Bump only after the feature work is committed and the local portable has already proven the behavior. Do not bump just to test whether a fix might work.
Always use bump-version.ps1 — never edit version strings by hand across files.
bump-version.ps1 now self-verifies the static release surfaces immediately after replacement. After cargo build, run pwsh ./scripts/verify-version-sync.ps1 -Version X.Y.Z -RequireCargoLock before committing the bump.
After bumping, run cargo build (this also regenerates Cargo.lock), then commit exactly these five files and nothing else:
```
git add Cargo.toml Cargo.lock README.md CLAUDE.md installer/hematite.iss
git commit -m "chore: bump version to X.Y.Z"
```
Never use git add . for a bump commit — it can sweep in unrelated changes. Never skip Cargo.lock — it must match Cargo.toml.

Commit message for a version bump:

chore: bump version to X.Y.Z

Release Build

Recommended wrapper for routine releases:

pwsh ./release.ps1 -Version X.Y.Z

For solo use, prefer release.ps1 over manually retyping the release sequence. It refuses to run from a dirty worktree, sets the exact release version when you use -Version X.Y.Z, rebuilds Cargo.lock, verifies version sync, commits the version files, creates the annotated tag, then builds release artifacts from that tagged commit. Add -Push to also push main and the tag automatically. Use -Bump patch|minor|major when you want the script to calculate the next semantic version for you.

pwsh ./release.ps1 -Version X.Y.Z -AddToPath -Push is the full Windows publish path: local bump commit, local tag, rebuilt portable bundle, rebuilt installer, PATH update, then push of both main and the new tag.

That order is intentional. Hematite's startup banner and /version only show release when the binary is compiled from the exact matching tag, so local release artifacts must be built after the tag exists.

For crates.io automation:

add -PublishCrates to publish hematite-cli after the push succeeds
add -PublishVoiceCrate only when hematite-kokoros changed and must be published first
-PublishCrates requires -Push; do not publish crates from a local-only release state

Practical operator order:

Land the actual feature or fix first.
Add or update diagnostics coverage when the change introduces or materially changes behavior.
Rebuild the local Windows portable without bumping: pwsh ./scripts/package-windows.ps1 -AddToPath
Restart the terminal, run the local portable, and test the live behavior.
Commit the feature work as a normal commit.
When the work is proven, run pwsh ./release.ps1 -Version X.Y.Z -AddToPath -Push or the appropriate -Bump variant from a clean tree.
Wait for CI to go green on both Windows and Linux before publishing to crates.io. Pushing the tag triggers both release workflows. If either fails, push a patch fix first — never publish a crate from a state where CI is red on any platform.

Do not bump just to test whether a feature works. For Hematite, the local portable is the pre-release smoke test. Public version bumps happen after the live local test passes.

release.ps1 is for cutting a release from a known-good state. It is not a substitute for first validating an unshipped fix in the local portable.

For behavioral changes, diagnostics are part of the change, not optional cleanup. Prefer adding or updating focused coverage in tests/diagnostics.rs as you land the work so the live portable test is not your only proof.

Solo verification loop (Codex/operator path):

cargo fmt
cargo check --tests
cargo test --test diagnostics
cargo deny check
powershell -ExecutionPolicy Bypass -File ./scripts/verify-doc-sync.ps1
pwsh ./scripts/package-windows.ps1 -AddToPath

Why these exist:

cargo fmt Normalizes Rust formatting so the diff stays readable and consistent. CI runs cargo fmt --all --check and will fail if this is skipped — always run it before every commit.
cargo check --tests Fast compile check for both app code and test code without paying the full release-build cost yet.
cargo test --test diagnostics Runs the focused behavior checks where tool routing, Vein behavior, host inspection, and other product-level regressions are usually covered.
cargo deny check Validates licenses, detects duplicate crates, and checks advisories. Run this before pushing whenever Cargo.toml or any transitive dep changes. New crates occasionally use non-standard SPDX license identifiers (e.g. bzip2-1.0.6) that must be explicitly added to the allow list in deny.toml. The fix is always a one-liner there, but it will fail CI if skipped.
pwsh ./scripts/package-windows.ps1 -AddToPath Rebuilds the actual portable build you run locally, updates the PATH-backed copy, and gives you the real pre-release smoke test.

CI-only fix retag rule: When a CI failure has no user-visible change (formatting, license config, doc typo), do NOT bump the version. Fix the issue, then force-move the existing tag to the new commit:

git tag -d vX.Y.Z
git push origin :refs/tags/vX.Y.Z
git tag -a vX.Y.Z -m "Release vX.Y.Z"
git push origin vX.Y.Z

Only bump the version when the change itself warrants it per the versioning policy. A cargo fmt pass or a deny.toml line addition is not a release — it is a tag correction.

Mojibake check (run before every publish): After any README or doc edit, scan for encoding corruption before committing or publishing to crates.io. PowerShell's Set-Content with -Encoding utf8 and the bump-version script both write UTF-8 correctly, but copying text from browsers or other tools can introduce Windows-1252 sequences. Common symptoms: â€" instead of —, â€™ instead of ', 16â€"24 instead of 16–24. Quick check:

Select-String -Path README.md,CLAUDE.md,CAPABILITIES.md -Pattern "â€|Ã |â„¢" | Select-Object Line

If any matches appear, re-save the affected file as UTF-8 without BOM and replace the corrupt sequences with their correct Unicode equivalents before committing.

When the change is narrow, prefer a targeted diagnostics test instead of the full file:

cargo test --test diagnostics test_name_here -- --exact

Routing fix workflow (inspect_host topic routing gaps):

When a query routes to shell instead of inspect_host, the fix pattern is:

Check preferred_host_inspection_topic() in src/agent/routing.rs — if the topic has no asks_* variable there, that's the root cause. host_inspection_mode is derived from this function; if it returns None, the HOST INSPECTION MODE system prompt is never injected and the model free-forms.
Add the missing asks_* variable with natural-language phrases that cover the query shape.
Add it to the dispatch chain (if asks_X { Some("topic") }).
Update the HOST INSPECTION MODE bullet list in src/agent/conversation.rs to include the new topic so the model knows to use it.
Add a test_routing_detects_*_topic test in src/agent/conversation.rs (the current tests live there) covering 2–3 representative phrases.
Run cargo test --lib agent::conversation::tests, rebuild portable, test the live query.

Note: all_host_inspection_topics() (used for multi-topic harness pre-runs) is a separate table — a topic can be in one and not the other. Always check preferred_host_inspection_topic() specifically.

Inside Hematite itself, explicit cleanup, local packaging, and scripted release requests should prefer the structured approval-gated Hematite maintainer workflow tool instead of falling back to raw shell. Use that path when the user is asking to run Hematite's own clean.ps1, scripts/package-windows.ps1, or release.ps1 in natural language. Do not present it as a generic current-workspace script runner.

For project-specific questions or commands, launch Hematite in the target project directory before asking. Hematite's own maintainer workflows are separate from whatever scripts exist in the current workspace.

Launching from the home directory is valid for workstation inspection, docs-only memory, and general machine questions. It is not the right default for project-specific build, test, script, or repo work.

For normal project work, prefer the separate workspace workflow lane for the active repo's build, test, lint, fix, package scripts, make/just/task targets, local repo scripts, or exact project commands. That path is rooted to the locked workspace, not to Hematite's own source tree.

For a new contributor or non-technical operator, the short explanation is: format the code, make sure it still compiles, make sure the behavior test passes, then rebuild the real app and try it live.

Step 1 — bump the version (updates tracked release metadata and verifies the static surfaces):

pwsh ./bump-version.ps1 -Version X.Y.Z

Never edit version numbers by hand — they will drift across files.

Step 2 — rebuild the lockfile and verify the full version state:

cargo build
pwsh ./scripts/verify-version-sync.ps1 -Version X.Y.Z -RequireCargoLock

Step 3 — tag and push to trigger CI:

git tag -a vX.Y.Z -m "Release vX.Y.Z"
git push origin main
git push origin vX.Y.Z

Pushing the tag triggers windows-release.yml and unix-release.yml on GitHub Actions. Both workflows download the Kokoro voice model assets, run cargo build --release, package the artifacts, and attach them to the GitHub Release automatically when they go green. No manual upload needed.

Local build (optional, for testing before tagging):

pwsh ./scripts/package-windows.ps1

The ONNX model (311 MB) is baked into the binary at compile time — no separate download
DirectML.dll is copied from target/release/ automatically by the ORT build script
Output: dist/windows/Hematite-X.Y.Z-portable.zip (~336 MB)
dist/ is gitignored — these are release artifacts, not tracked in source

Cleanup

pwsh ./clean.ps1           # ghost, scratch, memories, sandbox, reports, logs
pwsh ./clean.ps1 -Deep    # + target/, onnx_lib/, vein.db
pwsh ./clean.ps1 -Deep -PruneDist   # + old dist/ artifacts, keeps only current Cargo.toml version
pwsh ./clean.ps1 -Reset   # + PLAN.md, TASK.md (full blank-slate, simulates new user)

Regular clean removes runtime artifacts: ghost backups, scratch files, session memories, sandbox output, reports, and logs (.hematite/logs/). Deep also removes build outputs and the vein database. Note: session logs previously written to .hematite_logs/ in the project root now live at .hematite/logs/ — delete any leftover .hematite_logs/ directories manually. -PruneDist is opt-in and removes stale packaged artifacts under dist/ while keeping only the current Cargo.toml version. Reset goes further and wipes session state files — use this to simulate a first-run experience without touching settings.json or mcp_servers.json.

For Hematite, disk growth is a normal maintenance concern. This is a heavy native Rust project with release packaging, ORT/DirectML sidecars, tests, and repeated debug/release builds. target/ can climb into the tens of gigabytes quickly, and after enough iteration it is believable to hit 50-100 GB of local build output. Treat periodic deep cleanup as part of the normal workflow. When disk pressure matters, run pwsh ./clean.ps1 -Deep; if you also want to keep only the latest packaged release artifacts, use pwsh ./clean.ps1 -Deep -PruneDist. Remember that the next full rebuild will be slower because you deliberately wiped cached build state.

Contributor Roadmap

Hematite is designed around the real constraint of a single consumer GPU running 9B-class open models. The goal is not to pretend the local model is smarter than it is. The goal is to make the harness so tight that a 9B model on a 4070 can do real work.

This roadmap reflects that design philosophy: things that are worth doing now because they work with the model's actual capability, and things to revisit when local models improve.

Shipped

Streaming shell output — ✓ Done. execute_streaming streams each stdout/stderr line to the SPECULAR panel as it arrives via InferenceEvent::ShellLine. verify_build uses the same path. Background tasks fall back to blocking execution.
Turn checkpointing — ✓ Done. save_session() writes .hematite/session.json after every turn. On next startup, load_checkpoint() surfaces the resume hint in SPECULAR and running_summary + session_memory are reinjected into the model’s system prompt. /new and /forget both clear the session cleanly via save_empty_session().
Computation integrity routing — ✓ Done. needs_computation_sandbox() in routing.rs detects math queries and injects a pre-turn nudge. Shell-to-run_code block recovery and Deno parse error recovery are wired in the tool result handler.
Per-project rule and skill injection — ✓ Done. Hematite now natively checks for .hematite/rules.md, HEMATITE.md, CLAUDE.md, SKILLS.md, and SKILL.md as project guidance, and scans .agents/skills/ plus .hematite/skills/ for directory-based Agent Skills. This is additive guidance only; sovereign scaffold, .hematite/PLAN.md, .hematite/TASK.md, and resumable execution remain baked-in harness workflows. Includes /rules and /skills commands for inspecting the active guidance surface directly from the TUI.
Ultra-Deterministic Teleportation — ✓ Done. Spawns fresh terminal sessions on workspace transitions with a specialized handshake greeting and origin-path propagation via --teleported-from. New window matches the originating window’s pixel size and position; launches without splash screen. Source terminal auto-closes via a background watcher on the parent cmd.exe (Windows Terminal excluded). Sovereign OS directories (Desktop, Downloads, Documents, Pictures, Videos, Music) redirect all runtime state to ~/.hematite/ — no .hematite/ folders created in those locations. Bare name support: /cd downloads, /cd desktop, /cd ~ all resolve without @ prefix.
Native Tool Mandate — ✓ Done. Triage hierarchy and system prompts now strictly prioritize native surgical tools over MCP mutations for local filesystem operations, enforced by surgical_filesystem_mode in routing.rs.
Deep WSL / Docker filesystem auditing — ✓ Done. Shipped as inspect_host(topic: “docker_filesystems”) and inspect_host(topic: “wsl_filesystems”). Covers bind mounts, named volumes, Docker Desktop disk-image growth, WSL rootfs usage, host-side ext4.vhdx sizing, and /mnt/c bridge checks, with output shaped as finding -> impact -> exact fix steps.
Advanced LAN / UPnP / neighborhood inspection — ✓ Done. Shipped as inspect_host(topic: “lan_discovery”). Covers neighborhood discovery summary, SMB/NetBIOS visibility, mDNS/SSDP/UPnP listener surface, gateway/device-discovery hints, and plain-English diagnosis for “discovery broken vs service missing vs firewall blocked”.
Voltage telemetry for overclocker — ✓ Done. overclocker now reports real board-power context plus explicit GPU-voltage availability on the active NVIDIA driver path, and only shows CPU voltage when WMI exposes a decodable firmware-reported value. The wording stays strict: power draw is not presented as voltage telemetry.
Audio + microphone troubleshooting — ✓ Done. Shipped as inspect_host(topic: “audio”). Covers Windows Audio service health, playback and recording endpoint inventory, microphone and speaker path checks, Bluetooth-audio crossover, and plain-English diagnosis for “no sound / bad mic / crackling”.
Bluetooth troubleshooting — ✓ Done. Shipped as inspect_host(topic: “bluetooth”). Covers Bluetooth radio presence, service health, paired-device inventory, Bluetooth audio endpoint crossover, and plain-English diagnosis for “won’t pair / keeps disconnecting / wrong headset role”.
Camera + privacy-permission auditing — ✓ Done. Shipped as inspect_host(topic: “camera”). Covers PnP camera/webcam device inventory, Windows camera privacy registry state, Windows Hello biometric camera detection, and plain-English diagnosis for “camera not working / blocked by privacy settings”.
Windows Hello / sign-in recovery — ✓ Done. Shipped as inspect_host(topic: “sign_in”). Covers Windows Hello and biometric service state (WBioSrvc), recent logon failure events (EventID 4625), enrolled credential providers, and plain-English diagnosis for “PIN/fingerprint not working / can’t sign in”.
Search indexing diagnostics — ✓ Done. Shipped as inspect_host(topic: “search_index”). Covers Windows Search (WSearch) service state, indexer registry configuration, indexed locations, recent indexer errors, and plain-English diagnosis for “search not finding files / indexer stopped”.
Display configuration — ✓ Done. Shipped as inspect_host(topic: “display_config”). Covers active monitor resolution, refresh rate, bits-per-pixel, video adapter driver version, connected monitor PnP names, and DPI/scaling percentage via Win32 GDI.
NTP / time sync — ✓ Done. Shipped as inspect_host(topic: “ntp”). Covers Windows Time service (W32Time) health, NTP source and last sync via w32tm, configured NTP peers (registry fallback), and plain-English diagnosis for clock drift or sync failure.
CPU power and frequency — ✓ Done. Shipped as inspect_host(topic: “cpu_power”). Covers active power plan, processor min/max state and turbo boost mode, current CPU clock and load via WMI Win32_Processor, thermal zone temperatures, and diagnosis for “CPU stuck slow / boost disabled / power plan capping frequency”.
Credential Manager diagnostics — ✓ Done. Shipped as inspect_host(topic: “credentials”). Covers vault summary, credential target inventory, type counts, and hygiene warnings without exposing secret values.
TPM / Secure Boot diagnostics — ✓ Done. Shipped as inspect_host(topic: “tpm”). Covers TPM presence/readiness/spec version, Secure Boot state, firmware mode, and plain-English diagnosis for Windows 11 or BitLocker security posture.
Browser health diagnostics — ✓ Done. Shipped as inspect_host(topic: “browser_health”). Covers Edge/Chrome/Firefox inventory, default browser and protocol associations, WebView2 runtime health, browser proxy/policy overrides, profile/cache pressure, and recent browser crash evidence.
Microsoft 365 identity-auth diagnostics — ✓ Done. Shipped as inspect_host(topic: “identity_auth”). Covers TokenBroker / WAM / AAD Broker Plugin state, dsregcmd device-registration signals, Office/Teams/OneDrive account mismatch detection, WebView2 auth dependency state, and recent auth-related events.
Outlook diagnostics — ✓ Done. Shipped as inspect_host(topic: “outlook”). Covers classic Outlook and new Outlook for Windows install inventory, running process state and RAM usage, mail profile count, OST and PST file discovery with sizes, add-in inventory with load behavior and resiliency-disabled items, authentication and token broker cache state, and recent Outlook crash evidence from the Application event log.
Teams diagnostics — ✓ Done. Shipped as inspect_host(topic: “teams”). Covers classic Teams and new Teams (MSTeams MSIX) install inventory, running process state and RAM usage, cache directory sizing for both classic and new Teams, WebView2 runtime dependency check, account and sign-in state, audio/video device binding, and recent Teams crash evidence from the Application event log.
Windows backup diagnostics — ✓ Done. Shipped as inspect_host(topic: “windows_backup”). Covers File History service state and last backup date/target drive, Windows Backup (wbadmin) last successful backup versions and scheduled tasks, System Restore enabled state and most recent restore point, OneDrive Known Folder Move per-account protection state, and recent backup failure events from the Application event log.
Hyper-V diagnostics — ✓ Done. Shipped as inspect_host(topic: “hyperv”). Covers Hyper-V role state (VMMS service, feature installed), VM inventory with name, state, CPU%, RAM, and uptime, VM network switch inventory (External/Internal/Private with bound NIC), VM checkpoint listing with creation timestamps, and host RAM overcommit detection. Reports gracefully if Hyper-V is not installed.
Application crash triage — ✓ Done. Shipped as inspect_host(topic: “app_crashes”). Faulting application name/version, faulting module, exception code, crash vs hang classification, WER archive count, crash frequency over 7 days. Accepts optional process arg to filter by app name. Distinct from recent_crashes (BSOD/kernel events); routing detects natural-language variants including plural/verb forms.
MCP server mode — ✓ Done. hematite --mcp-server starts a JSON-RPC 2.0 newline-delimited stdio server exposing all 128+ inspect_host topics to Claude, Codex CLI, and any other MCP-capable client with no TUI, no local model required. Implemented in src/agent/mcp_server.rs.
Edge redaction Tier 1 — ✓ Done. --edge-redact applies compiled regex patterns post-inspect_host: strips usernames in paths, MAC addresses, serial numbers, hostnames, AWS key IDs, and credential-shaped env values. Each response includes a machine-readable receipt header with per-category counts. Implemented in src/agent/edge_redact.rs.
Semantic redaction Tier 2 + privacy gateway — ✓ Done. --semantic-redact routes raw inspect_host output through the local LM Studio model with a hardened privacy prompt before any data leaves the machine. Fail-safe: unreachable model returns an error, never raw data. Jailbreak resistance: <diagnostic_data> delimiters, refusal detection, unknown MCP args stripped. Tier 1 runs after as safety net. Policy file (.hematite/redact_policy.json) provides per-topic block lists, whitelist mode, and redaction level overrides. Metadata-only audit trail written to ~/.hematite/redact_audit.jsonl. Implemented across src/agent/semantic_redact.rs, src/agent/redact_policy.rs, src/agent/redact_audit.rs.

Next Up — highest-value missing support lanes

Nothing currently queued. All roadmap items shipped.

Recently Shipped (developer toolkit wave)

Secret scanner — ✓ Done. secret_scanner tool scans the workspace for accidentally committed secrets using 14 regex patterns (AWS keys, GitHub tokens, Stripe keys, Slack webhooks, private key blocks, database URLs, bearer tokens, password literals, and more). Skips binary files, lock files, and obvious placeholder values. Findings grouped by file with line numbers and redacted snippets plus actionable remediation steps. Routing detects natural-language variants including "scan for secrets", "leaked credentials", "hardcoded password", "gitleaks", "trufflehog".
Changelog generator — ✓ Done. changelog_gen tool generates Markdown changelogs from git commit history grouped by conventional commit type (feat/fix/perf/refactor/docs/test/chore/ci/build/style). Supports version range scoping via from/to tags, custom titles, and up to 500 commits. Scopes rendered in bold, short hash appended to each entry.
Code metrics — ✓ Done. code_metrics tool reports lines of code, comment density, blank lines, TODO/FIXME counts, language breakdown by file extension, test file ratio, and top 10 largest files. Skips binaries, build artifacts, and vendor directories. Provides a test coverage proxy (% of code lines in test files).
Dependency audit — ✓ Done. dependency_audit tool audits Cargo.toml, package.json, requirements.txt/pyproject.toml, and go.mod for pinning issues, wildcard versions, deprecated packages, missing lock files, and outdated major versions. No network required. Directs users to cargo audit/npm audit/safety for CVE scanning as follow-up.
Port check — ✓ Done. port_check tool tests TCP port reachability with configurable timeout. Annotates 40+ well-known ports (PostgreSQL, Redis, MongoDB, MySQL, SSH, HTTP/S, LM Studio, Ollama, Jupyter, Kubernetes, RDP, etc.). Returns OPEN or CLOSED/FILTERED with actionable hints for closed ports.
Environment diff — ✓ Done. env_diff tool compares two .env files or a .env file against the live process environment. Reports additions (+), removals (-), and changed values (~) with secret values automatically redacted. Auto-detects .env/.env.local pairs in the workspace root when called with no arguments.
Template generator — ✓ Done. template_gen tool generates 23 built-in project templates: Dockerfiles (Node/Python/Rust/Go multi-stage), GitHub Actions CI workflows, .gitignore for 4 ecosystems, .env.example, Makefiles, docker-compose.yml with web+db+redis, .pre-commit-config.yaml, .editorconfig, Dependabot config, CODEOWNERS, PR template, and bug/feature issue templates. Supports variable substitution (project_name, port, language versions). Use template='list' to see all templates.
JSON tools — ✓ Done. json_tools tool queries, transforms, and analyzes JSON without needing jq or external utilities. 16 actions: pretty, compact, keys, get (dot-path navigation like user.address.city and items[0].id), filter (field equality/comparison), pluck, flatten, count, sort, unique, merge, diff, validate, schema (recursive type inference), stats (numeric min/max/mean/median/stddev), to-csv. Accepts inline JSON or file path.
Regex tools — ✓ Done. regex_tools tool tests, extracts, replaces, splits, and explains regular expressions without external tools. 6 actions: test (match/no-match with excerpts, accepts single string or array), extract (all matches or named/numbered capture groups), replace (with optional limit), split (partition text on pattern), explain (plain-English breakdown of each syntax component), named-groups (extract (?P<name>...) captures by name). Flags: case_insensitive, multiline, dot_all. Routing detects natural-language variants including "test this regex", "explain this pattern", "named capture groups".
Diff tools — ✓ Done. diff_tools tool compares, patches, and analyzes text or file differences without needing external diff/patch utilities. 5 actions: compare (unified diff with configurable context lines), patch (generate a unified .patch from two inputs), apply (apply a unified patch to a base text or file), word-diff (inline [+added]/[-removed] word-level diff), stat (lines added/deleted/unchanged, similarity %, ASCII bar). Accepts inline text via text_a/text_b or file paths via file_a/file_b. Routing detects "compare files", "diff these", "generate a patch", "apply this patch", "word diff", "what changed between".
Diff3 tools — ✓ Done. diff3_tools tool parses, inspects, and resolves git-style three-way merge conflicts (<<<<<<< / ======= / >>>>>>> markers) without external utilities. 4 actions: conflicts/parse (list all conflict blocks with ours/base/theirs sections and line counts), merge3 (three-way LCS merge of two sides against a base text), sides/extract (extract ours or theirs side from all conflicts), resolve/auto (auto-resolve with strategy: smart/ours/theirs/both/union). Also decodes diff3-style ||||||| base sections. Pass 'text' for inline content or 'file' for a file path. Routing detects "merge conflict", "resolve conflict", "conflict marker", "<<<<<<", "diff3", "three-way merge", "auto-resolve", "git conflict", "rebase conflict", and related phrases.
YAML tools — ✓ Done. yaml_tools tool validates, formats, queries, and transforms YAML documents without external utilities. 8 actions: validate (type/depth/key summary), format (canonical re-serialization), get (dot-path navigation including array index like spec.containers[0].image), keys (list keys or elements at any path), to-json, from-json, merge (deep-merge overlay), diff (additions, removals, changes). Accepts inline YAML via yaml arg or file path. Routing detects "validate yaml", "yaml to json", "merge yaml", "kubernetes yaml", "helm chart", "ansible yaml", and related phrases.
CSV tools — ✓ Done. csv_tools tool reads, inspects, filters, sorts, and converts CSV data without external tools. 9 actions: read (formatted table view), head (first N rows), columns, stats (min/max/mean/median/stddev for numeric columns; unique count and top values for text), filter (eq/ne/gt/lt/gte/lte/contains/starts-with/ends-with), sort (asc/desc), to-json (auto-coerces numbers and booleans), to-markdown, count. RFC 4180-compliant parser handles quoted fields and escaped quotes. Accepts inline CSV or file path.
Encode tools — ✓ Done. encode_tools tool encodes and decodes data between formats without external utilities. 9 actions: base64-encode (standard or URL-safe), base64-decode, url-encode (percent-encoding), url-decode, hex-encode, hex-decode, jwt-decode (header + payload with exp/iat human-readable display; no signature verification), html-encode (escapes &, <, >, ", '), html-decode. All actions take an input field. Routing detects "base64", "url encode/decode", "hex encode/decode", "jwt decode", "html encode/escape", and related phrases.
Hash tools — ✓ Done. hash_tools tool computes cryptographic hashes of strings or files without external tools. 5 actions: sha256 (default), sha512, md5, hmac-sha256 (requires key field), all (runs MD5 + SHA-256 + SHA-512 in one call). Accepts input (inline string) or file (path). Zero new dependencies — uses sha2 = "0.10", md-5 = "0.10", and new hmac = "0.12" already in the RustCrypto ecosystem. Routing detects "sha256", "sha-256", "sha512", "md5 hash", "hash this", "hmac", "file hash", "cryptographic hash", and related phrases.
TOML tools — ✓ Done. toml_tools tool validates, formats, queries, and transforms TOML documents without external utilities. 6 actions: validate (root type and top-level key summary), format (canonical pretty-print), get (dot-path navigation like package.name or bin[0].name), keys (list keys at any path), to-json, from-json. Accepts inline TOML via toml arg or file path. Works with Cargo.toml, pyproject.toml, config.toml, and any TOML config file. Routing detects "toml file", "parse toml", "validate toml", "cargo.toml key", "toml to json", and related phrases.
Text tools — ✓ Done. text_tools tool transforms, analyzes, and manipulates text without external tools. 16 actions: case conversion (to-snake, to-camel, to-pascal, to-kebab, to-screaming, to-title, to-lower, to-upper), slugify (URL-safe slug), count (word/line/character/byte/sentence stats), truncate (with configurable max and ellipsis), pad (left/right/center with fill char), wrap (word-wrap at configurable width), repeat (N times with optional separator), reverse, lines (with sort/dedupe/filter_empty options). Routing detects "snake_case", "camelCase", "kebab-case", "slugify", "word count", "truncate text", "word wrap", "sort lines", and related phrases.
Date tools — ✓ Done. date_tools tool handles date/time work without external utilities. 9 actions: now (current UTC/local/ISO/epoch/week), parse (parse any date string — ISO 8601, RFC 2822, natural formats like "June 15, 2024"), format (reformat with strftime pattern), add (add days/weeks/months/years/hours/minutes with correct month rollover), diff (duration between two dates — weeks/days/hours breakdown + approx months/years), timestamp (date → Unix epoch + millis), from-timestamp (epoch → human date, auto-detects milliseconds), relative ("3 days ago" / "in 2 hours"), weekday (day name + ISO week number). Zero new dependencies — chrono was already in Cargo.toml. Routing detects "current date", "unix timestamp", "days between", "add months", "date diff", "what day of the week", and related phrases.
Number tools — ✓ Done. number_tools tool handles number conversion, formatting, and math without external utilities. 8 actions: convert (base conversion 2–36, accepts 0x/0b/0o prefixes; omit 'to' to show all bases at once), format (thousands separators, scientific, engineering, SI prefix), roman (int 1–3999 → Roman numeral), from-roman (Roman → int), si (show with SI prefix: k/M/G/T/P/E), factors (prime factorization with primality flag), gcd (Euclidean GCD + LCM via 'a'/'b' fields), clamp ('value' clamped to 'min'/'max'). Pure Rust stdlib — zero new dependencies. Routing detects "convert to hex", "roman numeral", "prime factors", "gcd of", "si prefix", "format number", and related phrases.
UUID gen — ✓ Done. uuid_gen tool generates and validates UUIDs without external utilities. 4 actions: generate (default — UUID v4 with version/variant metadata), validate (check format, decode version/variant), nil (all-zeros nil UUID), bulk (generate up to 100 UUIDs at once via 'n' field). All actions accept 'upper: true' for uppercase output. Zero new dependencies — rand was already in Cargo.toml. Routing detects "uuid", "guid", "unique identifier", "unique id", "validate uuid", "bulk uuid", and related phrases.
Cron tools — ✓ Done. cron_tools tool parses, explains, and operates on cron expressions without external utilities. 4 actions: explain (field-by-field breakdown with natural-language summary), validate (strict parse with YES/NO verdict), next (next N run times from now, minute-by-minute iteration capped at 2 years), describe (one-line human summary of the schedule). Supports named days (MON–SUN) and months (JAN–DEC), step (*/N), range (A-B), and list (,) syntax. Zero new dependencies — chrono already in Cargo.toml. Routing detects "cron", "crontab", "cron expression", "cron schedule", "next run", "when does this job run", and related phrases.
IP tools — ✓ Done. ip_tools tool performs IP address calculations and analysis without external utilities. 5 actions: info (class, type, binary, hex, decimal for IPv4; expanded/compressed for IPv6), cidr (full subnet breakdown — network, broadcast, first/last host, usable hosts, wildcard mask, binary representations), contains (checks whether an IP is within a CIDR range), convert (decimal integer ↔ IPv4, 0xHEX ↔ IPv4, IPv4 ↔ IPv6 mapped), subnet (mask-style subnet calculation). Zero new dependencies — std::net. Routing detects "cidr", "subnet mask", "network address", "broadcast address", "convert ip", "ip to decimal", "is this ip", and related phrases. Fixed: mask_to_prefix now uses count_ones() instead of the broken leading_zeros + trailing_zeros check.
Subnet tools — ✓ Done. subnet_tools tool provides extended IPv4 subnet and CIDR operations without shell commands or external utilities. 7 actions: split (default — divide a CIDR block into N equal sub-networks; N must be a power of 2; pass 'cidr' and 'n'), hosts (enumerate all usable host IPs in a CIDR with offset/limit pagination; pass 'cidr', optional 'limit' default 50 and 'offset'), supernet (find the smallest CIDR that contains all given IPs/CIDRs; pass 'ips' array), aggregate (compress a list of IPs/CIDRs into the minimal covering set; pass 'ips' array), overlap (find all overlapping pairs in a CIDR list; pass 'ips' array), contains (check if every IP in a list falls within a CIDR; pass 'cidr' and 'ips' array), range (convert a start/end IP range to CIDR notation; pass 'start' and 'end'). Pure Rust stdlib, zero new dependencies. Routing detects "split subnet", "subnet split", "subnets from cidr", "divide cidr", "list hosts in cidr", "enumerate hosts", "hosts in subnet", "hosts in cidr", "supernet", "cidr aggregat", "aggregate cidr", "aggregate subnet", "merge cidr", "cidr overlap", "overlapping cidr", "ip range to cidr", "cidr from range", "subnet_tools", and related phrases.
Color tools — ✓ Done. color_tools tool converts, analyzes, and manipulates colors without external utilities. 7 actions: info (full breakdown — RGB, HSL, hex, luminance, CSS name match), convert (any format → all formats), mix (blend two colors with optional ratio), lighten (increase HSL lightness by %), darken (decrease HSL lightness by %), contrast (WCAG 2.1 contrast ratio with AA/AAA grading), palette (complementary, triadic, analogous, lighter/darker variants). Accepts #RRGGBB, #RGB, rgb(), hsl(), 31 CSS named colors. Zero new dependencies — pure Rust math. Routing detects "hex color", "rgb color", "hsl color", "contrast ratio", "wcag", "color palette", "complementary color", "lighten color", "darken color", "mix colors", and related phrases.
SemVer tools — ✓ Done. semver_tools tool implements SemVer 2.0 parsing, comparison, and range checking without external utilities. 6 actions: parse (major/minor/patch/pre-release/build-meta breakdown, stability flag), compare (A vs B with ordering label), bump (major/minor/patch/premajor/preminor/prepatch — clears pre-release on stable bumps), validate (YES/NO with error detail), satisfies (version against range — supports ^, ~, >=, <=, >, <, =, *, || OR, space-AND), sort (asc/desc array sort with correct pre-release ordering per SemVer 2.0). Zero new dependencies — pure Rust. Routing detects "semver", "semantic version", "bump version", "compare versions", "version range", "satisfies range", "sort versions", "^1.", "~1.", and related phrases.
Password gen — ✓ Done. password_gen tool generates cryptographically random passwords, passphrases, and PINs without external utilities. 4 actions: generate (configurable length 8–128, upper/lower/digits/symbols/no-ambiguous flags, Fisher-Yates shuffle guarantees at least one char from each selected class), passphrase (~500 embedded English words, configurable word count 3–12, separator, capitalize, optional appended number), strength (entropy bits, 0–4 score bar, ✓/✗ checklist, improvement suggestions), pin (numeric-only PIN 4–12 digits). Zero new dependencies — rand already in Cargo.toml. Routing detects "generate password", "secure password", "passphrase", "password strength", "generate pin", "random pin", and related phrases.
JWT tools — ✓ Done. jwt_tools tool decodes, verifies, signs, and inspects JSON Web Tokens without external utilities. 4 actions: decode (header + payload breakdown with human-readable exp/iat timestamps, claims pretty-print; no signature verification), verify (HS256/HS384/HS512 HMAC signature check + expiry/nbf validity; returns VALID or INVALID verdict with per-claim state), sign (create a new JWT with any claims object and HS256/HS384/HS512 HMAC), inspect (expiry status, validity window, subject/issuer/audience summary without secret). Zero new dependencies — base64, hmac, sha2 already in Cargo.toml. Routing detects "jwt", "json web token", "bearer token", "decode token", "verify token", "sign token", "HS256", "eyJ" prefix, and related phrases.
XML tools — ✓ Done. xml_tools tool parses, formats, queries, and converts XML documents without external utilities. 6 actions: validate (default — parse and report root element name, element count, max depth, attribute count, and direct children summary), format (pretty-print with 2-space indentation, preserves XML declaration), get (navigate to any element by dot-path like project.build or deps.dependency[2]), keys (list immediate children and attributes of root or a path target), to-json (convert full document to JSON — @ prefix for attributes, #text for text content, arrays for repeated same-name elements), query (find all elements matching a tag name anywhere in the document). Accepts 'xml' for inline XML or 'file' for a file path. Works with Maven POMs, Android manifests, Spring configs, SOAP responses, RSS/Atom feeds, SVG, XHTML, and any XML document. Uses quick-xml = "0.36". Routing detects "xml", "pom.xml", "maven pom", "android manifest", "soap", "rss feed", "svg file", "xml to json", "convert xml", "<?xml", and related phrases.
Archive tools — ✓ Done. archive_tools tool inspects and reads zip archives without external utilities. 4 actions: list (default — tabular listing of all entries with name, compressed/uncompressed size, compression method, file vs directory; supports max and filter args), info (overall archive statistics — file count, directory count, total size, compression ratio, and comment), inspect (detailed metadata for a specific entry by name — size, method, CRC-32, last-modified timestamp), extract (read a specific text entry as UTF-8 string, limited to 1 MB). Pass 'file' with path to the archive. Works with .zip, .jar, .whl, .vsix, .apk, and any zip-format archive. Uses zip = "6" (already present as a transitive dep). Routing detects ".zip", ".jar", ".whl", ".vsix", ".apk", "zip archive", "unzip", "extract zip", "archive contents", "list archive", and related phrases.
ASCII tools — ✓ Done. ascii_tools tool generates ASCII/Unicode art, box drawings, progress bars, tables, and trees without external utilities. 5 actions: banner (default — block-letter ASCII art from 'text'; max 30 characters using a 5-row Unicode block glyph font), box (draw a Unicode border box around text lines; 'style': single/double/rounded/heavy/ascii; optional 'padding'), bar (render a fill/progress bar; 'value' required; 'max' default 100; 'width' default 40; 'style': block/hash/equals/shade/circle/dot; optional 'label'), table (render a formatted Unicode table from 'headers' string array and 'rows' 2D array; 'style': single/double/heavy/rounded), tree (render a directory-style tree from 'root' + 'nodes' array of {label, children?} objects, or from a 'text' indented outline string). Zero new dependencies — pure Rust stdlib. Routing detects "ascii art", "ascii banner", "big text", "big letters", "ascii box", "box drawing", "draw box", "ascii table", "progress bar", "ascii tree", "tree diagram", and related phrases.
Base tools — ✓ Done. base_tools tool encodes, decodes, and identifies data in base16/base32/base58/base85 encodings without external utilities. 3 actions: encode (default — all four encodings at once, or a specific one via 'encoding' field), decode (decode from a specific encoding back to UTF-8 or hex; requires 'encoding' field), identify (detect which encodings a string is likely to be — charset fingerprinting by alphabet analysis). Implements RFC 4648 base32 (A–Z + 2–7 alphabet), Bitcoin/IPFS base58 (no ambiguous 0OIl characters), Z85/ZeroMQ base85 (85-char printable ASCII alphabet), and base16 (hex). Zero new dependencies — pure Rust stdlib. Routing detects "base32", "base58", "base85", "base16 encode", "z85", "ascii85", "encode base", "decode base", "identify encoding", "guess encoding", "bitcoin base58", "ipfs base58", "rfc 4648", and related phrases.
Binary tools — ✓ Done. binary_tools tool performs bit manipulation, bitfield packing/unpacking, and binary analysis without external utilities. 5 actions: info (default — full representation of any integer: decimal/hex/octal/binary, popcount, parity, leading/trailing zero counts, Gray code, NOT, IEEE 754 float view for 32/64-bit values; 'value' as integer or 0x/0b/0o string; optional 'width' in bits), flags (enumerate each bit position as SET/clear with hex mask and optional named labels via 'names' array), pack (assemble a packed integer from an ordered array of {value, bits, name?} field objects — MSB first), unpack (extract named fields from a packed integer given a {bits, name?} layout array), ops (compute NOT/AND/OR/XOR/NAND/NOR/XNOR, left/right shifts, rotate-left/rotate-right, popcount, parity, Gray code, and mask/set/clear/toggle on A and optional B; optional 'shift' count). Zero new dependencies — pure Rust stdlib. Routing detects "bit manipulation", "bitfield", "bit field", "pack bits", "flag bits", "bitmask", "bit mask", "bit operations", "bitwise ops", "popcount", "gray code", "rotate bits", "set bit", "clear bit", "toggle bit", "bit packing", "binary flags", and related phrases.
SQLite tools — ✓ Done. sqlite_tools tool inspects and queries SQLite databases in read-only mode — no sqlite3 CLI required. 5 actions: tables (default — list all tables with row counts, plus views and index count), schema (show CREATE SQL and PRAGMA table_info column details; pass 'table' to scope to one table), query (execute a SELECT/EXPLAIN/WITH/PRAGMA statement; pass 'sql'; max 100 rows, use 'limit' to override — INSERT/UPDATE/DELETE/DROP/CREATE blocked), info (database file metadata — page size, encoding, journal mode, SQLite version, table count), export (dump a full table as CSV or JSON; pass 'table', optionally 'format' and 'limit'). Pass 'file' with the path to the .sqlite or .db file. Zero new dependencies — rusqlite was already in Cargo.toml. Routing detects "sqlite", ".db file", "sqlite3", "query database", "list tables", "database schema", "export csv", and related phrases.
Markdown tools — ✓ Done. markdown_tools tool parses and analyzes Markdown documents without external tools. 6 actions: toc (default — generate table of contents with GitHub-style anchor links; 'depth' limits heading levels, default 3), stats (word count, reading time estimate, heading count by level, code block count and lines, link/image/table/blockquote counts), extract (extract headings, code blocks with optional language filter, links, or images; pass 'what' = headings | code | links | images), links (list all hyperlinks with display text and URL, plus images), to-html (render Markdown to HTML via pulldown-cmark; 'wrap: true' for full HTML document with optional 'title'), strip (remove all Markdown formatting and return plain text). Accepts 'text' for inline Markdown or 'file' for a .md path. Uses pulldown-cmark = "0.12". Routing detects "table of contents", "markdown stats", "word count in", "extract headings", "extract links", "markdown to html", "render markdown", "strip markdown", "reading time", and related phrases.
URL tools — ✓ Done. url_tools tool parses, builds, encodes, decodes, and manipulates URLs without external utilities. 7 actions: parse (default — break URL into scheme, host, port, path, query params, fragment), build (construct URL from 'scheme', 'host', 'path', optional 'port'/'params'/'fragment'), params (list/set/remove query parameters via 'op': list | set | remove; 'key'/'value' for mutations), encode (percent-encode a string; 'component: true' for strict encoding), decode (percent-decode), normalize (lowercase scheme/host, resolve dot segments), validate (check if URL is valid, flag HTTP vs HTTPS and localhost). Zero new dependencies — url = "2.5" and percent-encoding = "2.3" already in Cargo.toml. Routing detects "parse this url", "decode url", "url encode", "query params", "build a url", "validate url", and related phrases.
Line tools — ✓ Done. line_tools tool provides line-based text processing — a self-contained grep/head/tail/sort/cut — without external utilities. 11 actions: grep (filter lines matching a pattern; regex and invert modes, ignore_case, line numbers), head (first N lines), tail (last N lines), sort (alphabetic, numeric, reverse, case-insensitive, optional dedup), unique (remove duplicates preserving order; frequency count mode; sort by frequency), count (line/word/character/byte counts), slice (extract lines from/to by 1-based line number), number (add line numbers with start/step), join (join lines with configurable separator), replace (find-and-replace with regex support and limit), cut (extract a field by delimiter, 1-based field index). Zero new dependencies — regex already in Cargo.toml. Routing detects "grep for", "filter lines", "sort these lines", "unique lines", "count lines", "join lines", "replace in text", "cut field", and related phrases.
Hex tools — ✓ Done. hex_tools tool provides hex dump, binary analysis, and hex encoding/decoding without external utilities. 6 actions: dump (default — xxd-style hex dump with offset, hex bytes per row, and ASCII sidebar; configurable width and byte limit), strings (extract printable ASCII strings from binary data with offsets; configurable minimum length), bytes (byte frequency histogram, null count, high-byte count, Shannon entropy, top-8 bytes by frequency), analyze (magic byte file type detection for 30+ formats: PNG, JPEG, GIF, ZIP, gzip, PDF, ELF, PE, Mach-O, SQLite, MP3, FLAC, MP4, Matroska, HTML, XML, JSON, TOML, shebang, UTF BOM, etc. + entropy estimate), to-hex (encode bytes or text as a hex string; configurable separator and upper/lowercase), from-hex (decode a hex string back to bytes with UTF-8 interpretation). Pass 'file' for a file path, 'hex' for an existing hex string, or 'text'/'input' for UTF-8 text. Zero new dependencies — pure Rust stdlib. Routing detects "hex dump", "hexdump", "xxd", "hex encode", "decode hex", "magic bytes", "binary file", "extract strings", "shannon entropy", "analyze binary", and related phrases.
INI tools — ✓ Done. ini_tools tool parses, queries, validates, and converts INI/config files without external utilities. Handles standard INI: [section] headers, key=value and key: value pairs, ; and # comments (both full-line and inline), and global keys before any section. 7 actions: parse (default — display all sections and key-value pairs with counts), get (retrieve a specific value; 'section.key' dot notation or separate 'section'/'key' args; case-insensitive key matching), sections (list all section names with key counts), keys (list keys in a section; pass 'section' to scope, omit for global keys), validate (check for duplicate keys, duplicate sections, empty sections), to-json (convert full INI document to a JSON object with nested section objects), to-toml (convert to TOML format). Pass 'text'/'ini' for inline content or 'file' for a file path. Zero new dependencies — pure Rust stdlib + serde_json already in Cargo.toml. Routing detects ".ini", ".cfg", ".conf", "ini file", "config file", "parse ini", "ini section", "ini to json", "validate ini", "configuration file", and related phrases.
Duration tools — ✓ Done. duration_tools tool parses, humanizes, converts, and adds time durations without external utilities. Input formats: '1h 30m 45s', '90 minutes', '2 days 4 hours', '5400' (seconds), '1:30:45' (HH:MM:SS), 'PT1H30M45S' (ISO 8601). 4 actions: parse (default — full breakdown by years/days/hours/minutes/seconds, compact form, and long-form human label), humanize (convert seconds to readable text; 'style: compact' for '1h 30m 45s' form), convert (express as seconds/minutes/hours/days/weeks; 'to' for a specific unit, omit for all), add (sum two durations via 'a'/'b', or sum an array via 'durations'). Zero new dependencies — pure Rust stdlib. Routing detects "parse duration", "humanize seconds", "convert duration", "seconds to hours", "how many seconds in", ISO 8601 duration prefixes, and related phrases.
Dotenv tools — ✓ Done. dotenv_tools tool parses, validates, converts, and merges .env files without external utilities. 7 actions: parse (default — display all key-value pairs with line numbers; 'show_values: false' to redact), validate (check key names, quote balance, duplicate keys; VALID/INVALID verdict), get (retrieve a specific key; last definition wins), list (key names only, no values), to-json (convert to JSON object), to-shell (generate export/SET commands; 'shell: bash' default, 'powershell', or 'cmd'), merge (overlay one .env on another; 'base' + 'overlay' text — overlay wins on conflict, base order preserved, overlay-only keys appended). Handles KEY=value, KEY="double quoted" (with \n \t \ $ \" escapes), KEY='single quoted' (no escapes), # comments (full-line), and empty values. Pass 'text' or 'env' for inline content or 'file' for a file path. Zero new dependencies — pure Rust stdlib + serde_json. Routing detects ".env", "dotenv", "merge env", "export env", "env to json", "env file" + parse/validate/load, and related phrases.
Path tools — ✓ Done. path_tools tool parses, joins, normalizes, and manipulates filesystem paths without any filesystem access (no canonicalize, no I/O). 8 actions: parse (default — parent/filename/stem/extension/absolute flag and indexed component list; shows normalized form when it differs from input), join ('base' + 'parts' array or 'paths' array; shows normalized result when it differs from joined), normalize (resolve . and .. components logically without touching the filesystem), relative (compute relative path from 'from' to 'to' using common-prefix stripping; errors on cross-root paths), basename (filename portion of path), stem (filename without final extension), extension (current extension; optional 'replace' param to swap extension), is-absolute (YES/NO verdict). Zero new dependencies — std::path. Routing detects "parse this path", "basename of", "file extension", "normalize path", "join path", "relative path", "absolute path", "is absolute", "path stem", "split path", and related phrases.
Table tools — ✓ Done. table_tools tool formats, renders, and converts tabular data without external utilities. 5 actions: format (default — render a 'headers' array and 'rows' 2D array as a formatted table), from-csv (parse CSV text into a table; RFC-4180-compliant with quoted-field and escaped-quote support; 'header: false' for headerless CSV; accepts 'text' or 'csv' field), from-json (accepts array-of-objects — uses keys from first object as headers; or array-of-arrays — renders directly without headers; accepts 'json' as inline JSON or file-path string), to-markdown (delegate to format/from-csv/from-json with markdown style override), transpose (flip rows and columns; headers are prepended as first row before transposing). Three styles: 'simple' (default — space-aligned with dash header separator), 'bordered' (ASCII box art with | and + corners), 'markdown' (GitHub-flavored with | col | and --- separator row). All styles auto-size column widths. Zero new dependencies — pure Rust stdlib + serde_json already in Cargo.toml. Routing detects "format as table", "ascii table", "align columns", "tabular format", "markdown table", "bordered table", "table from csv", "table from json", and related phrases.
ANSI tools — ✓ Done. ansi_tools tool strips, generates, measures, and parses ANSI escape sequences without external utilities. 4 actions: strip (default — remove all escape sequences from text; reports count of sequences removed), colorize (wrap text in SGR color/style codes; 'fg'/'bg' for 16-color names like red/green/blue/cyan/magenta/yellow/white/gray and bright variants; 'style' for bold/dim/italic/underline/blink/reverse/strikethrough; at least one required), length (compute visible character count excluding all escape sequences; shows raw vs visible lengths), parse (enumerate all escape sequences — type, SGR code names, byte offsets). State-machine parser handles CSI (ESC[...letter), OSC (ESC]...BEL/ST), and 2-char ESC sequences. Zero new dependencies — pure Rust stdlib. Routing detects "strip ansi", "remove escape codes", "ansi escape", "colorize text", "terminal color", "visible length", "vt100", "sgr code", and related phrases.
Template tools — ✓ Done. template_tools tool renders, lists, validates, and previews {{PLACEHOLDER}} templates without external utilities. 4 actions: render (default — substitute {{VAR}} and {{VAR|default}} from a 'vars' object; 'strict: true' errors on undefined vars without defaults; non-strict leaves undefined placeholders as-is), list (enumerate all unique variables in the template with default values and count), validate (check whether all required variables — those without defaults — are provided; VALID/INVALID verdict with missing names listed), preview (render with defined-var substitution and [MISSING:VAR] markers for absent required vars; shows DEFINED/MISSING status per variable). Char-by-char {{...}} parser; | separator for defaults. Zero new dependencies — pure Rust stdlib + serde_json. Routing detects "render template", "fill template", "variable substitution", "substitute placeholders", "mustache", "handlebars", "{{", template + variable, and related phrases.
Char tools — ✓ Done. char_tools tool inspects Unicode characters, converts codepoints, escapes/unescapes sequences, and checks character properties without external utilities. 5 actions: info (default — full Unicode detail for a char or string: codepoint U+XXXX, block name, category, decimal/hex/octal/binary representations, uppercase/lowercase variants), codepoint (char → U+XXXX for each char in 'input'; or provide 'codepoint' number/U+XXXX string to reverse-lookup the character), escape (encode non-printable or non-ASCII chars to Unicode escapes; 'style: unicode' (default) = \u{XXXXX}, 'json' = \uXXXX with surrogate pairs, 'hex' = \xXX per byte), unescape (decode \u{XXXXX}, \uXXXX, \xXX, \n, \t, \r sequences back to characters), check (test character properties for every char: is_ascii, is_alphabetic, is_numeric, is_alphanumeric, is_uppercase, is_lowercase, is_whitespace, is_control, is_ascii_punctuation — ✓/~/✗ for all/partial/none). Zero new dependencies — pure Rust stdlib. Routing detects "unicode character", "codepoint", "unicode block", "unicode escape", "escape unicode", "unescape unicode", "char category", "character info", "is alphabetic", "is numeric", and related phrases.
Stat tools — ✓ Done. stat_tools tool performs statistical analysis on number arrays without external utilities. 7 actions: describe (default — count/sum/min/max/range/mean/median/stddev/variance/Q1/Q3/IQR), histogram (ASCII bar chart; 'bins' for count default 10, 'width' for bar length default 40), percentile ('p' as single value or array like [25, 50, 75, 90, 99]), mode (most frequent values with occurrence counts and percentages; 'top' for top-N limit), outliers (values beyond N stddevs; 'threshold' sigma cutoff default 2.0; 'method: zscore' default or 'method: iqr' for IQR fence), zscore (normalize each value to z-score), correlate (Pearson r between two series; pass 'a' and 'b' arrays; reports r and plain-English interpretation). Input: 'numbers' JSON array or 'data' as comma/space/newline-delimited string. Zero new dependencies — pure Rust stdlib. Routing detects "descriptive statistics", "find outliers", "compute percentile", "pearson correlation", "mean and stddev", "histogram of", "z-score", "frequency distribution", and related phrases.
RSS tools — ✓ Done. rss_tools tool parses RSS 2.0 and Atom 1.0 feeds without external utilities or network calls. 4 actions: list (default — all entries with title/date/author/link/description snippet; 'limit' to cap, default 20), info (feed metadata: type, title, description, language, generator, last updated, author list), links (extract all entry hyperlinks with titles), search (filter entries matching 'query'/'q' against title, description, and author). HTML-stripped descriptions, CDATA-aware, namespace-tolerant. Pass 'text'/'xml'/'rss' for inline feed content or 'file' for a path to an .xml/.rss file. Uses quick-xml (already present). Routing detects "rss feed", "atom feed", "parse feed", "parse rss", "feed entries", "news feed", "podcast feed", "feed xml", and related phrases.
KeyVal tools — ✓ Done. keyval_tools tool provides a persistent key-value store backed by .hematite/kv.json — lets the model remember arbitrary facts across tool calls within a session or project. 6 actions: set (store a value; 'key' + 'value' as any JSON type), get (retrieve by key), list (show all keys/values; optional 'prefix' to scope), delete (remove a key), clear (wipe all or prefix-matched keys), keys (list key names only). Namespace support via 'namespace'/'ns' prefix automatically applied to all keys (e.g. ns='build', key='version' → 'build:version'). Store location: .hematite/kv.json in nearest parent directory with .hematite/, or ~/.hematite/kv.json as fallback. Zero new dependencies — pure Rust stdlib + serde_json. Routing detects "key-value store", "kv store", "store this value", "keyval", "store key and value", and related phrases.
Net lookup tools — ✓ Done. net_lookup_tools tool looks up well-known TCP/UDP ports, service names, and IANA IP protocol numbers without shell commands. 4 actions: port (port number → service name and description; optional 'protocol'/'proto' to filter tcp/udp), service (service name → matching port/protocol entries), search (fuzzy search across service names and descriptions; 'query'/'q'), protocol (IP protocol number or name lookup; omit args to list all ~30 IANA entries). Covers ~100 well-known ports including developer-relevant entries like LM Studio (1234), Ollama (11434), Jupyter (8888), Vite (5173), and Redis (6379). Zero new dependencies — pure Rust static tables. Routing detects "what port does X use", "what service runs on port", "look up port", "ip protocol number", "iana protocol", "well-known port", and related phrases.
Money tools — ✓ Done. money_tools tool performs financial calculations without external libraries. 8 actions: compound_interest (final amount and interest earned; 'principal', 'rate' %, 'periods' years, 'n' compounds/yr), loan (monthly payment and amortization summary; 'principal', 'annual_rate' %, 'term_months'), apr_to_apy (convert APR to effective APY; 'apr' %, 'n' compounds/yr), discount (sale price and savings; 'price', 'percent' off), percent_of (what % is A of B, or what is X% of N — two call patterns), format_currency (thousands-separated currency string; 'amount', optional 'symbol' and 'decimals'), tip (tip amount and per-person total; 'bill', 'tip_percent', 'people'), split_bill (per-person share with optional tip; 'total', 'people', 'tip_percent'). Zero new dependencies — pure Rust stdlib. Routing detects "compound interest", "loan payment", "monthly mortgage", "apr to apy", "percent discount", "tip calculator", "split the bill", "format currency", and related phrases.
Financial tools — ✓ Done. financial_tools tool performs extended financial analysis without external libraries. 7 actions: amortize (default — full amortization schedule with optional month-by-month table; pass 'principal', 'annual_rate' %, 'term_months'; optional 'show_schedule' bool), depreciation (asset depreciation schedule; pass 'cost', 'salvage', 'life_years', 'method': straight_line/declining_balance/sum_of_years/macrs5/macrs7), roi (return on investment with optional annualized ROI; pass 'initial', 'final'; optional 'years'), breakeven (break-even analysis with margin of safety; pass 'fixed_costs', 'price_per_unit', 'variable_cost'; optional 'expected_units'), cashflow (NPV + IRR via bisection + payback period; pass 'cashflows' array with first element as negative initial investment, 'discount_rate' %), cagr (compound annual growth rate with projection table; pass 'start_value', 'end_value', 'years'), savings (savings goal planner with time-to-target; pass 'target', 'monthly_contribution'; optional 'current_savings', 'annual_rate' %, 'years'). Pure Rust stdlib, zero new dependencies. Routing detects "amortization", "amortize", "amortisation", "depreciation", "straight line depreciation", "double declining", "sum of years", "macrs", "roi calculation", "return on investment", "break-even", "breakeven", "npv calculation", "net present value", "internal rate of return", "irr", "cagr", "compound annual growth", "savings goal", "savings planner", "payback period", "cash flow analysis", "financial_tools", and related phrases.
Size tools — ✓ Done. size_tools tool parses, converts, formats, and compares data sizes (bytes ↔ KB/MB/GB/TB/PB and binary KiB/MiB/GiB/TiB/PiB) and estimates bandwidth transfer times without shell commands. 5 actions: convert (default — show all conversions; optional 'to' for a specific unit), parse (resolve a size string to bytes + human-readable forms), format (auto/decimal/binary human-readable label), compare (compare two sizes 'a'/'b' — ratio, difference, larger/smaller verdict), bandwidth (estimate transfer time given 'speed' like "100 Mbps"; or compute speed given 'time'; omit both for a transfer-time table across 6 common speeds). Accepts all SI and IEC units including "k"/"m"/"g" shorthands. Zero new dependencies — pure Rust stdlib. Routing detects "convert bytes", "bytes to mb/gb", "gb to tb", "file size convert", "transfer time", "how long to download", "bandwidth calculation", "mebibyte", and related phrases.
Validate tools — ✓ Done. validate_tools tool validates 12 common data formats without external utilities. Actions: email (RFC 5321 structural check with local/domain breakdown), ipv4 (octet validation + class/private/loopback annotation), ipv6 (std::net parser + expanded form), cidr (IPv4/IPv6 prefix — shows network/broadcast/mask/host count), mac (colon or dash separated, 6-group validation, multicast/locally-administered flags, normalized form), url (scheme/host structural check, HTTPS warning), credit_card (Luhn algorithm + Visa/Mastercard/Amex/Discover network detection, masked form), isbn (ISBN-10 and ISBN-13 check digit), uuid (8-4-4-4-12 format, RFC 4122 version/variant), phone (NANP 10-digit US/CA with formatting + E.164 international), semver (SemVer 2.0 — major/minor/patch/pre-release/build-meta), hex_color (#3/#4/#6/#8 hex with RGB breakdown, brightness, luminance). auto action detects format automatically. Pass 'value'/'input'/'text'. Zero new dependencies — pure Rust stdlib + std::net. Routing detects "validate email", "valid url", "validate cidr", "luhn check", "validate isbn", "valid uuid", "validate mac", and related phrases.
Word tools — ✓ Done. word_tools tool performs word frequency analysis, anagram detection, Soundex phonetic matching, palindrome checking, and syllable counting without external utilities. 5 actions: frequency (default — ranked word frequency table with per-word percentage; 'text', optional 'top' N (default 20), 'stop_words' bool to filter common words (default true)), anagram (check if two strings are anagrams with letter-by-letter breakdown; 'a' and 'b' fields), soundex (Soundex phonetic code per word; 'word', 'words' array, or 'text'; groups phonetically similar words with ← markers), palindrome (check if text is a palindrome; 'text'; optional 'strict' bool; finds word-level palindromes and longest palindromic substring), syllables (syllable count per word with totals and Flesch-Kincaid grade level estimate; 'text'). Zero new dependencies — pure Rust stdlib. Routing detects "word frequency", "most common words", "anagram", "soundex", "phonetic match", "palindrome", "syllable", "syllables", "flesch-kincaid", "count syllables", and related phrases.
Time zone tools — ✓ Done. time_zone_tools tool converts times between timezones, lists timezone offsets, and shows a world clock without external utilities. 4 actions: convert (default — convert a datetime from one timezone to another; 'datetime' as ISO 8601 or 'YYYY-MM-DD HH:MM:SS', 'from' source timezone, 'to' target timezone), list (list all supported timezone abbreviations with UTC offsets; optional 'filter' string), offset (get UTC offset for a timezone; 'tz' field), world_clock (show current or given UTC time in multiple zones; 'zones' as string array or object array; defaults to current system time when no datetime provided). Accepts named zones (UTC, EST, PST, IST, JST, CET, etc.) and numeric offsets (+05:30, -07:00). Zero new dependencies — pure Rust stdlib. Routing detects "time zone", "timezone", "convert time", "utc offset", "world clock", "time difference", "pst to est", "ist to utc", "list timezones", and related phrases.
String metric tools — ✓ Done. string_metric_tools tool computes string similarity and edit distance metrics without external utilities. 8 actions: levenshtein (default — minimum edit operations with similarity %; 'a' and 'b' fields), damerau (Damerau-Levenshtein distance with adjacent-transposition support), jaro (Jaro similarity 0–1), jaro_winkler (Jaro-Winkler with common-prefix boost), hamming (character mismatch positions for equal-length strings; errors on length mismatch), lcs (longest common subsequence length and the recovered subsequence), similarity (all four metrics in one comparison table with average and plain-English verdict), fuzzy (rank a list of candidates by composite JW+LCS score; 'query' and 'candidates' array). All algorithms pure Rust DP — no external crates. Routing detects "levenshtein", "edit distance", "jaro-winkler", "hamming distance", "fuzzy match", "string similarity", "string distance", "lcs", "longest common subsequence", and related phrases.
Calc tools — ✓ Done. calc_tools tool evaluates mathematical expressions, runs RPN calculations, manages variable sessions, and generates numeric sequences without external utilities. 4 actions: eval (default — infix expression evaluator with 30+ functions including sqrt, abs, ceil, floor, round, ln, log, log2, exp, sin/cos/tan and inverses, atan2, sinh/cosh/tanh, factorial, gcd, lcm, choose/nCk, clamp, sign, hypot; named constants pi, e, tau, phi; variable binding via 'x=3; x^2+1' multi-statement syntax), rpn (Reverse Polish Notation postfix stack calculator), variables (multi-statement variable session with full expression support), sequence (generate arithmetic/geometric/fibonacci/triangular/prime/custom sequences; 'type' and 'count' fields). Pure Rust recursive-descent parser, zero new dependencies. Routing detects "evaluate expression", "rpn calculator", "math expression", "factorial(", "sequence generator", "infix expression", "reverse polish", and related phrases.
Fraction tools — ✓ Done. fraction_tools tool performs fraction arithmetic, simplification, decimal-to-fraction conversion, comparison, and mathematical series without external utilities. 8 actions: simplify (default — reduce to lowest terms; shows GCD, mixed-number form, decimal, percent; 'fraction' string like "6/9" or 'numerator'/'denominator' integers), add/sub/mul/div (binary arithmetic on two fractions; 'a' and 'b' as fraction strings; shows result with mixed-number and decimal forms), convert ('fraction' → decimal/percent/mixed-number, or 'decimal' number → fraction via continued-fraction algorithm; optional 'tolerance'), compare ('a'/'b' pair shows relation and difference; 'fractions' array ranks sorted ascending), series ('type': harmonic (partial sums 1+1/2+1/3+... ; 'terms' N), egyptian (proper fraction decomposed into unit fractions; 'fraction'), farey (Farey sequence F_n; 'n')). Zero new dependencies — pure Rust stdlib. Routing detects "fraction", "simplify fraction", "add fractions", "decimal to fraction", "harmonic series", "egyptian fraction", "farey sequence", "rational number", "lowest terms", and related phrases.
Number sequence tools — ✓ Done. number_sequence_tools tool analyzes and extends numeric sequences without external utilities. 4 actions: detect (default — identify pattern type: arithmetic, geometric, Fibonacci-like, polynomial via finite differences, perfect squares, cubes, triangular, power-of-2, primes, or constant), continue (extend the sequence by N more terms using the detected pattern), diff (show Newton's forward difference table to reveal polynomial degree), stats (count/min/max/sum/mean/stddev/net change/growth%/avg step with pattern hint). Input: 'numbers' array or 'data' comma-separated string. Routing detects "number sequence", "sequence pattern", "continue the sequence", "next terms", "what comes next in", "difference table", "arithmetic sequence", "geometric sequence", "fibonacci sequence", "triangular numbers", and related phrases.
Number words tools — ✓ Done. number_words_tools tool converts numbers to/from English words without external utilities. 6 actions: to_words (default — integer → English words like 'one thousand two hundred thirty-four'), to_ordinal (integer → ordinal word like 'forty-second'), from_words (English word text → integer; handles hyphens, 'and', negative/minus), currency (amount → 'one hundred twenty-three dollars and forty-five cents'; currency_name: dollar/euro/pound), digits (spell each digit: 123 → 'one two three'), roman (integer → Roman numeral via 'number'; Roman → integer via 'text'; also shows English words). Handles integers up to 999 quadrillion, negatives, 'uppercase: true'. Routing detects "number to words", "spell out the number", "ordinal number", "roman numeral", "amount in words", "currency words", "words to number", "spell digits", and related phrases.
Music tools — ✓ Done. music_tools tool performs music theory calculations without external utilities. 6 actions: note (default — note name like 'A4' → frequency in Hz + MIDI number; or 'frequency' arg → nearest note name with tuning offset in cents; A4=440 Hz reference), chord (list notes in a named chord: 'root'+'quality' → note list with intervals; or 'notes' array → detect chord name; supports major/minor/dim/aug/sus2/sus4/dominant7/major7/minor7/dim7/half-dim/add9/power/6/9 and more), scale (list all notes in a named scale: 'root'+'quality'; supports major, natural/harmonic/melodic minor, all 7 modes, pentatonic, blues, whole tone, diminished, chromatic, Japanese scales), interval (name the interval between 'note' and 'note2': Unison through Octave + compound intervals + frequency ratio), midi ('note' → MIDI number or 'midi' number → note name; A4=69, C4=60), tempo ('bpm' + optional 'duration' → note duration in ms; shows whole/half/quarter/eighth/sixteenth/dotted/triplet durations at the given tempo). Zero new dependencies — pure Rust stdlib math. Routing detects "music note", "note frequency", "frequency of", "a4 440", "midi note", "music chord", "major chord", "minor chord", "music scale", "major scale", "minor scale", "pentatonic", "music interval", "perfect fifth", "bpm to ms", "tempo calculation", and related phrases.
Periodic tools — ✓ Done. periodic_tools tool provides periodic table lookups and molar mass calculations without external utilities. 5 actions: element (default — full detail for one element by symbol, name, or atomic number: mass, density, melting/boiling point, electronegativity, electron configuration, period/group, category), search (fuzzy filter by name substring or category; pass 'query' and/or 'category'), list (tabular listing of all 118 elements; optional 'category' filter), compare (side-by-side property table for two elements; 'symbol'/'name' + 'element2'), mass (molar mass calculator for a chemical formula like 'H2O' or 'C6H12O6'; shows per-element contribution with percentage breakdown). Full 118-element table. Zero new dependencies — pure Rust static table. Routing detects "periodic table", "element symbol", "atomic number", "atomic mass", "molar mass", "molecular weight", "electronegativity", "melting point of", "noble gas", "transition metal", "alkali metal", and related phrases.
Vector tools — ✓ Done. vector_tools tool performs 2D/3D (and nD) vector math without external utilities. 11 actions: info (default — magnitude, unit vector, angle from +x for 2D; pass 'v' or 'vector' as JSON array), add (a+b), subtract (a-b), scale (v × scalar; 'scalar' field), dot (dot product + angle between + perpendicularity check; 'a' and 'b'), cross (3D cross product with magnitude; 'a' and 'b' must be 3D), magnitude (|v| and |v|²), normalize (unit vector with verification), angle (angle in degrees and radians; detects perpendicular/parallel/antiparallel), project (scalar projection, vector projection, perpendicular part; 'a' onto 'b'), reflect (reflect v over normal n; 'n' auto-normalized). Zero new dependencies — pure Rust stdlib math. Routing detects "dot product", "cross product", "vector magnitude", "normalize vector", "unit vector", "vector addition", "subtract vectors", "scale vector", "angle between vectors", "vector projection", "reflect vector", "2d vector", "3d vector", "orthogonal vectors", and related phrases.
Sort tools — ✓ Done. sort_tools tool demonstrates and compares sorting algorithms with step traces without external utilities. 4 actions: sort (default — sort a 'numbers' array with a named 'algorithm': bubble/selection/insertion/merge/quick/heap/shell/counting/radix; shows sorted output, comparisons, swaps, up to 20 step trace entries, and time/space complexity; omit 'algorithm' for merge sort default), compare (run all 9 algorithms on the same input and show a comparison table of comparisons, swaps, steps, and complexity side-by-side), analyze (analyze the input array for already-sorted %, near-sorted %, unique value count, min/max/range/mean, and recommend the best algorithm with reasoning), search (binary search — 'numbers' array + 'target' value; returns index or 'not found'; shows per-iteration probe sequence). Optional: 'max_steps' to cap trace output (default 20). Zero new dependencies — pure Rust stdlib. Routing detects "sort this list", "sort these numbers", "sort algorithm", "sorting algorithm", "bubble sort", "merge sort", "quick sort", "heap sort", "insertion sort", "selection sort", "shell sort", "counting sort", "radix sort", "compare sorting", "binary search", and related phrases.
Compression tools — ✓ Done. compression_tools tool demonstrates lossless compression algorithms and text analysis without external utilities. 4 actions: rle (default — Run-Length Encoding encode/decode; 'encode' mode: consecutive repeated chars collapsed to count+char; 'decode' mode: reverse; 'text' required; reports original size, encoded size, ratio, and savings); lz (LZ77 sliding-window compression; 'text' required; optional 'window' and 'lookahead' sizes; reports token stream — Literal(char) or BackRef{offset,length} — and compressed size estimate), analyze (Shannon entropy analysis; 'text' required; reports character frequency table, entropy in bits/char, theoretical minimum bits total, compressibility classification: Highly/Moderately/Slightly/Not compressible), huffman (Huffman coding; 'text' required; builds optimal prefix-free code via iterative weight-merging; reports code length per symbol, weighted avg bits/char, estimated compressed size, and savings vs plain ASCII). Zero new dependencies — pure Rust stdlib. Routing detects "run-length encoding", "rle encode", "rle decode", "lz77", "lz compression", "compress this text", "huffman coding", "huffman encoding", "shannon entropy", "entropy of text", "text compression", "lossless compression", "compression algorithm", and related phrases.
Trie tools — ✓ Done. trie_tools tool provides prefix tree (trie) operations without external utilities. Pass 'words' as a JSON array or space/comma-separated string. 6 actions: build (default — insert words into a trie and render ASCII tree; * marks end-of-word), search (exact match lookup; 'query'; reports FOUND / NOT FOUND / prefix exists), prefix (all words sharing a given prefix; 'query', optional 'limit'), autocomplete (ranked completions for a prefix; 'query', optional 'limit'), count (node count, word count, max depth), suggest (typo-tolerant suggestions within edit distance 1, fallback to distance 2; 'query'). Optional: case_insensitive, limit. Zero new dependencies — pure Rust stdlib + HashMap. Routing detects "trie", "prefix tree", "autocomplete words", "prefix search", "words with prefix", "build trie", "typo suggestions", and related phrases.
Stack tools — ✓ Done. stack_tools tool simulates stack, queue, and deque data structures and evaluates expressions without external utilities. 5 actions: stack (default — LIFO stack with step-by-step operation trace; 'operations' string array; ops: "push ", "pop", "peek", "size", "clear"), queue (FIFO queue with trace; ops: "enqueue ", "dequeue", "peek", "size", "clear"), deque (double-ended queue; ops: push_front/push_back/pop_front/pop_back/peek_front/peek_back/size/clear), evaluate (auto-detects RPN or infix expression from 'expression' string; infix uses shunting-yard algorithm with step trace; RPN uses stack evaluation with step trace; operators: +/-/*//%/^), balance (bracket/parenthesis balance check for (), [], {}; 'expression'; reports BALANCED or mismatch location). Pass 'initial' as a JSON array to pre-populate any structure. Zero new dependencies — pure Rust stdlib. Routing detects "stack data structure", "lifo stack", "push and pop", "queue data structure", "fifo queue", "deque", "rpn expression", "reverse polish", "infix expression", "shunting yard", "bracket balance", "parenthesis balance", "expression evaluation", and related phrases.
Logic tools — ✓ Done. logic_tools tool performs propositional logic operations without external utilities. 8 actions: truth_table (default — full truth table for 'expression'; classifies as TAUTOLOGY/CONTRADICTION/CONTINGENCY with true-row percentage; max 8 variables), evaluate ('expression' + 'variables' object {A: true, B: false} → T/F result), sat (find satisfying variable assignments — reports SATISFIABLE with examples or UNSATISFIABLE; max 20 vars), tautology (check if always true; shows counterexample if not), contradiction (check if always false; shows witness assignment if not), simplify (show minterm expansion as DNF from truth table), cnf (convert to Conjunctive Normal Form via NNF + distribution), dnf (convert to Disjunctive Normal Form via NNF + distribution). Operators: and/&&, or/||, not/!, xor/^, implies/->, iff/<->. Variables: any identifier. Canonical output uses ∧/∨/¬/→/↔/⊕ Unicode symbols. Zero new dependencies — pure Rust recursive-descent parser. Routing detects "truth table", "propositional logic", "boolean logic", "boolean expression", "satisfiable", "tautology", "contradiction", "cnf form", "dnf form", "conjunctive normal form", "evaluate logic", "p implies q", "simplify boolean", and related phrases.
Inflect tools — ✓ Done. inflect_tools tool inflects English words — plurals, verb forms, and possessives — without external utilities. 7 actions: pluralize (default — singular → plural; irregular table first, then rule-based -es/-ies/-ves/+s; uncountable nouns returned unchanged), singularize (plural → singular; reverse irregular table + suffix rules), pluralize_with (attach a count and the correct singular/plural form: '3 items'), verb_third (third-person singular present: 'run' → 'runs'), verb_ing (present participle: 'run' → 'running'; CVC doubling handled), verb_past (simple past: 'run' → 'ran'; CVC doubling for regulars), noun_possessive (possessive form: 'dog' → "dog's", 'class' → "class'"). ~60 irregular plural entries, ~80 irregular verb entries, 25+ uncountable nouns. Preserves input case (ALL CAPS or Titlecase). Zero new dependencies — pure Rust stdlib. Routing detects "pluralize this", "plural form of", "plural of", "make plural", "singularize", "verb conjugation", "third person singular", "present participle", "past tense of", "possessive form", "word inflection", and related phrases.
Text align tools — ✓ Done. text_align_tools tool aligns and formats text without external utilities. 6 actions: align (default — left/right/center/justify each line to a target width; 'fill' character for padding), columns (format multiple text columns side-by-side; 'columns' array of {text, align?, width?}; 'separator' default ' '), indent (add or remove indentation: positive 'indent_width' adds prefix chars, negative removes leading chars; 'indent_char' space or tab), normalize (collapse internal space runs, strip trailing whitespace, standardize line endings — preserves leading indent), center_block (center an entire block as a unit by padding all lines from the left based on the widest line), ruler (generate a character ruler with ·/+/| tick marks and column numbers at every tenth; 'width' default 80). Justify distributes spaces evenly between words. Zero new dependencies — pure Rust stdlib. Routing detects "align text", "right align", "center align", "justify text", "align columns", "column layout", "add indentation", "remove indentation", "normalize whitespace", "center this block", "alignment ruler", and related phrases.
Number theory tools — ✓ Done. number_theory_tools tool performs pure number-theory calculations without external utilities. 10 actions: factor (default — prime factorization, all divisors, divisor sum σ(n), perfect/abundant/deficient classification; 'n'), primes ('limit' for sieve listing via Sieve of Eratosthenes; 'nth' for the Nth prime; 'test' for single-number primality check with factorization), gcd/lcm ('a'/'b' pair or 'numbers' array; gcd shows Bézout coefficients and coprimality), totient (Euler phi function; 'n'), modpow (fast modular exponentiation; 'base', 'exp', 'modulus'), modinv (modular inverse via extended Euclidean; 'a', 'modulus'; reports if none exists), collatz (Collatz sequence to 1; 'n'; shows stopping time, max value, full sequence), fibonacci (first N numbers via 'n'; specific index via 'nth'; membership test via 'test'; golden ratio approximation), perfect (classify n as perfect/abundant/deficient via 'n'; or scan range via 'limit'). Zero new dependencies — pure Rust stdlib. Routing detects "prime factorization", "is prime", "list primes", "euler totient", "modular inverse", "modpow", "collatz", "fibonacci sequence", "perfect number", "number theory", "coprime", and related phrases.
Geo tools — ✓ Done. geo_tools tool performs geographic coordinate calculations without external utilities. 6 actions: distance (default — Haversine great-circle distance between two lat/lng points; 'lat1','lng1','lat2','lng2'; returns km, miles, nautical miles, and initial bearing with compass point), bearing ('lat1','lng1','lat2','lng2' — initial and back bearing in degrees with compass point), midpoint (geographic centroid via 3D Cartesian averaging; handles antimeridian; 'lat1'/'lng1'/'lat2'/'lng2' or 'points' [[lat,lng],...] array), dms (decimal degrees ↔ DMS conversion; decimal mode: 'lat'+'lng' → DMS string; DMS mode: 'lat_d'/'lat_m'/'lat_s'/'lat_dir' + 'lng_d'/'lng_m'/'lng_s'/'lng_dir' → decimal), bbox (bounding box of a set of points; 'points' array → N/S/E/W bounds, center, width/height in km), destination (project a point at a given distance and bearing; 'lat','lng','distance' km, 'bearing' degrees). Lat/lng validation (-90–90, -180–180). Zero new dependencies — pure Rust stdlib math. Routing detects "haversine", "great circle", "gps coordinates", "latitude longitude", "degrees minutes seconds", "dms coordinates", "geographic distance", "distance between coordinates", "compass bearing", "geographic midpoint", "bounding box coordinates", and related phrases.
Data gen tools — ✓ Done. data_gen_tools tool generates test/mock data without external utilities or network calls. 6 actions: lorem (default — Lorem ipsum text from 110-word corpus; 'count' items, 'unit': words/sentences/paragraphs; deterministic with optional 'seed'), name (random person names from 50 first × 50 last names; 'count'), email (random email addresses from first.last@domain pattern; 'count'; optional 'domain' override), numbers (random integers or floats in range; 'count', 'min', 'max'; 'float: true' with 'decimals' precision; optional 'separator'), dates (random calendar dates in range; 'count', 'from'/'to' as YYYY-MM-DD; 'format': iso/us/eu/long; custom day-of-month math handles leap years), id (generate IDs; 'count', 'kind': seq/hex/uuid; seq: 'prefix', 'start', 'pad'; uuid generates v4-format UUIDs). All actions accept optional 'seed' for reproducible output. Zero new dependencies — pure Rust stdlib + LCG PRNG. Routing detects "lorem ipsum", "generate lorem", "fake names", "random names", "test data generation", "generate test data", "mock data", "dummy data", "random emails", "fake email", "generate ids", "fake uuid", "random dates", "test fixture", "placeholder data", and related phrases.
Cipher tools — ✓ Done. cipher_tools tool encodes and decodes classical ciphers and performs cipher analysis without external utilities. 6 actions: rot13 (default — ROT13 is its own inverse; works in place), caesar (configurable shift 0–25 with encode/decode flag; shows all-shifts brute-force table for short messages), vigenere (repeating keyword stream cipher; 'key' must be ASCII alphabetic; encode/decode flag), atbash (mirror substitution A↔Z, B↔Y; self-inverse), rail_fence (transposition cipher with configurable 'rails'; shows rail diagram for short messages), analyze (letter frequency table, Index of Coincidence, and Caesar brute-force guess — IC > 0.060 suggests monoalphabetic, < 0.045 suggests polyalphabetic or transposition). Zero new dependencies — pure Rust stdlib. Routing detects "caesar cipher", "vigenere", "rot13", "atbash", "rail fence", "classical cipher", "frequency analysis", "index of coincidence", "cipher break", and related phrases.
Unit tools — ✓ Done. unit_tools tool converts values between units of measurement across 13 categories without external utilities. 3 actions: convert (default — 'value' number, 'from' unit name/symbol, optional 'to' target unit; omit 'to' to see all conversions in the same category), list (all supported units; optional 'category' to filter), categories (all 13 categories with unit counts). 13 categories: length (18 units including light years, parsecs, furlongs), mass (13), temperature (4: Celsius base; Fahrenheit/Kelvin/Rankine via affine conversion), area (10), volume (17 including US/imperial culinary units and barrels), speed (6 including Mach), energy (11), power (8 including horsepower/PS), pressure (9), time (12), angle (6 including arcminutes/arcseconds), fuel (4: L/100km, mpg US/Imperial, km/L), frequency (5). Zero new dependencies — pure Rust stdlib. Routing detects "convert meters", "convert km", "convert kg", "convert celsius", "unit conversion", "metres to feet", "km to miles", "fahrenheit to celsius", "celsius to fahrenheit", "convert knots", "litres to gallons", "convert horsepower", "convert psi", "convert hertz", "list units", and related phrases.
Geometry tools — ✓ Done. geometry_tools tool computes geometric properties without external utilities. 5 actions: area (default — 'shape' + dimensions → area; shapes: rectangle/width+height, square/side, circle/radius, ellipse/a+b, triangle/base+height or a+b+c sides via Heron's formula, trapezoid/a+b+height, parallelogram/base+height, rhombus/d1+d2, regular_polygon/sides+side_length, sector/radius+angle), volume ('shape' + dimensions → volume and surface area; shapes: cube/side, rectangular_prism/width+height+depth, sphere/radius, hemisphere/radius, cylinder/radius+height, cone/radius+height with slant, pyramid/base_area+height, torus/major_radius+minor_radius), perimeter (same shapes as area, ellipse uses Ramanujan approximation), triangle (comprehensive solver; 'a','b','c' for SSS or 'a','b','angle_c' for SAS — returns all three angles via law of cosines, area via Heron's, perimeter, inradius, circumradius, and type classification: Acute/Right/Obtuse × Equilateral/Isosceles/Scalene), circle (comprehensive circle math; provide any one of radius/diameter/circumference/area → all others derived; optional 'angle' in degrees for arc length, sector area, and chord length). Zero new dependencies — pure Rust stdlib. Routing detects "area of a circle", "area of a rectangle", "area of a triangle", "volume of a sphere", "volume of a cylinder", "surface area of", "perimeter of a", "solve triangle", "triangle angles", "right triangle", "inradius", "circumradius", "circle circumference", "arc length", "sector area", "calculate area", "calculate volume", and related phrases.
Checksum tools — ✓ Done. checksum_tools tool computes non-cryptographic checksums for error detection without external utilities. 6 actions: all (default — run all algorithms in one pass), crc8, crc16, crc32, adler32, fletcher16. Input: 'text' (UTF-8) or 'hex' (hex-encoded bytes). Pure Rust implementations: CRC-8 (poly 0x07), CRC-16/MODBUS (0xA001 reflected, init 0xFFFF), CRC-32 IEEE (0xEDB88320 reflected, pre/post XOR 0xFFFFFFFF), Adler-32 (rolling sum mod 65521), Fletcher-16 (dual checksum mod 255). Zero new dependencies — pure Rust stdlib. Routing detects "crc32", "crc-32", "crc16", "crc8", "adler32", "fletcher", "fletcher16", "checksum", "cyclic redundancy", "error detection checksum", "compute checksum", and related phrases.
ID tools — ✓ Done. id_tools tool generates and decodes structured unique identifiers without external utilities. 4 actions: ulid (default — ULID: 26-char Crockford base32, 48-bit millisecond timestamp + 80-bit random; time-sortable; 'count' up to 100, optional 'seed'), nanoid (URL-safe NanoID with configurable 'size' 1–256 and custom 'alphabet'; default 21 chars from base64url+underscore/dash), snowflake (Twitter/Discord-style 64-bit integer: 41-bit elapsed ms + 10-bit 'machine_id' + 12-bit sequence; custom epoch 2024-01-01T00:00:00Z), decode (detect and decode a ULID or Snowflake ID — shows timestamp, random part, machine ID, and sequence). LCG PRNG seeded by SystemTime for live generation or optional deterministic 'seed'. Zero new dependencies — pure Rust stdlib. Routing detects "ulid", "generate ulid", "nanoid", "nano id", "snowflake id", "snowflake id generate", "time-sortable id", "decode ulid", "decode snowflake", and related phrases.
HAR tools — ✓ Done. har_tools tool parses and analyzes HTTP Archive (.har) files for web performance analysis without external utilities. 6 actions: summary (default — entry count, unique domains, error count, total time/size, status distribution, MIME type breakdown), entries (tabular list of all requests with status/method/time/size/URL; 'limit' caps rows), slowest (top N slowest with per-phase timing breakdown: DNS/connect/SSL/send/wait/receive; 'n' default 10), errors (filter 4xx/5xx/network-error entries only with labels), domains (per-domain request count, cumulative time, total bytes — sorted slowest first), search (filter entries by URL substring; pass 'query' or 'q'). Input: 'har' parsed JSON object, 'json'/'text' JSON string, or 'file' path to a .har file. Zero new dependencies — serde_json already in Cargo.toml. Routing detects ".har file", "http archive", "parse har", "slowest requests", "web performance", "network waterfall", "request timing", "browser network log", "chrome devtools export", and related phrases.
iCalendar tools — ✓ Done. ical_tools tool parses and inspects iCalendar (.ics) files without external utilities. 5 actions: parse (default — all VEVENT and VTODO components with title, start/end, location, status, organizer, recurrence, and description snippet), events (same as parse, VEVENT only), todos (VTODO items with due date, status, and priority), info (calendar-level metadata: iCal version, producer, calendar name, timezone, component counts by type), search (filter events/todos by keyword across all fields; pass 'query' or 'q'). Handles line unfolding per RFC 5545, CDATA, parameter stripping, DTSTART/DTEND formatting. Input: 'text'/'ical'/'ics' with iCalendar content, or 'file' path to a .ics file. Zero new dependencies — pure Rust stdlib. Routing detects ".ics file", "ical file", "icalendar", "parse ics", "calendar events", "vevent", "vtodo", "recurring event", "outlook calendar export", "google calendar export", and related phrases.
Graph tools — ✓ Done. graph_tools tool performs graph algorithm operations without external utilities. 7 actions: info (default — node/edge counts, density, in/out degree distribution; pass 'nodes' array and 'edges' array), bfs (breadth-first search from 'start' — level order, visited list, parent map), dfs (depth-first search from 'start' — discovery order, finish order, back/forward edges), shortest (Dijkstra's shortest path between 'start' and 'end'; shows cost and full path), topo (topological sort via Kahn's algorithm; detects and names cycles), cycles (cycle detection — DFS back-edge for directed, union-find for undirected), components (BFS connected components for undirected; Kosaraju's two-pass SCC for directed). Pass 'directed: true' for directed graphs (default: undirected). Edges: array of {from, to, weight?} objects or [from, to, weight?] arrays. Zero new dependencies — pure Rust stdlib. Routing detects "bfs traversal", "breadth first search", "dfs traversal", "depth first search", "shortest path", "dijkstra", "topological sort", "topo sort", "detect cycle", "graph cycle", "connected components", "strongly connected", "graph theory", and related phrases.
Matrix tools — ✓ Done. matrix_tools tool performs linear algebra matrix operations without external utilities. 7 actions: info (default — shape, rank, trace, determinant, min/max/mean, invertibility; pass 'matrix'), multiply (A×B; pass 'a' and 'b' as 2D arrays), transpose (flip rows/columns; pass 'matrix'), determinant (det(A) via LU; pass 'matrix' — must be square), inverse (A⁻¹ via LU with verification A×A⁻¹≈I; pass 'matrix' — square and invertible), solve (solve Ax=b via Gaussian elimination with residual verification; pass 'matrix' and 'vector'), rank (matrix rank via row reduction with nullity; pass 'matrix'). Matrix format: JSON array of arrays e.g. [[1,2],[3,4]]. Zero new dependencies — pure Rust stdlib. Routing detects "matrix multiply", "multiply matrices", "matrix transpose", "matrix determinant", "determinant of", "matrix inverse", "invert matrix", "solve linear", "linear system", "gaussian elimination", "matrix rank", "rank of matrix", "linear algebra", and related phrases.
Graphviz tools — ✓ Done. graphviz_tools tool generates and parses Graphviz DOT language without external utilities. 4 actions: generate (default — produce DOT output from 'nodes' and 'edges' arrays; 'directed: true' for digraph; 'rankdir' for layout direction; nodes accept {id, label} objects; edges accept {from, to, label} objects), parse (extract nodes and edges from DOT source text; reports directed/undirected, node list, edge list with labels), flowchart (sequential top-down flowchart from 'steps' array with oval start/end nodes), tree (tree-structured DOT from 'root' string and 'children' array with optional nested children). Output includes render commands for dot -Tpng/-Tsvg/-Tpdf. Zero new dependencies — pure Rust stdlib. Routing detects "graphviz", "dot language", "dot graph", "generate dot", "parse dot", "dot file", "digraph", "graph viz", "graphviz flowchart", "graphviz tree", and related phrases.
Mermaid tools — ✓ Done. mermaid_tools tool generates Mermaid.js diagram syntax without external utilities. 6 actions: flowchart (default — from 'nodes'/'edges' arrays or 'steps' shorthand; 'direction' TD/LR/RL/BT; node 'shape': box/diamond/circle/stadium/cylinder), sequence (sequence diagram from 'messages' array with {from, to, label, type: sync/async/lost}), class (UML class diagram from 'classes' array with {name, fields, methods} and 'relationships' array), gantt (project timeline from 'sections' with task arrays), pie (pie chart from 'data' object {label: value}), er (entity-relationship diagram from 'entities' and 'relationships' arrays). Output is a fenced ```mermaid code block ready for GitHub/GitLab/Notion/Obsidian/mermaid.live. Zero new dependencies — pure Rust stdlib. Routing detects "mermaid", "mermaid diagram", "mermaid flowchart", "sequence diagram", "class diagram", "er diagram", "gantt chart", "pie chart mermaid", "mermaid.live", and related phrases.
DNS tools — ✓ Done. dns_tools tool parses and analyzes DNS zone files and DNS records without external utilities. 4 actions: parse (default — list all resource records in a NAME/TTL/TYPE/DATA table grouped by type; shows $ORIGIN/$TTL directives; per-type count summary), records (filter by type — pass 'type' arg e.g. "MX"/"TXT"/"A"), validate (zone file compliance checks: missing SOA, fewer than 2 NS records, CNAME at zone apex, MX pointing to CNAME, duplicate A/AAAA for same name, TXT strings over 255 chars, multiple SPF records per name per RFC 7208), explain (plain-English breakdown per record type; SPF decoded token-by-token include:/ip4:/-all/~all; DMARC decoded per tag p=/rua=/pct=; DKIM noted; CAA policy explained; SOA fields labelled). Handles parenthesised multi-line continuation, inline semicolon comments, optional name/TTL/class fields. Input: 'text'/'zone' for inline content or 'file' for a path. Zero new dependencies — pure Rust stdlib. Routing detects "dns zone", "zone file", "parse dns", "analyze dns", "spf record", "dkim record", "dmarc record", "validate zone", "dns records", "mx records", "txt records", "ns records", "soa record", and related phrases.
CSS tools — ✓ Done. css_tools tool parses, validates, and analyzes CSS stylesheets without external utilities. 5 actions: parse (default — list selectors with line number, property count, and key declarations; at-rule summary with nested rule counts), validate (duplicate selectors, empty rule blocks, duplicate properties per rule, !important overuse >5, vendor prefix without standard counterpart, selector depth >4, invalid hex color length, z-index >9999, unknown pseudo-elements), vars (defined --custom-property variables with values and containing selectors; var() usage counts; variables used but not defined), stats (total rules/declarations/unique selectors, at-rule breakdown, top-10 most-used properties, selector complexity distribution, color values found, file size with gzip estimate, !important count, CSS variable count), minify (strip block and line comments, collapse whitespace, remove trailing semicolons before }; reports size reduction %). Input: 'text'/'css' for inline CSS or 'file' for a path. Uses regex crate (already in Cargo.toml). Routing detects "parse css", "css file", "css selector", "css variables", "css custom properties", "minify css", "validate css", "stylesheet", "css stats", "duplicate selectors", "css !important", "vendor prefix", and related phrases.
HTTP parse tools — ✓ Done. http_parse_tools tool parses raw HTTP/1.1 request and response messages without external utilities. 6 actions: parse (default — auto-detect request vs response and display all fields), request (method/URL/version, query parameters, headers table, content-type analysis, body preview), response (status code/reason/version, status meaning, headers table, redirect/error flags, body preview), headers (header annotations with known meanings; security header gap check for responses: X-Content-Type-Options, X-Frame-Options, CSP, HSTS), cookies (Cookie: request parsing + Set-Cookie: response parsing with Domain/Path/Expires/Secure/HttpOnly/SameSite; XSS/CSRF risk flags), auth (decode Basic auth username, identify Bearer tokens and JWT shape, parse Digest realm/nonce/algorithm, detect API key headers). Input: 'text'/'http'/'message' for inline HTTP text or 'file' path. Zero new dependencies — pure Rust stdlib. Routing detects "parse http request", "parse http response", "raw http", "http headers", "decode http cookies", "authorization header", "bearer token header", "set-cookie header", "http message", and related phrases.
jq tools — ✓ Done. jq_tools tool queries, filters, and transforms JSON using a jq-inspired path syntax without external utilities. 8 actions: query (default — evaluate a dot-path expression: .field, .a.b[0], .items[-1], .items[]; multi-path .a,.b; pipes .arr|sort, .arr|unique, .arr|reverse, .items|first, .items|min; builtins: length, keys, values, type, first, last, reverse, sort, unique, min, max, add), keys (list object keys or array indices at path), values (list object values at path), flatten (flatten nested array; optional 'depth'), map (extract a 'field' from each array element at 'path'), filter (keep array elements matching 'field'+'value'/'contains'/'gt'/'lt'/'exists'), count (count elements/keys/chars at path), type (JSON type + element count/distribution). Input: 'json' string or 'file' path. Uses serde_json (already in Cargo.toml). Routing detects "jq query", "jq filter", "json path", "json query", "filter json", "query json", "extract json", "json field", "flatten json array", "map json", and related phrases.
Plist tools — ✓ Done. plist_tools tool parses and analyzes Apple Property List (plist) XML files without external utilities. 5 actions: parse (default — indented tree view with type annotations; Notable Keys section for Info.plist: bundle ID, version, min OS, ATS disabled warning, permission strings), get (dot-path navigation to any key, e.g. NSAppTransportSecurity.NSAllowsArbitraryLoads, UIBackgroundModes[0]), keys (tabular listing of dict keys at any path with type and value preview), validate (missing CFBundleIdentifier/CFBundleVersion, NSAllowsArbitraryLoads=true, permission booleans missing UsageDescription strings), to-json (full plist→JSON: dict→object, array→array, bool/int/real/string→native JSON, data→"<data: N bytes>"). Supports all plist value types: string, integer, real, boolean, date, data, array, dict. Input: 'text'/'plist'/'xml' or 'file'. Uses quick-xml (already in Cargo.toml). Routing detects "plist file", "info.plist", "apple plist", "parse plist", "validate plist", "plist to json", "cfbundle", "nsallowarbitraryloads", and related phrases.
Bencode tools — ✓ Done. bencode_tools tool decodes and analyzes BitTorrent bencode format (.torrent files and raw bencode data) without external utilities. 4 actions: decode (default — human-readable indented tree; pieces key shown as count not binary blob), info (structured torrent summary: name, file count, total size human+bytes, piece size, piece count, primary tracker, alt tracker count, creator, creation date UTC, comment), files (tabular file listing with size and cumulative offset for multi-file torrents; single-file handled gracefully), trackers (all tracker URLs from announce and announce-list grouped by tier, annotated UDP/HTTP/HTTPS, unique domain count). Input: 'hex' (hex-encoded bencode bytes) or 'file' (path to .torrent/.bencode file). Pure Rust stdlib, zero new deps. Routing detects "bencode", "torrent file", "parse torrent", "torrent info", "torrent trackers", "files in torrent", "bittorrent", "piece length", and related phrases.
printf tools — ✓ Done. printf_tools tool analyzes, simulates, validates, and converts C-style printf format strings without external utilities. 4 actions: explain (default — parse all format specifiers with type, flags, width, precision, and plain-English meaning; warns on dangerous %n; shows arg index mapping), simulate (render the format string with a provided args JSON array; handles %s/%d/%f/%e/%g/%o/%x/%X/%c/%% and flag/width/precision formatting), validate (check for %n security risk, unknown specifiers, arg count mismatches, null byte literals), convert (translate to Python % formatting, Python f-string, Rust format!, Go fmt.Sprintf, and JavaScript template literal). Pass 'format' for the format string; 'args' as a JSON array for simulate. Zero new dependencies — pure Rust stdlib. Routing detects "printf format", "format specifier", "format string", "explain printf", "simulate printf", "validate printf", "printf syntax", "c format string", "sprintf format", "convert printf", "printf to python", "printf to rust", and related phrases.
ASCII chart tools — ✓ Done. ascii_chart_tools tool renders ASCII/Unicode charts (bar, line, scatter, sparkline) from numeric data arrays in the terminal without external utilities. 5 actions: bar (default — vertical bar chart; labels, title, width, and fill style block/hash/equals/dot/shade; handles negative values with zero-axis divider), line (line/time-series chart with Y-axis scale and optional connected dots), scatter (XY scatter plot from separate x/y arrays or [[x,y]] pairs), sparkline (compact one-row Unicode sparkline ▁▂▃▄▅▆▇█ for inline trend visualization), hbar (alias for bar). Pass 'data' as a JSON number array or comma-separated string for bar/line/sparkline; 'x' and 'y' arrays for scatter. Zero new dependencies — pure Rust stdlib. Routing detects "ascii chart", "ascii bar chart", "ascii line chart", "terminal chart", "terminal graph", "terminal plot", "sparkline", "plot data", "scatter plot", "visualize data", "chart these values", "unicode chart", and related phrases.
SQL format tools — ✓ Done. sql_format_tools tool formats, minifies, splits, and extracts from SQL statements without external utilities. 4 actions: format (default — pretty-print with configurable indent string and uppercase keywords; handles SELECT/FROM/WHERE/JOIN/GROUP BY/ORDER BY/CASE-WHEN blocks and subquery depth; 'indent' and 'uppercase' options), minify (compact SQL — strip all whitespace and comments; reports original/minified size and % reduction), split (split multi-statement SQL on semicolons into numbered blocks), extract (extract 'tables', 'columns', 'aliases', or 'comments' via 'what' arg). Pass 'sql' for inline text or 'file' for a .sql path. Pure Rust stdlib, custom tokenizer handles line comments, block comments, string literals, backtick/bracket identifiers. Routing detects "format sql", "beautify sql", "sql formatter", "minify sql", "split sql", "extract tables from sql", "indent sql", "clean up sql", and related phrases.
TAR tools — ✓ Done. tar_tools tool inspects uncompressed TAR archives without external utilities. Detects gzip/bzip2/xz/zstd compression and reports the correct decompression command. 4 actions: list (default — tabular listing of all entries with POSIX permissions, size, modification date, entry type file/dir/symlink/fifo, and symlink targets; 'max' arg caps output), info (archive statistics: total entries, file/dir/symlink counts, total content size vs archive file size, owner list, oldest/newest dates), find (filter entries by name substring; pass 'query'), extract (read a specific text entry as UTF-8 string; pass 'entry' with exact path; limited to 512 KB). Handles GNU TAR long-name extension (typeflag L) and POSIX ustar prefix paths. Handles GNU TAR base-256 encoding for large file sizes. Pass 'file' with path to the .tar archive (required). Zero new dependencies — pure Rust stdlib, hand-rolled 512-byte block parser. Routing detects "tar archive", ".tar file", "tarball", "list tar", "inspect tar", "tar contents", "untar", and related phrases.
Email tools — ✓ Done. email_tools tool parses and analyzes RFC 2822 email files (.eml) without external utilities. Decodes RFC 2047 encoded words (base64-B and quoted-printable-Q Subject/From/To lines), parses folded headers (RFC 2822 §2.2.3 continuation lines), detects MIME structure with multipart boundaries, and traces delivery hop chains. 4 actions: parse (default — structured summary of key headers — From/To/Subject/Date/Message-ID/DKIM/SPF/X-Mailer — with decoded values, body preview, hop count; 'preview' arg controls body preview length), headers (full header table; 'name' to retrieve a specific header by name — returns all instances; 'filter' to narrow by substring), structure (MIME part tree showing content types, encodings, sizes, and attachment listing; recursive up to depth 4), trace (delivery chain from Received: headers in chronological order — from/by servers, timestamps; also shows Return-Path, X-Originating-IP, Delivered-To metadata). Pass 'file' (path to .eml) or 'text' (raw email string). Zero new dependencies — pure Rust stdlib with custom RFC 2047 base64 decoder and QP decoder. Routing detects "parse email", "parse eml", ".eml file", "eml file", "email headers", "mime structure", "delivery trace", "received headers", "rfc 2822", "dkim header", "spf result", and related phrases.
WebAssembly tools — ✓ Done. wasm_tools tool inspects WebAssembly binary (.wasm) modules without external utilities. Parses WASM magic bytes, LEB128-encoded section headers, type signatures (function params/results), import records (function/table/memory/global with module+name), export records, and the debug name section. 4 actions: info (default — magic, version, section count, total size, import/export count summary), sections (all sections with id, name, size in bytes, and byte offset), imports (all imported symbols with module name, item name, kind, and type signature for functions), exports (all exported symbols with name, kind, and index). Pass 'file' (path to .wasm) or 'hex' (hex-encoded WASM bytes). Zero new dependencies — pure Rust stdlib. Routing detects ".wasm", "wasm binary", "webassembly", "wasm imports", "wasm exports", "wasm sections", "inspect wasm", and related phrases.
JSON Schema tools — ✓ Done. jsonschema_tools tool inspects and validates JSON Schema documents (draft-07 and compatible) without external utilities. 4 actions: info (default — $schema dialect, $id, title, description, root type, required count, property count, additionalProperties, enum values, $defs count, numeric/string/array constraints, and allOf/anyOf/oneOf combiner count), properties (tabular list of all properties with type, required flag, and description), refs (enumerate all $ref usages, $defs/definitions entries, and $id anchors in the schema tree), validate (validate a JSON instance against the schema — checks type, required, enum, const, properties, additionalProperties, items, minItems/maxItems, minLength/maxLength, pattern, minimum/maximum, multipleOf, allOf/anyOf/oneOf/not, $ref with pointer resolution; reports per-field errors with JSON Pointer paths). Pass 'schema' (inline JSON or file path) or 'schema_file'. For validate also pass 'instance' or 'instance_file'. Zero new dependencies — serde_json + regex already in Cargo.toml. Routing detects "json schema", "validate json", "schema validation", "$ref", "draft-07", "schema properties", "schema refs", "inspect schema", and related phrases.
CBOR tools — ✓ Done. cbor_tools tool decodes and analyzes CBOR (Concise Binary Object Representation, RFC 7049/8949) binary data without external utilities. 3 actions: decode (default — recursive human-readable value tree with type labels and known-tag annotations: datetime/epoch/UUID/bignum/COSE/WebAuthn; detects WebAuthn AttestationObject and COSE structures by map key patterns), info (type distribution table — major type counts, tag count, nesting depth, total bytes), annotate (per-byte hex dump with format labels showing structure boundaries). Handles indefinite-length arrays/maps/byte-strings, half/single/double floats, tagged values (0=datetime, 1=epoch, 37=UUID, 55799=self-described), and CBOR sequences. Pass 'hex' (hex-encoded CBOR bytes) or 'base64' (standard or URL-safe base64). Zero new dependencies — pure Rust stdlib. Routing detects "cbor", "concise binary object", "cbor decode", "webauthn cbor", "fido2 cbor", "coap payload", and related phrases.
Network header tools — ✓ Done. network_header_tools tool parses and decodes raw network protocol headers (IPv4, IPv6, TCP, UDP, ICMP, Ethernet II) from hex bytes without external tools. 7 actions: parse (auto-detect protocol from header bytes — checks EtherType for Ethernet frames, version nibble for IPv4/IPv6), ipv4 (version, IHL, DSCP/ECN, total length, ID, flags DF/MF, fragment offset, TTL, protocol name, checksum verification via RFC 1071, src/dst IP), ipv6 (version, traffic class, flow label, payload length, next header, hop limit, src/dst with :: compression), tcp (src/dst port with well-known name annotations, seq/ack numbers, data offset, flag bits FIN/SYN/RST/PSH/ACK/URG/ECE/CWR, window, checksum, urgent pointer), udp (src/dst port with well-known names, length, checksum), icmp (type, code, checksum, echo ID/seq for Echo/Reply; ICMPv6 type names), ethernet (dst MAC, src MAC with broadcast/multicast detection, EtherType name). Pass 'hex' with raw header bytes (spaces and colons stripped). Optional 'protocol' hint for 'parse'. Zero new dependencies — pure Rust stdlib. Routing detects "decode ipv4 header", "decode tcp header", "decode ethernet frame", "ipv4 checksum", "packet header", "raw packet", "hex dump packet", "wireshark hex", and related phrases.
TLV tools — ✓ Done. tlv_tools tool parses, decodes, and builds Type-Length-Value (TLV) encoded binary data without external utilities. 5 actions: parse (generic TLV with configurable 'type_size' 1/2/4 bytes, 'length_size' 1/2/4 bytes, 'endian' big/little — decodes each triplet with hex, ASCII, and integer interpretation), ber (ASN.1 BER/DER — variable-length tag and length per X.690, recursive SEQUENCE/SET expansion, named universal types BOOLEAN/INTEGER/NULL/OID/UTF8String/UTCTime/GeneralizedTime/etc., INTEGER/BOOLEAN/NULL/OID value decoding, context/application/private class labeling), dhcp (DHCP options per RFC 2132 — known option names for 30+ option codes, IP address formatting for single and list options, lease time in seconds with h/m/s breakdown, DHCP message type decoding), wifi (802.11 information elements — SSID decoding, Supported Rates as Mbps list with basic-rate flag, channel number, ERP flag bits, RSN version, Vendor Specific OUI identification with Microsoft/Apple/Qualcomm annotation), build (assemble TLV bytes from 'items' JSON array of {type, value_hex?, value_string?, value_u8?} objects with formatted hex output and compact hex string). Pass 'hex' with raw bytes (spaces/colons stripped). Zero new dependencies — pure Rust stdlib + serde_json. Routing detects "tlv", "type-length-value", "ber encoding", "der encoding", "asn.1", "asn1", "dhcp options", "802.11 ie", "wifi ie", "tlv parse", "tlv decode", "build tlv", and related phrases.
Binary struct pack tools — ✓ Done. bin_pack_tools tool packs and unpacks binary data using struct-style format strings (similar to Python's struct module) without external utilities. Format string: optional endian prefix < (little-endian) or > (big-endian, default), then field specifiers: b/B (int8/uint8), h/H (int16/uint16), i/I (int32/uint32), q/Q (int64/uint64), f (float32), d (float64), s (length-prefixed UTF-8 string — 4-byte length prefix + bytes), x (pad byte). Repeat count prefix allowed: 4B = four uint8 fields. Optional names array maps positional field names. 4 actions: pack (values array → hex bytes with per-field offset/hex summary and hex dump), unpack (hex bytes → typed field values with per-field offset/value breakdown), describe (explain each field in the format string with type name, size, and byte order), size (total fixed byte size of the format, or minimum size for variable string fields). Zero new dependencies — pure Rust stdlib + serde_json. Routing detects "pack binary", "unpack binary", "struct pack", "struct unpack", "binary struct", "pack bytes", "pack format", "binary format string", "byte packing", "binary serialization", and related phrases.
Java .class bytecode tools — ✓ Done. class_tools tool inspects Java .class bytecode files without javap or external tools. Pure Rust parser. 5 actions: info (default — CAFEBABE magic, Java version from major class file version (45=Java 1.1 through 65=Java 21), access flags decoded PUBLIC/FINAL/INTERFACE/ABSTRACT/ENUM, this class name, superclass name, interface count), methods (all methods with access flags, name, descriptor decoded from JVM type notation — Ljava/lang/String; → java.lang.String, [I → int[], (II)V → (int, int) -> void), fields (all fields with access flags, name, decoded type, optional constant value), constants (raw constant pool listing with all tag types — Utf8/Integer/Long/Float/Double/String/Class/FieldRef/MethodRef/InterfaceMethodRef/NameAndType/InvokeDynamic), imports (unique class names referenced in the constant pool — the effective import set). Pass 'file' (.class path) or 'hex' (hex-encoded bytes). Zero new dependencies — pure Rust stdlib + serde_json. Routing detects ".class file", "java bytecode", "jvm bytecode", "cafebabe", "java constant pool", "javap", "java class methods", "class file version", "decompile class", "java major version", "java access flags", and related phrases.
Android DEX tools — ✓ Done. dex_tools tool inspects Android DEX (Dalvik Executable) binary files — classes.dex from APKs and multi-dex files — without dexdump or external tools. 5 actions: info (default — DEX magic and version string 035–041, endianness from endian tag, file size, checksum, string/type/proto/field/method/class counts, DEX version to Android API level mapping), classes (all class definitions with access flags decoded, Java-notation class name, superclass, interface count, field/method counts), methods (all method references with class, name, and decoded parameter+return type signature), strings (raw DEX string pool listing — useful for hardcoded URLs, API keys, package names without decompilation; 'limit' param), imports (unique class references from the type ID table). Pass 'file' (.dex path) or 'hex' (hex-encoded bytes). Zero new dependencies — pure Rust stdlib + serde_json. Routing detects ".dex file", "android dex", "dalvik dex", "dalvik executable", "classes.dex", "android bytecode", "android classes", "dex version", "dexdump", "baksmali", "apk dex", "android reverse engineering", and related phrases.
Mach-O binary tools — ✓ Done. macho_tools tool inspects macOS Mach-O binaries (executables, dylibs, frameworks, bundles, fat/universal binaries) without otool or nm. Pure Rust parser. 5 actions: info (default — magic, file type MH_EXECUTE/MH_DYLIB/MH_BUNDLE/MH_OBJECT/MH_CORE, architecture x86-64/ARM64/ARM/x86/PPC, CPU subtype, flags PIE/DYLDLINK/TWOLEVEL, UUID, entry point, install name for dylibs, source version, build platform, min OS/SDK, code signature and encryption flags, load command count), segments (all LC_SEGMENT_64/LC_SEGMENT with virtual address, file offset, size, flags, and embedded section names), sections (all sections across all segments with section name, segment, type, flags, address, size), imports (all LC_LOAD_DYLIB/LC_LOAD_WEAK_DYLIB/LC_REEXPORT_DYLIB with install name, compatibility version, and current version), fat (architecture table for fat/universal binaries with cputype, cpusubtype, offset, size). Pass 'file' or 'hex'. Zero new dependencies — pure Rust stdlib. Routing detects "mach-o", "macho", ".dylib", "dylib imports", "dylib info", "macos binary", "macos executable", "apple binary", "fat binary", "universal binary", "otool", "inspect dylib", "mach-o segments", "mach-o sections", "mach-o imports", "mach-o fat", "lc_load_dylib", "lc_segment", "feedface", "feedfacf", "arm64 binary", "x86-64 macos", and related phrases.
PCAP packet capture tools — ✓ Done. pcap_tools tool parses and analyzes PCAP/PCAPNG packet capture files without Wireshark or tcpdump. Handles classic PCAP (little/big-endian, nanosecond variant) and PCAPNG (SHB/IDB/EPB/OPB blocks). 6 actions: info (default — format, byte order, link type, packet count, duration, pps, bytes), packets (tabular listing with number/timestamp/length/protocol/source/destination; port-annotated protocol names and inline DNS/HTTP info; 'limit'), protocols (distribution table with percentage bar chart), conversations (top host pairs by packet count and bytes), dns (DNS queries/responses from UDP port 53 with name/type/answer), http (HTTP request/response pairs from port 80/8080/8000 with method/path/host/status). Supports IPv4/IPv6, Ethernet/802.1Q VLAN, loopback, Linux Cooked. Pass 'file' with path to .pcap or .pcapng file. Zero new dependencies — pure Rust stdlib. Routing detects "pcap", "pcapng", "packet capture", "wireshark", "tcpdump", "network capture", "analyze pcap", ".pcap file", ".pcapng file", "pcap dns", "pcap http", "network traffic analysis", "capture file", and related phrases.
PE binary tools — ✓ Done. pe_tools tool inspects Windows PE (EXE/DLL/SYS/OCX) binaries without dumpbin or readpe. 5 actions: info (default — machine type, file type EXE/DLL/Object/Driver, architecture PE32/PE32+, subsystem, COFF timestamp, image base, entry point RVA, image size, ASLR/DEP/CFG/HighEntropyVA/ForceIntegrity security flags, import DLL count, export count), sections (section table: name, virtual address, virtual size, raw size, raw offset, flags EXEC/READ/WRITE/CODE/INIT_DATA/UNINIT_DATA/DISCARDABLE), imports (all imported DLLs with function names or ordinals; up to 50 shown per DLL), exports (exported function names with ordinals; up to 300 shown), headers (full DOS e_lfanew, COFF machine/sections/timestamp/characteristics, Optional Header magic/entry/base/subsystem/DllCharacteristics, Data Directory RVAs for Export/Import/Resource/TLS/Load Config). Pass 'file' (.exe/.dll/.sys/.ocx path) or 'hex' (raw PE bytes as hex string). Zero new dependencies — pure Rust stdlib. Routing detects "pe binary", "pe file", "pe header", "windows binary", "windows executable", ".dll imports", ".dll exports", "pe sections", "pe imports", "pe exports", "dumpbin", "readpe", "aslr enabled", "dep enabled", "guard cf", "coff header", "inspect exe", "inspect dll", "analyze exe", "analyze dll", and related phrases.
ELF binary tools — ✓ Done. elf_tools tool inspects ELF (Executable and Linkable Format) binary files — Linux executables, shared libraries (.so), object files (.o), and kernel modules (.ko) — without readelf, objdump, or any external tools. Parses ELF magic, class (32/64-bit), endian, OS/ABI, type (ET_EXEC/ET_DYN/ET_REL/ET_CORE), machine architecture (x86-64/AArch64/ARM/MIPS/RISC-V/eBPF and 15+ others), entry point, and program/section header table metadata. 5 actions: info (default — full ELF overview including interpreter path for dynamic executables and segment type summary), segments (program headers — PT_LOAD/PT_DYNAMIC/PT_INTERP/PT_GNU_STACK/etc. with flags R/W/X, virtual address, file offset, file size, memory size; shows PT_INTERP interpreter path inline), sections (section headers — name from .shstrtab, type SHT_PROGBITS/SHT_SYMTAB/SHT_STRTAB/SHT_DYNAMIC/etc., flags AXW, virtual address, file offset, size), symbols (symbol table entries from .symtab or .dynsym fallback — value, size, bind LOCAL/GLOBAL/WEAK, type FUNC/OBJECT/FILE/SECTION/NOTYPE, section index, name; up to 200 symbols), dynamic (shared library dependencies via DT_NEEDED entries, SONAME, RPATH, RUNPATH, and all dynamic section entries). Pass 'file' (path to ELF binary) or 'hex' (raw ELF bytes as hex string). Zero new dependencies — pure Rust stdlib. Routing detects "elf binary", "elf file", "elf header", ".elf", "elf sections", "elf segments", "elf symbols", "readelf", ".so file", "linux binary", "dynamic linking", "needed libraries", "elf symbol table", and related phrases.
ASN.1 tools — ✓ Done. asn1_tools tool parses and inspects ASN.1 DER/BER encoded binary data without external utilities. Used in X.509 certificates, PKCS#8/PKCS#12 keys, SNMP, LDAP, and cryptographic formats. 4 actions: parse (default — decode DER/BER structure as an indented tag/length/value tree with Universal tag names: SEQUENCE/INTEGER/BIT STRING/OCTET STRING/OID/UTCTime/GeneralizedTime/etc., tag class, offset, and length), oid (look up an OID number to its human-readable name; pass 'oid' field; 200+ well-known OIDs from X.509 attribute types, certificate extensions, signature algorithms, EC curves, AES, SHA-2/3, PKCS#7/PKCS#9/PKCS#12), decode_cert (X.509 certificate summary — scan for OIDs, DN fields, serial number, validity dates from raw DER), info (tag class/number/constructed flag and byte structure at root level only). Pass 'hex' (hex-encoded DER bytes, spaces allowed) or 'file' (path to .der/.cer/.crt/.p8 binary file). Optional 'max_depth' to limit tree expansion (default 20). Zero new dependencies — pure Rust stdlib. Routing detects "asn.1", "asn1", "der encoded", "ber encoded", "der format", "parse der", "decode der", "x.509 der", "pkcs der", "oid lookup", "asn.1 structure", "asn.1 tag", and related phrases.
JSONL tools — ✓ Done. jsonl_tools tool processes JSONL (JSON Lines / NDJSON) data without external utilities — each newline-separated JSON object is one record. 9 actions: parse (default — display records with index and pretty-print; 'limit' caps rows, default 20), filter (keep records where a field matches; 'field' dot-path + 'value' + 'op': eq/ne/gt/lt/gte/lte/contains/exists/missing), map (extract one field from every record; 'field'), aggregate (count/sum/avg/min/max/distinct on a field; 'field' + 'agg'), keys (union of all keys with type distribution and coverage %), stats (record count, key coverage %, null rate, type distribution per field), to_csv (convert records to CSV using all observed keys as headers), group (group by field value with ASCII bar chart; 'field'), sort (sort by a field; 'field'; 'order': asc/desc). Dot-path navigation supports nested fields (user.name) and array indexing (items[0]). Pass 'text'/'jsonl' for inline content or 'file' for a .jsonl/.ndjson path. Zero new dependencies — pure Rust stdlib + serde_json. Routing detects "jsonl", "ndjson", "json lines", "newline-delimited json", "jsonl file", ".jsonl", ".ndjson", "json stream", "jsonl stats", "jsonl to csv", and related phrases.
JSON-RPC tools — ✓ Done. jsonrpc_tools tool parses, builds, validates, and inspects JSON-RPC 2.0 messages without external utilities. 4 actions: parse/inspect (default — decode any message type: request/notification/success response/error response/batch; field-by-field annotations with spec compliance notes and standard error code descriptions), build/create (construct a valid message; 'kind': request/notification/response/error; supply 'method'/'id'/'params'/'result'/'error_code'/'error_message'/'error_data' as needed; auto-validates the built message), validate/check (strict JSON-RPC 2.0 spec check; every violation reported including missing jsonrpc field, invalid id types, missing error.code/message, result+error both present), batch (parse a JSON array as a batch with per-item type and validation summary, or build one from 'messages' array). Standard error codes decoded: -32700 Parse error, -32600 Invalid Request, -32601 Method not found, -32602 Invalid params, -32603 Internal error, -32099 to -32000 Server error. Pass 'message' with the raw JSON-RPC string. Pure Rust stdlib + serde_json, zero new deps. Routing detects "json-rpc", "jsonrpc", "json rpc", "rpc request", "rpc notification", "rpc response", "rpc error", "rpc batch", "-32600", "-32601", "parse rpc", "build rpc", "validate rpc", and related phrases.
LEB128 tools — ✓ Done. leb128_tools tool encodes, decodes, and analyzes LEB128 (Little-Endian Base-128) variable-length integers — both ULEB128 (unsigned) and SLEB128 (signed) — without external utilities. Used in WebAssembly, DWARF debug info, Android DEX, and protobuf field tags. 5 actions: encode (integer → LEB128 hex bytes with byte dump), decode (hex bytes → integer + bytes consumed + remaining stream), analyze (byte-by-byte bit-field breakdown showing continuation bit and data bits per group), multi (batch encode a JSON array of integers or decode a concatenated stream into multiple values), explain (verbose bit-level walkthrough per group with value accumulation trace). Pass 'value' (integer) for encode, 'hex' or 'bytes' for decode/analyze/multi, 'signed: true' for SLEB128 mode (default: ULEB128). Example: 624485 encodes to e5 8e 26 in ULEB128. Zero new dependencies — pure Rust stdlib. Routing detects "leb128", "uleb128", "sleb128", "varint", "variable length integer", "wasm encoding", "dwarf encoding", "little endian base 128", and related phrases.
Unicode tools — ✓ Done. unicode_tools tool analyzes Unicode text for script distribution, bidi safety, confusable/homoglyph detection, encoding sizes, and normalization status without external utilities. 7 actions: analyze (default — per-character table with codepoint U+XXXX, Unicode category, script, UTF-8 hex bytes; up to 200 chars), scripts (script distribution count table — Latin/CJK/Cyrillic/Greek/Arabic/Hebrew/etc.), blocks (Unicode block distribution — Basic Latin/CJK Unified Ideographs/Combining Diacritical Marks/etc.), bidi (RTL character count, detected RTL scripts, and Trojan Source CVE-2021-42574 invisible bidi control character detection — RLO/LRO/RLE/LRE/PDF/FSI/PDI), confusables (homoglyph/lookalike detection — Cyrillic/Greek characters that visually resemble ASCII letters, flagged with ASCII equivalent), encoding (UTF-8/UTF-16 LE/BE/UTF-32 LE/BE byte sequences for each character with code unit counts), normalize (NFC vs NFD normalization status — flags combining mark sequences vs precomposed forms, counts combining characters). Pass 'text' with the string to analyze. Zero new dependencies — pure Rust stdlib. Routing detects "unicode bidi", "trojan source", "homoglyph", "unicode confusable", "unicode normalization", "bidi control", "unicode script", "rtl character", "analyze unicode", "unicode encoding", and related phrases.
HTML tools — ✓ Done. html_tools tool parses and analyzes HTML documents without external utilities. 9 actions: parse (default — document overview: DOCTYPE, title, meta description, element counts, and heading hierarchy), links (all anchor elements with href, visible text, link type EXT/INT/ANCH/MAIL, and nofollow flag), images (all img tags with src, alt text, and dimensions; flags missing alt attributes), forms (form elements with method, action, enctype, and input field inventory), tables (table structure with row/column counts and first-5-row cell preview), scripts (external and inline script tags with src, type, and inline byte count), validate (accessibility and SEO checks: DOCTYPE, lang attribute on html, charset, title, viewport, missing alt on img, single h1 rule), text (strip all HTML tags to plain text with common entity decoding), stats (total elements, unique tag count, max nesting depth, comment count, text bytes). Custom char-level tokenizer handles quoted attributes and nested angle brackets. Pass 'html' (inline HTML string) or 'file' (path to .html/.htm file). Zero new dependencies — pure Rust stdlib + serde_json. Routing detects "parse html", "extract links from html", "html images", "html forms", "validate html", "html stats", "strip html", ".html file", ".htm file", and related phrases.
vCard tools — ✓ Done. vcf_tools tool parses and analyzes vCard contact files (.vcf) without external utilities. Supports vCard 2.1, 3.0, and 4.0. Handles RFC 6350 line unfolding (CRLF + whitespace continuation), property parameters (TYPE=WORK,CELL), structured names (N property with family/given/additional/prefix/suffix), encoded values (\n , ; \ escaping), embedded base64 photos (reported as size, not decoded), and multi-value typed fields (all emails, phones, addresses stored with their TYPE labels). 5 actions: parse (default — full contact detail per card: full name, structured name, org, title, all emails/phones/addresses with types, URLs, birthday, categories, notes, UID), list (compact summary table: name, primary email, primary phone), search (filter contacts by keyword across all fields; pass 'query' or 'q'), to_json (structured JSON array with all fields including nested name object), to_csv (CSV export with columns: Full Name, Given, Family, Organization, Title, Email, Phone, Address, Birthday, Categories, URL). Pass 'vcf'/'text' (inline content) or 'file' (path to .vcf file). Zero new dependencies — pure Rust stdlib + serde_json. Routing detects "vcard", "vcf file", ".vcf", "contact file", "parse vcard", "vcard to json", "vcf to csv", "import contacts", and related phrases.
MessagePack tools — ✓ Done. msgpack_tools tool decodes and analyzes MessagePack binary data without external utilities. 3 actions: decode (default — recursive human-readable value tree with format names and ext type annotations), info (type distribution table — nil/bool/int/uint/float/str/bin/array/map/ext counts, total bytes), annotate (per-byte hex dump with format byte labels showing structure boundaries). Handles all MessagePack format bytes: positive/negative fixint, fixmap, fixarray, fixstr, all integer widths (uint8–uint64, int8–int64), float32/float64, str8/str16/str32, bin8/bin16/bin32, array16/array32, map16/map32, fixext1/2/4/8/16, ext8/ext16/ext32. Ext type −1 decoded as Timestamp (4-byte = epoch seconds; 8-byte = 30-bit nanoseconds + 34-bit seconds). Pass 'hex' (hex-encoded MessagePack bytes) or 'base64'. Zero new dependencies — pure Rust stdlib. Routing detects "messagepack", "msgpack", ".msgpack", "msgpack decode", "serialize messagepack", and related phrases.
TOTP tools — ✓ Done. totp_tools tool generates, verifies, and inspects TOTP/HOTP one-time passwords (RFC 6238 / RFC 4226) without external utilities or network calls. Pure Rust SHA-1 + HMAC-SHA1 implementation. 5 actions: generate (default — current TOTP code from base32 secret; shows code, validity window, previous/current/next codes for context), verify (check a user-supplied code against the secret; ±1 window tolerance for clock drift; returns VALID/INVALID with window offset), hotp (generate HMAC-based OTP codes from a monotonic counter; 'count' arg for N consecutive codes), info (explain TOTP/HOTP algorithm or parse an otpauth:// URI to show all parameters), qr (generate the otpauth:// URI for registering in any authenticator app — Google Authenticator, Authy, 1Password, Bitwarden, etc. — with QR code generation instructions). Pass 'secret' as the base32-encoded secret. Optional: 'digits' (default 6), 'period' (default 30s), 'time' (Unix timestamp override for testing). Routing detects "totp", "hotp", "one-time password", "2fa code", "authenticator code", "mfa code", "otpauth", "verify 2fa", "authenticator app secret", and related phrases.
NATO/Morse tools — ✓ Done. nato_tools tool converts text to/from NATO phonetic alphabet and Morse code without external utilities. 4 actions: nato (default — spell out each character in NATO phonetic words; shows letter-by-letter breakdown for short text), from_nato (parse a sequence of NATO words back to text; handles variants like alfa/alpha, juliett/juliet, wun/one), morse (encode text to dot-dash Morse or decode Morse back to text; auto-detects direction from content; letter separator: space, word separator: /), spell (phonetic spellout with character label — useful for phone/radio dictation). Covers all 26 letters, digits 0–9, and punctuation in Morse. Zero new dependencies — pure Rust static lookup tables. Routing detects "nato alphabet", "nato phonetic", "morse code", "morse", "encode morse", "decode morse", "phonetic alphabet", "alpha bravo charlie", and related phrases.
Token tools — ✓ Done. token_tools tool estimates LLM token counts and context budget without external libraries. 4 actions: estimate (default — chars/4 and words*1.3 heuristics averaged, with fill bars for 4K/8K/32K/128K context windows), budget (fill % and remaining tokens for a specific context window size; 'context_size' defaults to 8192; status OK/WARNING/CRITICAL), compare (token cost difference between two texts via 'a'/'b' fields — ratio and cheaper-by %), truncate (cut text to approximately N tokens at a word boundary; 'max_tokens' defaults to 1000). Zero new dependencies — pure Rust stdlib. Routing detects "estimate tokens", "token count", "how many tokens", "token budget", "context window fill", "llm token", and related phrases.
MIME tools — ✓ Done. mime_tools tool looks up MIME content types by file extension, finds extensions for a MIME type, searches, and lists by category — 130+ entries, zero new dependencies. 4 actions: from_ext (default — file extension to MIME type and category; accepts 'js', '.ts', or 'report.pdf'), from_mime (MIME type string to file extensions), search (fuzzy search on extension or MIME type string), category (list all types in a category — text/image/audio/video/application/font; omit for a category summary with counts). Covers text/code (54 extensions including all common source file types), images (15), audio (10), video (11), application/binary/archive (34), fonts (5). Zero new dependencies — pure Rust stdlib. Routing detects "mime type", "mimetype", "content-type header", "look up mime", "image/png", "audio/mpeg", "video/mp4", and related phrases.
HTTP status tools — ✓ Done. http_status_tools tool looks up, searches, and lists HTTP status codes — 65 standard codes across all 5 categories, zero new dependencies. 4 actions: lookup (default — code number to reason phrase and description; accepts integer or string), search (keyword search in reason and description; pass 'query'), category (list codes in a category — 1xx/2xx/3xx/4xx/5xx; omit for a summary with counts), list (all codes or filtered by category). Routing detects "http status code", "http status", "status code meaning", "what is a 404", "http 4xx", "http 5xx", "list http codes", and related phrases.
Coverage tools — ✓ Done. coverage_tools tool parses, analyzes, and compares code coverage reports (LCOV and Istanbul/nyc JSON) without external utilities. 4 actions: summary (default — overall line/branch/function percentages with ASCII grade bar; auto-detects LCOV vs Istanbul JSON; 'text' or 'file'), files (per-file coverage table sorted by lowest line% first; optional 'min_pct'/'max_pct' filters), uncovered (uncovered line ranges per file; optional 'min_uncovered' threshold), compare (side-by-side diff of two reports via 'file_a'/'file_b' or 'text_a'/'text_b' — coverage delta per file). LCOV format: SF:/DA:/LH:/LF:/FNF:/FNH:/BRF:/BRH:/end_of_record. Istanbul JSON: {"path": {"lines": {"total","covered","pct"}, "functions": {...}, "branches": {...}}}. Zero new dependencies — pure Rust stdlib + serde_json. Routing detects "code coverage", "lcov", "lcov.info", "coverage report", "coverage summary", "istanbul coverage", "nyc coverage", "coverage-summary.json", "uncovered lines", "lines are uncovered", "line coverage", "branch coverage", "function coverage", "parse coverage", "compare coverage", "coverage threshold", and related phrases.
Strace tools — ✓ Done. strace_tools tool parses and analyzes Linux strace system-call trace output without external utilities. 5 actions: summary (default — syscall frequency table ranked by call count; error rate; total elapsed time; PID distribution for multi-process traces; handles plain/-f/-T/-t/-tt strace formats), calls (tabular listing of every call with pid/syscall/args-preview/result/elapsed; optional 'pid', 'syscall', 'error_only' filters), files (file-path operations extracted from openat/open/creat/unlink/rename/chmod calls with syscall and result), network (socket/connect/sendto/recvfrom/bind/listen calls with extracted address/port from sockaddr structs), errors (all failed calls — result < 0 or errno set — grouped by errno name with count and first-seen example). Handles [pid NNNN] prefix, timestamp prefixes (-t/-tt), elapsed <N.NNN> suffix (-T). Zero new dependencies — pure Rust stdlib. Routing detects "strace output", "strace log", "parse strace", "analyze strace", "strace syscall", "system call trace", "syscall trace", "syscall frequency", "failed syscall", "in strace", "from strace", "trace file operations", "trace network calls", and related phrases.
CMake tools — ✓ Done. cmake_tools tool parses, inspects, and validates CMakeLists.txt files without external utilities. 5 actions: info (default — cmake_minimum_required version, project name/version/languages, executable/library/option/variable/subdirectory counts), targets (all add_executable and add_library targets with source files and library type STATIC/SHARED/INTERFACE/MODULE), options (cmake_option() variables with description and default value), deps (find_package() dependencies with target_link_libraries() relationships), validate (missing cmake_minimum_required, missing project(), executables/libraries with no sources, undefined variables in target_link_libraries). Custom depth-aware CMake tokenizer handles nested parentheses and # comments. Zero new dependencies — pure Rust stdlib. Routing detects "cmake_tools", "cmakelists.txt", "cmakelists", "cmake project", "parse cmake", "analyze cmake", "cmake targets", "cmake options", "add_executable", "add_library cmake", "find_package", "cmake dependencies", "cmake validate", "cmake modules", "target_link_libraries", "cmake subdirectory", "cmake configure", and related phrases.
dotnet tools — ✓ Done. dotnet_tools tool parses, inspects, and validates .NET project files (.csproj, .fsproj, .vbproj) and Visual Studio solution files (.sln) without external utilities. 5 actions: info (default — format detection, SDK/TargetFramework/OutputType/AssemblyName/RootNamespace, configuration list, NuGet package count, project reference count, target count), packages (all PackageReference entries with Version; optional 'filter' by name substring), targets (custom MSBuild Target blocks with DependsOnTargets and BeforeTargets/AfterTargets), references (ProjectReference entries with path and inferred project name), validate (missing Sdk attribute, missing TargetFramework, duplicate PackageReference versions, wildcard versions '*', assets file references). SLN format: lists projects by type (C#/F#/VB/solution folder), path, and GUID. Zero new dependencies — pure Rust stdlib. Routing detects "dotnet_tools", ".csproj", ".fsproj", ".vbproj", ".sln file", "solution file", "visual studio solution", "nuget packages", "packagereference", "dotnet project", "parse csproj", "parse sln", "msbuild project", "sdk-style project", "targetframework", "target framework", "dotnet validate", "csproj packages", "project references csproj", and related phrases.
Maven tools — ✓ Done. maven_tools tool parses, inspects, and validates Maven pom.xml files without external utilities. 6 actions: info (default — coordinates groupId/artifactId/version/packaging, parent info, description, dep/plugin/profile counts), deps (all dependencies from with scope/classifier/type; optional 'scope' filter), managed (dependencyManagement entries — the BOM layer), plugins (build and pluginManagement plugins with version and inherited flag), profiles (activation condition, dep count, plugin count per profile), validate (missing coordinates, LATEST/RELEASE anti-patterns, version ranges, deps missing version not in BOM, duplicate deps, Java source/target mismatch, SNAPSHOT parent in release). Pure Rust XML tag extraction, zero new dependencies — pure Rust stdlib. Routing detects "maven_tools", "pom.xml", "maven pom", "parse pom", "maven dependencies", "maven plugins", "maven profiles", "dependencymanagement", "maven lifecycle", "mvn dependency", "mvn dependency:tree", "maven project", "parse maven", "inspect pom", "validate pom", "pom coordinates", "maven bom", and related phrases.
Gradle tools — ✓ Done. gradle_tools tool parses, inspects, and validates Gradle build files (build.gradle Groovy DSL and build.gradle.kts Kotlin DSL) without external utilities. 6 actions: info (default — DSL type, group/version, Java source/target, Kotlin jvmTarget, plugin count, dep count, task count, repositories detected), deps (all dependencies grouped by configuration with GAV/project/files/platform kinds; optional 'configuration' and 'filter' args), plugins (applied plugins with id/version/apply flag; supports both Groovy and KTS forms), tasks (task definitions with name, type, dependsOn, description), properties (ext/extra properties from ext.foo or val foo by extra()), validate (missing group/version, no repositories, jcenter deprecated, deps without version, duplicate deps, deprecated compile/runtime/testCompile/testRuntime configurations). Custom comment-stripping tokenizer handles // and /* */ in both DSLs. Zero new dependencies — pure Rust stdlib. Routing detects "gradle_tools", "build.gradle", "build.gradle.kts", "settings.gradle", "gradle dependencies", "gradle plugins", "gradle tasks", "gradle build", "parse gradle", "testImplementation", "testCompileOnly", "groovy dsl", "kotlin dsl gradle", "gradle configuration", "validate gradle", "gradle ext", "gradle properties", "analyze gradle", and related phrases.
Go module tools — ✓ Done. go_mod_tools tool parses, inspects, and validates Go module files (go.mod) without external utilities. 5 actions: info (default — module path, Go version, toolchain, direct/indirect dep counts and list), require (all required modules with version; 'filter' for name substring, 'indirect: true/false' to scope direct vs indirect), replace (all replace directives; local path replacements flagged as CI risk), exclude (excluded module versions in tabular view), validate (VALID/WARNINGS/INVALID — old Go version <1.16, local replace directives, pseudo-version direct deps, multiple major versions of same base module). Pass 'file' (path to go.mod) or 'gomod' (inline content). Pure Rust, zero new dependencies. Routing detects "go_mod_tools", "go.mod", "go.sum", "golang module", "parse go.mod", "go module dependencies", "go require", "go replace directive", "go exclude", "go modules", "validate go.mod", "gomod", "go mod tidy", "go module path", "go indirect dep", "go direct dep", and related phrases.
Python requirements tools — ✓ Done. requirements_tools tool parses, inspects, and validates Python dependency files (requirements.txt, pyproject.toml PEP 621, pyproject.toml Poetry) without external utilities. Auto-detects format. 5 actions: info (default — total packages, pinned/loose/unpinned/editable/URL dep counts, group summary), list (tabular listing with pin type, group, and specifiers; 'group' to scope by dep group, 'filter' for name substring), validate (VALID/WARNINGS/INVALID — unpinned main deps, duplicates, editable installs in main group, URL/VCS deps, mixed pinning in main group), extras (dependency groups for Poetry/PEP 621 or package-level extras for requirements.txt), export (re-emit all packages in pip requirements.txt format). Pass 'file' (path to requirements.txt or pyproject.toml) or 'requirements' (inline text). Pure Rust, zero new dependencies. Routing detects "requirements_tools", "requirements.txt", "requirements file", "pyproject.toml dependencies", "parse requirements", "python dependencies", "pip requirements", "poetry dependencies", "python packages", "pip install requirements", "python requirements", "validate requirements", "pyproject deps", "pinned packages", "pip freeze", "pep 621", "python dep group", and related phrases.
Glob tools — ✓ Done. glob_tools tool tests, filters, explains, and converts glob patterns without external utilities. 4 actions: match (test if a single path matches; pass 'pattern' and 'path'), filter (filter a list of paths; pass 'pattern' and 'paths' as JSON array or newline string), explain (tokenize and describe each component — globstar/wildcard/any-char/char-class/literal; shows regex equivalent), convert (show the equivalent anchored regex). Glob syntax: ** matches any depth including separators, * matches a single segment, ? matches one character, [!abc] negates a character class. Uses the existing regex crate. Routing detects "glob pattern", "test glob", "glob match", "glob filter", "glob to regex", "convert glob", "explain glob", "gitignore pattern", "wildcard pattern", and related phrases.
Log parse tools — ✓ Done. log_parse_tools tool parses and analyzes structured log lines without external utilities. 4 actions: parse (default — auto-detect format and extract key-value fields from each line), detect (identify the log format with per-format distribution), filter (keep only lines where a named field matches a value; pass 'field' and 'value'), stats (count occurrences of a field's values; defaults to 'status' for Apache or 'level' for others). Supported formats: JSON Lines, key=value, Apache Common/Combined, Syslog (traditional and ISO 8601). Pass 'format' to override auto-detection. Zero new dependencies — pure Rust stdlib + serde_json. Routing detects "parse log", "parse json logs", "parse apache log", "parse syslog", "filter log", "log stats", "structured log", "access log parse", and related phrases.
CSP tools — ✓ Done. csp_tools tool parses, explains, validates, and builds Content Security Policy headers without external utilities. 4 actions: parse (default — break header into directives with per-source descriptions and [UNSAFE] flags), explain (plain-English summary of what each directive permits — with nonce/hash/wildcard detection), validate (check for 'unsafe-inline', 'unsafe-eval', wildcard *, http:, missing base-uri/object-src, deprecated report-uri, redundant unsafe-inline+nonce), build (generate CSP from a directives object or named preset: strict/moderate/api). Strips 'Content-Security-Policy:' prefix automatically. Zero new dependencies — pure Rust stdlib. Routing detects "content security policy", "csp header", "parse csp", "explain csp", "validate csp", "build csp", "unsafe-inline", "frame-ancestors", and related phrases.
robots.txt tools — ✓ Done. robots_txt_tools tool parses, checks path accessibility, validates, and summarizes robots.txt files without external utilities. 4 actions: parse (default — list all user-agent blocks with Allow/Disallow rules and Crawl-delay; list Sitemap directives), check (test if a path is ALLOWED or BLOCKED for a given user-agent per RFC 9309 — most-specific rule wins, Allow beats Disallow on tie; pass 'url' or 'path' and optional 'agent'), validate (warn on unknown directives, non-path Allow/Disallow values, missing wildcard block, Disallow:/ blocking entire site, relative Sitemap URLs), summary (tabular view of agent blocks — allows count, disallows count, crawl-delay). Auto-detects: url/path present → check, else → parse. Zero new dependencies — pure Rust stdlib. Routing detects "robots.txt", "disallow rule", "allow rule", "can googlebot crawl", "crawl-delay", "check robots", "validate robots", and related phrases.
Sitemap tools — ✓ Done. sitemap_tools tool parses, searches, and analyzes sitemap XML files (urlset and sitemapindex formats) without external utilities. 4 actions: parse (default — list URLs with lastmod/changefreq/priority; 'max' limits output, default 20), search (filter URLs by query string — pass 'query' or 'q'), stats (total count, field coverage %, changefreq and priority distributions), list (all URLs or filtered by 'filter'/'prefix'; for index sitemaps lists child sitemap URLs). Auto-detects: query/q present → search, else → parse. Uses quick-xml (already in Cargo.toml). Routing detects "sitemap.xml", "sitemap urls", "parse sitemap", "search sitemap", "sitemap stats", "sitemap index", "urlset", and related phrases.
Physics tools — ✓ Done. physics_tools tool looks up physical constants and evaluates physics formulas without external utilities. 4 actions: constant (default — search ~29 NIST constants by name/symbol/keyword: c, h, ħ, G, k_B, N_A, R, σ, e, ε₀, μ₀, k_e, F, m_e, m_p, m_n, m_u, a₀, α, R_∞, μ_B, μ_N, Planck units, g, atm, eV), formula (evaluate a named formula solving for the missing variable; pass 'name' and 'vars' — ~20 formulas: kinematics, Newton's 2nd law, kinetic energy, GPE, E=mc², momentum, work, centripetal force, gravitational force, Ohm's law, electric power, Coulomb's law, wave speed, photon energy, ideal gas, heat capacity, Carnot efficiency, thin lens, Snell's law, de Broglie), list (browse constants or formulas by domain; pass what='constants' or what='formulas'), domains (show all domains with counts). Zero new dependencies — pure Rust stdlib. Routing detects "physics constant", "physical constant", "speed of light", "planck constant", "boltzmann", "avogadro", "kinetic energy formula", "ohms law", "snells law", "de broglie", "carnot efficiency", "ideal gas formula", "e=mc", "f=ma", and related phrases.
Chemistry tools — ✓ Done. chemistry_tools tool balances chemical equations, calculates stoichiometry, molarity, pH, and gas laws without external utilities. 5 actions: balance (default — balance a chemical equation via Gaussian elimination with rational arithmetic; handles nested parentheses like Ca(OH)₂, Al₂(SO₄)₃; pass 'equation' like 'H2 + O2 -> H2O'), stoichiometry (mole/mass yield from a balanced equation; pass 'equation', 'reactant', 'product', and 'moles' or 'grams'), solution (molarity M=n/V and dilution C₁V₁=C₂V₂; pass moles_solute+volume_L for molarity, or three of C1/V1/C2/V2 for dilution), ph (pH/pOH/[H+]/[OH-] from pH_value; Henderson-Hasselbalch buffer from Ka+acid_conc+base_conc; Kb→pKb/pKa/Ka conversion), gas (ideal gas law PV=nRT; pass three of P (Pa)/V/n (mol)/T (K); set unit='L' for volume in liters). Full 118-element atomic mass table. Zero new dependencies — pure Rust stdlib. Routing detects "balance chemical", "balance equation", "balance reaction", "stoichiometry", "molarity", "dilution formula", "henderson-hasselbalch", "ph calculation", "Ka to ph", "ideal gas law", "gas pressure", "gas law", and related phrases.
Citation tools -- Done. cite_tools tool formats, generates, and validates academic citations in five styles without external utilities. 5 actions: format (default -- format a citation in 'style': apa/mla/chicago/ieee/harvard from fields: authors/title/journal/book/publisher/year/volume/issue/pages/doi/url/accessed/city/edition/editors/institution/degree; 'type': article/book/chapter/website/conference/thesis/report), bibtex (generate a BibTeX entry from citation fields; optional 'key' for the cite key), parse_doi (validate and describe a 'doi' identifier), parse_isbn (validate ISBN-10 or ISBN-13 check digit), validate (check fields for completeness and formatting issues). Author strings accept "Last, First and Last, First" format; array of names also accepted. Zero new dependencies -- pure Rust stdlib. Routing detects "apa citation", "mla citation", "chicago citation", "ieee citation", "harvard citation", "generate bibtex", "format citation", "cite source", "doi citation", "parse doi", "validate isbn", and related phrases.
LaTeX tools -- Done. latex_tools tool generates, escapes, and converts LaTeX without external utilities. 7 actions: escape (default -- escape 13 special LaTeX chars in 'text': & % $ # _ { } ~ ^ \ < >), table (generate a complete table block from 'headers' array and 'rows' 2D array; 'caption', 'label', 'border': full/outer/none), equation (wrap 'expression' in a math environment; 'env': equation/align/gather/multline; 'numbered': true/false), template (full LaTeX document scaffold; 'type': article/report/book/beamer/letter; 'title', 'author', 'packages' extra package list), strip (remove LaTeX markup from 'text', preserving inner content), symbols (look up LaTeX symbol commands by name or category; 'query' like 'alpha', 'greek', 'integral', 'arrow', 'logic'), convert (convert Markdown 'text' to LaTeX -- headings to section, bold/italic/code, lists). Zero new dependencies -- pure Rust stdlib. Routing detects "latex", "latex table", "latex equation", "latex template", "escape latex", "latex symbol", "convert to latex", "markdown to latex", "strip latex", and related phrases.
Notebook tools — ✓ Done. notebook_tools tool parses and inspects Jupyter Notebook (.ipynb) files without external utilities. 5 actions: info (default — nbformat version, kernel display name, language, cell counts by type, total source lines, output count, optional title and authors from metadata), cells (tabular Index/Type/Lines/Outputs/Exec# listing; optional 'type' filter: code/markdown/raw; optional 'limit'), source (extract all cell source with # --- Cell N (index I) --- separators; optional type filter), outputs (per-cell output display — stream preview, error ename+evalue, display_data/execute_result text/plain preview), stats (kernel, language, total/code/markdown/raw cell counts, source lines, total outputs, cells with errors, code cells with no output). Handles nbformat 3 (worksheets[0].cells) and 4 (top-level cells); cell source as string array or plain string. Zero new dependencies — pure Rust stdlib + serde_json. Routing detects "jupyter notebook", ".ipynb", "ipynb file", "parse notebook", "notebook cells", "notebook outputs", "notebook source", "notebook stats", "list cells", "code cells", "jupyter kernel", and related phrases.
Conda tools — ✓ Done. conda_tools tool parses, validates, and exports Conda environment.yml files without external utilities. 5 actions: info (default — environment name, channels, Python version, conda and pip dependency counts, optional variables section), list (tabular Package/Version/Type with optional 'type': conda/pip filter and 'query' name substring filter), compare (diff two environments via file_a/file_b or yaml_a/yaml_b — shows only_a/only_b/common with version deltas), validate (missing name, no channels, no defaults/conda-forge, duplicate packages; VALID/INVALID verdict with issue list), export (generate pip requirements.txt; normalizes =X.Y to ==X.Y for pip compat; marks python as comment). Strips channel prefixes (conda-forge::numpy). Accepts 'file' path, 'yaml'/'text' inline content. Zero new dependencies — pure Rust stdlib + serde_json + serde_yaml (existing). Routing detects "conda environment", "environment.yml", "conda env", "parse conda", "conda dependencies", "conda packages", "conda channels", "compare conda", "validate conda", "export conda", "conda to pip", "conda requirements", "conda yml", "conda yaml", "anaconda environment", and related phrases.
Bioinformatics tools — ✓ Done. bio_tools tool analyzes biological sequences (DNA, RNA, protein) and parses FASTA files without external utilities. 8 actions: info (default — sequence type auto-detection from alphabet, length, composition, GC content for nucleotides, unique amino acids for proteins), complement (reverse complement of a DNA sequence; A↔T G↔C), transcribe (DNA→RNA via T→U or RNA→DNA via U→T), translate (RNA or DNA codon-by-codon to amino acid single-letter codes; supports all 3 reading frames or 'all_frames: true' for 6-frame translation; full 64-codon standard genetic code table), gc (GC content percentage with per-50-nt sliding window min/max), orfs (open reading frames in all 6 frames — ATG-to-stop, minimum length filter via 'min_length' default 30 codons, start/end positions and coded protein), codons (codon usage table with counts and frequency % for each of 64 triplets), parse_fasta (parse multi-record FASTA text — per-record header, length, type, GC content, and sequence preview). Accepts 'sequence' or 'seq' for inline sequences; 'fasta'/'text' for FASTA-format input. Zero new dependencies — pure Rust stdlib. Routing detects "dna sequence", "rna sequence", "nucleotide sequence", "protein sequence", "reverse complement", "dna complement", "transcribe dna", "translate dna", "gc content", "open reading frame", "find orfs", "codon usage", "codon table", "parse fasta", "fasta file", "bioinformatics", "genetic sequence", and related phrases.
GPU VRAM tools — ✓ Done. gpu_tools tool estimates LLM VRAM requirements, analyzes GPU specs, computes batch memory, and parses nvidia-smi output without external utilities. 5 actions: estimate (default — VRAM breakdown for a model: weights_gb from params × bits-per-weight, KV cache from 2×layers×heads×head_dim×context×2 bytes, 5% overhead; GPU fit table across RTX 4060–4090 and A100; pass 'params_b', 'quantization', optional 'context', 'num_layers', 'num_heads', 'head_dim'), batch (per-batch activation memory from hidden_size×seq_len×num_layers×4 bytes; pass 'batch_size', 'seq_len', 'hidden_size', 'num_layers'), info (GPU spec lookup by name — VRAM, CUDA cores, tensor cores, bandwidth, FP16 TFLOPS, architecture; 22 GPUs: RTX 4090/4080/4070/4060 series, RTX 3090/3080/3070/3060, RTX 2080/2070, A100 40/80 GB, H100; pass 'gpu'), parse (parse nvidia-smi plain-text output — GPU name, driver, CUDA version, temperature, power, VRAM used/free/total), budget (quantization vs model size fit table for a given VRAM budget; shows which quantizations of 7B/13B/30B/70B models fit; pass 'vram_gb'). Bits-per-weight: FP32=32, FP16/BF16=16, Q8=8.5, Q6=6.5, Q5=5.5, Q4=4.5, Q3=3.5, Q2=2.6, Q1=1.7. Zero new dependencies — pure Rust stdlib. Routing detects "vram estimate", "model vram", "vram for model", "how much vram", "vram needed", "gpu memory", "llm vram", "gpu specs", "parse nvidia-smi", "vram budget", "q4 model size", "gguf size", "gguf vram", "7b vram", "13b vram", "70b vram", and related phrases.
Classical Mechanics tools — ✓ Done. mechanics_tools tool performs classical mechanics calculations without external utilities. 8 actions: kinematics (SUVAT equations — solve_for: v/s/a/t/u; all five equations: v=u+at, s=ut+½at², v²=u²+2as, s=½(u+v)t), forces (Newton's second law F=ma; friction force f=μN with normal force; incline analysis with weight components, friction, net force, and acceleration), energy (solve_for: KE/GPE/spring PE/conservation/power/work; conservation gives max speed at ground; power P=Fv; work W=Fs·cos(θ)), momentum (linear momentum p=mv; impulse J=FΔt; elastic collision with v1'/v2' and KE verification; perfectly inelastic collision with final velocity and KE lost), rotation (torque τ=rF·sin(θ); moment of inertia for 7 shapes: solid_sphere/hollow_sphere/solid_cylinder/ring/rod_center/rod_end/disk; angular acceleration α=τ/I; rotational KE=½Iω²; angular momentum L=Iω), oscillation (spring-mass period T=2π√(m/k); simple pendulum T=2π√(L/g); spring constant k from period; SHM position/velocity/acceleration at time t), projectile (range R=v0²sin(2θ)/g; max height H=vy0²/(2g); time of flight; optional position/speed at any time t), circular (centripetal: Fc=mv²/r with ac/ω/period; orbital: Fc from universal gravitation). Zero new dependencies — pure Rust stdlib. Routing detects "kinematics", "suvat", "projectile motion", "centripetal force", "circular motion", "moment of inertia", "torque calculation", "angular momentum", "simple harmonic motion", "spring period", "pendulum period", "elastic collision", "conservation of momentum", "conservation of energy", "kinetic energy formula", "gravitational potential energy", "newton's second law", "friction force", "inclined plane", "orbital speed", "classical mechanics", and related phrases.
Circuit tools — ✓ Done. circuit_tools tool performs electrical circuit calculations without external utilities. 8 actions: ohm (Ohm's law V=IR — solve_for: V/I/R), resistors (series: R_total=ΣR; parallel: R_total=1/Σ(1/R); two-resistor product-over-sum shortcut; pass mode:'series'/'parallel' + values array or R1/R2), power (solve_for: P_VI=VI/P_IR=I²R/P_VR=V²/R/efficiency=Pout/Pin; optionally t for energy in J and Wh), capacitors (solve_for: series/parallel combinations; energy E=½CV² with charge Q=CV; rc time constant τ=RC with charging/discharging V at any t), inductors (solve_for: series/parallel combinations; energy E=½LI²; rl time constant τ=L/R with current build-up at any t; instantaneous voltage VL=L·dI/dt), divider (voltage divider Vout=Vin·R2/(R1+R2) with ratio and current; current divider I1=I·R2/(R1+R2)); rlc (series RLC: resonant frequency f0=1/(2π√(LC)), Q-factor, bandwidth BW=f0/Q, damping ratio ζ, response type; optionally XL/XC/Z/phase at a given frequency), ac (AC impedance Z=√(R²+(XL-XC)²); phase angle φ and inductive/capacitive classification; power factor cos(φ); optionally real/apparent/reactive power from V). Zero new dependencies — pure Rust stdlib. Routing detects "ohm's law", "ohms law", "resistors in series", "resistors in parallel", "electrical power", "rc circuit", "rl circuit", "rlc circuit", "resonant frequency circuit", "q-factor circuit", "impedance", "voltage divider", "current divider", "capacitor energy", "rc time constant", "rl time constant", "power factor", "ac impedance", "reactive power", "circuit analysis", and related phrases.
Thermodynamics tools — ✓ Done. thermo_tools tool performs thermodynamics and fluid mechanics calculations without external utilities. 8 actions: ideal_gas (default — PV=nRT solver; solve_for: P/V/n/T plus the other 3 variables; shows result in Pa/kPa/atm or m³/L or mol or K/°C), work (thermodynamic work for process: isothermal/isobaric/isochoric/adiabatic; isothermal shows W=nRT·ln(V2/V1) and ΔS; adiabatic uses γ; isobaric uses P·ΔV; isochoric returns W=0), entropy (entropy change: isothermal=nR·ln(V2/V1), isobaric=n·Cp·ln(T2/T1), isochoric=n·Cv·ln(T2/T1), mixing=-nR·Σxi·ln(xi)), heat (mode: conduction via Fourier's Law with thermal resistance; convection via Newton's law with h reference table; radiation via Stefan-Boltzmann with emissivity and blackbody comparison), cycles (efficiency: Carnot with COP_HP/COP_cool; Otto with γ; Diesel with cutoff ratio; Brayton with pressure ratio), fluid (mode: reynolds with laminar/transitional/turbulent regime; bernoulli with pressure at point 2; poiseuille with Q, average and max velocity; continuity with v2 and ratio), properties (substance: air/nitrogen/oxygen/co2/hydrogen/helium/argon/methane/steam — molar mass, Cp, Cv, γ, μ at 20°C, k at 20°C, specific R), psychro (T_dry+T_wet or T_dry+RH → relative humidity, vapor pressure, humidity ratio, dew point via Antoine equation and Sprung's formula). Zero new dependencies — pure Rust stdlib. Routing detects "ideal gas", "pv=nrt", "isothermal", "isobaric", "isochoric", "adiabatic process", "thermodynamic work", "entropy change", "heat conduction", "fourier's law", "carnot cycle", "carnot efficiency", "otto cycle", "diesel cycle", "brayton cycle", "reynolds number", "bernoulli equation", "poiseuille", "relative humidity", "dew point", "thermodynamics", and related phrases.
Optics tools — ✓ Done. optics_tools tool performs optics and photonics calculations without external utilities. 8 actions: refraction (default — Snell's law with sin(θ2) computation; critical angle and TIR detection for n1>n2; pass n1, n2, and theta1 or theta2), lens (thin lens equation with 2 of f/do/di — solves for the missing one; reports real/virtual image, upright/inverted, magnification; OR lensmaker's equation from R1/R2/n_lens), mirror (mirror equation from f or R plus one of do/di; reports concave/convex, image type, magnification), diffraction (single-slit minima at a·sin(θ)=m·λ with positions at screen distance L; diffraction grating d·sin(θ)=m·λ with max order), interference (double-slit fringe spacing Δy=λL/a with fringe positions; thin film with phase-shift analysis, constructive/destructive conditions, and thickness table for each order), polarization (Malus's law I=I₀·cos²(θ) with transmission %; or Brewster's angle θ_B=arctan(n2/n1) with refracted angle), fiber (optical fiber: NA=√(n_core²-n_clad²), acceptance angle, critical angle, relative index difference Δ; V-number with single/multi-mode classification when lambda+D provided), blackbody (Wien's displacement λ_max=b/T, Stefan-Boltzmann M=σT⁴, Planck's law B_λ at optional wavelength_nm; color temperature description). Zero new dependencies — pure Rust stdlib. Routing detects "snell's law", "refraction", "critical angle", "total internal reflection", "thin lens", "focal length", "lensmaker", "mirror equation", "diffraction grating", "double slit", "young's experiment", "interference pattern", "thin film interference", "malus's law", "brewster angle", "optical fiber", "numerical aperture", "blackbody radiation", "planck's law", "wien's law", "wien displacement", and related phrases.
Quantum mechanics tools — ✓ Done. quantum_tools tool performs quantum mechanics calculations without external utilities. All constants are CODATA 2018 values. 8 actions: particle_box (default — particle in a 1D infinite square well: energy levels En=n²π²ħ²/(2mL²), de Broglie wavelength, momentum; pass L in m, optionally n and m), hydrogen (hydrogen atom energy levels En=-13.6/n² eV, or Rydberg transition wavelength via 1/λ=R_∞(1/n1²-1/n2²); pass n, or n1+n2 for transition with series name), uncertainty (Heisenberg uncertainty ΔxΔp≥ħ/2 and ΔEΔt≥ħ/2; pass solve_for: 'delta_p'/'delta_x'/'delta_E'/'delta_t' + known variable), de_broglie (de Broglie wavelength λ=h/p; pass v in m/s, p in kg·m/s, or E in eV as KE; optionally m for non-electron mass), photoelectric (photoelectric effect KE_max=hf-φ, stopping potential, threshold frequency/wavelength; pass phi in eV + f in Hz or lambda in nm), compton (Compton scattering Δλ=λ_C(1-cosθ), scattered wavelength, electron recoil KE; pass theta in degrees + lambda in nm), tunneling (quantum tunneling T≈e^(-2κL), penetration depth 1/κ; pass E in eV, V0 in eV, L in nm; optionally m), harmonic (quantum harmonic oscillator En=(n+½)ħω, zero-point energy, level spacing; pass omega in rad/s or k in N/m; optionally n and m). Zero new dependencies — pure Rust stdlib. Routing detects "quantum", "particle in a box", "infinite square well", "hydrogen energy level", "rydberg", "heisenberg uncertainty", "uncertainty principle", "de broglie", "photoelectric effect", "work function", "compton scattering", "quantum tunneling", "quantum harmonic oscillator", "zero-point energy", and related phrases.
Electromagnetism tools — ✓ Done. em_tools tool performs electromagnetism calculations without external utilities. All constants are CODATA 2018 values. 8 actions: coulomb (default — Coulomb's law F=ke·q1q2/r², electric field, potential, potential energy; pass q1, q2, r), electric_field (point charge electric field E=ke·q/r², potential V=ke·q/r, Gauss flux; pass q, r), magnetic_field (magnetic field for geometry: 'wire' B=μ₀I/2πr, 'loop' B=Nμ₀I/2r, 'solenoid' B=μ₀nI, 'toroid' B=μ₀NI/2πr; pass I + geometry + dimensions), capacitance (for geometry: 'parallel_plate' C=εA/d, 'cylindrical' C=2πεL/ln(b/r), 'spherical' C=4πεrb/(b-r); pass geometry + dimensions; optionally epsilon_r and v for energy/charge), inductance (for geometry: 'solenoid' L=μ₀N²A/l, 'toroid' L=μ₀N²A/2πr, 'coaxial' L=μ₀l/2π·ln(b/r); pass geometry + dimensions; optionally I for energy/flux), em_wave (EM wave: frequency, wavelength, period, photon energy E=hf, spectrum region; pass f in Hz or lambda in m/nm; optionally E_field or B_field for intensity), lorentz (Lorentz force F=q(E+v×B); scalar 1D cases; circular orbit radius; pass q + E_field and/or B_field + v; optionally theta), poynting (Poynting vector S=E×B/μ₀, time-averaged intensity, electric/magnetic/total energy density, radiation pressure; pass E_field and B_field). Zero new dependencies — pure Rust stdlib. Routing detects "coulomb's law", "coulombs law", "electric force", "electric field point charge", "magnetic field wire", "magnetic field solenoid", "parallel plate capacitance", "solenoid inductance", "electromagnetic wave", "em wave", "lorentz force", "lorentz law", "poynting vector", "radiation pressure", "electromagnetism", "gauss's law", "faraday's law", "ampere's law", and related phrases.
Special Relativity tools — ✓ Done. relativity_tools tool performs special relativity calculations without external utilities. All constants are CODATA 2018 values. 8 actions: gamma (default — Lorentz factor γ=1/√(1−β²) from v or beta; ultra-relativistic and non-relativistic approximations), lorentz (TIME DILATION Δt=γτ, LENGTH CONTRACTION L=L₀/γ, and relativistic velocity addition; pass 't' for time dilation, 'l' for contraction, 'u' for velocity addition), energy (E=γmc², KE=(γ−1)mc², rest energy E₀=mc², comparison with classical ½mv²; pass 'particle' for named particle or 'm' in kg or 'm_mev'), momentum (relativistic p=γmv and energy-momentum relation E²=(pc)²+(mc²)²; 'particle', 'm' kg, or 'm_mev'), transform (Lorentz coordinate transformation x'=γ(x−vt), t'=γ(t−vx/c²) with inverse check and interval; pass 'x' and 't_coord'), doppler (relativistic Doppler f_obs/f_src=√((1±β)/(1∓β)); pass 'freq' in Hz for absolute values; 'direction' approaching/receding), interval (spacetime interval s²=(cΔt)²−(Δx)² with TIMELIKE/SPACELIKE/LIGHTLIKE classification and proper time/distance; pass 'x' and 't_coord'), kinematics (full γ/E/KE/p summary for a named particle at given β). Accepts particle names: electron, proton, neutron, muon, or '#u' for N AMU. Zero new dependencies — pure Rust stdlib. Routing detects "special relativity", "lorentz factor", "time dilation", "length contraction", "relativistic energy", "relativistic momentum", "lorentz transformation", "relativistic doppler", "spacetime interval", "proper time", "e=mc2", "e=mc²", "rest energy", "velocity addition relativistic", "twin paradox", "minkowski", "four-momentum", and related phrases.
Nuclear Physics tools — ✓ Done. nuclear_tools tool performs nuclear physics calculations without external utilities. All constants are CODATA 2018 values. 8 actions: decay (default — radioactive decay N(t)=N₀e^(−λt); pass 'n0' for atoms or 'a0' for Bq; pass one of 't_half', 'lambda', 'tau' for the decay constant; shows remaining%, decayed%, half-lives elapsed), halflife (convert between T½, λ=ln2/T½, and τ=1/λ with practical time-unit display), binding_energy (Bethe-Weizsäcker SEMF with 5 terms: volume +aᵥA, surface −aₛA^(2/3), Coulomb −aCZ²/A^(1/3), asymmetry −aA(A−2Z)²/A, pairing δ; pass 'z' and 'a'; output: total B, B/A per nucleon, nucleus mass estimate), q_value (Q=(Σm_reactants−Σm_products)×931.494 MeV/u; pass 'reactants' and 'products' as mass arrays in u; exo/endothermic verdict), activity (Bq↔Ci↔mCi↔μCi↔dps↔dpm conversions; pass 'bq', 'ci', or 'mci'), dose (absorbed dose Gy↔rad and equivalent dose Sv↔rem with radiation weighting factors; pass 'gy', 'sv', 'rad', or 'rem'; optional 'radiation' type gamma/alpha/beta/neutron/proton/heavy_ion; context table for background/X-ray/CT/limit/ARS), carbon_dating (C-14 T½=5730 yr; 'ratio' → age in years, or 't_years' → fraction remaining), reactions (7 preset nuclear reactions with Q-values and energy density: fusion_dt D+T→⁴He+n 17.59 MeV, fusion_dd D+D→³He+n 3.27 MeV, fusion_pp p+p→²D+e⁺+νₑ 0.42 MeV, fission_u235 202.5 MeV, fission_pu239 210.0 MeV, alpha_decay Ra-226 4.871 MeV, beta_decay n 0.782 MeV; use reaction='list'). Zero new dependencies — pure Rust stdlib. Routing detects "radioactive decay", "half-life", "halflife", "nuclear binding energy", "bethe-weizsacker", "liquid drop model", "q-value nuclear", "radiation dose", "sievert", "gray dose", "becquerel", "curie activity", "carbon dating", "radiocarbon", "c-14 dating", "nuclear fission energy", "nuclear fusion energy", "alpha decay", "beta decay", "decay constant", "mean lifetime radioactive", "radioactivity", "semi-empirical mass formula", "semf", and related phrases.
Acoustics tools — ✓ Done. acoustics_tools tool performs acoustics and sound engineering calculations without external utilities. 8 actions: wave (default — wavelength λ=v/f, period T=1/f, wave number k=2π/λ, and angular frequency ω=2πf from 'freq' in Hz; optional 'temp_c' for speed-of-sound correction; audio band label and nearest musical note), decibels (SPL=20·log₁₀(p/p₀) from 'pressure' in Pa; intensity level from 'intensity' in W/m²; or dB→Pa inverse; shows context label for silence/whisper/conversation/concert/pain), doppler (f_obs=f_src·(v+v_obs)/(v−v_src) for 'freq' + 'v_source'/'v_observer' in m/s; approaching/receding classification; optional 'temp_c'), resonance (fundamental and harmonic series for 'type': open_pipe/closed_pipe/string; 'length' in m; 'n_harmonics' count; optional 'temp_c'), impedance (acoustic impedance Z=ρ·c for 'medium1'/'medium2'; reflection coefficient r=(Z₂−Z₁)/(Z₂+Z₁) and transmission T=4Z₁Z₂/(Z₁+Z₂)²; transmission loss in dB; supported media: air/water/steel/concrete/wood/tissue), rt60 (Sabine formula RT60=0.161·V/A; pass 'volume' m³ and 'absorption' m²; room type label: anechoic/studio/concert hall/cathedral), hearing (human auditory range table: frequency bands 20–20000 Hz with sensitivity and threshold of pain; optional 'freq' to classify a specific frequency as infrasound/audible/ultrasound), beat (beat frequency |f₁−f₂|, carrier frequency, frequency ratio, musical interval, overtone series for 'f1'/'f2' in Hz). Zero new dependencies — pure Rust stdlib. Routing detects "sound wave", "sound frequency", "acoustic", "acoustics", "decibel", "sound level", "spl ", "sound pressure", "doppler effect sound", "resonance frequency", "standing wave", "acoustic impedance", "sound transmission", "rt60", "reverberation time", "room acoustics", "sabine formula", "hearing range", "audible frequency", "beat frequency", "beat note", "speed of sound", and related phrases.
Materials Science tools — ✓ Done. materials_tools tool performs materials science and structural engineering calculations without external utilities. 8 actions: properties (default — full material datasheet for any of 18 materials: density ρ, Young's modulus E, Poisson's ratio ν, yield strength σ_y, thermal expansion coefficient α, thermal conductivity k; accepts common names like steel, aluminum, copper, titanium, glass, nylon, carbon_fiber, kevlar, bone, rubber), stress (axial stress σ=F/A, strain ε=σ/E, deformation δ=εL, lateral strain ε_lat=−ν·ε; pass 'material'/'E_gpa', 'force' N, 'area' m², optional 'length'), thermal (linear expansion ΔL=α·L₀·ΔT and volumetric expansion ΔV=3α·V₀·ΔT; thermal stress σ_thermal=E·α·ΔT; pass 'material'/'alpha_um', 'delta_t' °C, 'length' m, optional 'volume'), bending (simply supported beam under central point load: max moment M=FL/4, bending stress σ=M·c/I, deflection δ=FL³/(48EI), section modulus Z=I/c, moment of inertia I=bh³/12; pass 'material', 'force' N, 'length' m, 'width' m, 'height' m), hardness (Mohs scale 1–10 with mineral names and everyday examples; engineering hardness table for 11 common materials with Vickers HV and Brinell HB values; optional 'material' to look up a specific entry), pressure (hydrostatic pressure P=ρ_fluid·g·depth and buoyancy F_b=ρ_fluid·g·V_obj; pressure in Pa/kPa/atm/psi; buoyancy vs weight verdict; pass 'depth' m for pressure, add 'volume' m³ and 'density' kg/m³ for buoyancy), safety (factor of safety FS=σ_yield/σ_applied with design-quality assessment; pass 'material' or 'yield_mpa', and 'applied_stress' MPa), crystal (unit cell detail for 5 structures: FCC/BCC/HCP/SC/Diamond — atomic packing factor APF, coordination number CN, atoms per unit cell, representative elements, lattice parameters and volume for optional 'lattice_a' in Å). Zero new dependencies — pure Rust stdlib. Routing detects "material properties", "young's modulus", "youngs modulus", "elastic modulus", "poisson's ratio", "yield strength", "tensile strength", "stress strain", "thermal expansion", "coefficient of expansion", "beam bending", "bending stress", "bending moment", "moment of inertia beam", "mohs hardness", "material hardness", "vickers hardness", "brinell hardness", "buoyancy force", "buoyant force", "archimedes principle", "hydrostatic pressure", "factor of safety", "crystal structure", "fcc crystal", "bcc crystal", "atomic packing", and related phrases.
Astronomy tools — ✓ Done. astro_tools tool computes planetary positions, rise/set times, angular separations, apparent magnitudes, constellation lookups, moon phase, and Julian date conversions without external utilities. 8 actions: planet (default — heliocentric and geocentric ecliptic longitude/latitude and distance for any of 8 planets at a given date; mean orbital elements at J2000 + linear rates; Kepler's equation via Newton iteration), rise_set (civil rise and set time in UTC for an object at given RA/Dec and observer lat/lon), separation (great-circle angular separation in degrees between two RA/Dec points via haversine on sphere), magnitude (distance-modulus apparent magnitude from absolute magnitude and distance in au/ly/pc), distance (convert between au, ly, and pc), constellation (look up the IAU constellation for a given RA/Dec, or search the 88 IAU constellations by name or abbreviation), moon_phase (simplified synodic phase for a date — illumination percentage, phase name, New/Full/Quarter timing), julian (convert between calendar date and Julian Day Number in both directions). Zero new dependencies — pure Rust stdlib. Routing detects "planet position", "planetary position", "heliocentric", "geocentric", "rise and set", "angular separation", "apparent magnitude", "constellation", "moon phase", "lunar phase", "julian date", "julian day", "j2000", "ephemeris", "astronomy", "celestial", "right ascension", "declination", and related phrases.
Signal processing tools — ✓ Done. signal_tools tool performs DSP operations — DFT/IDFT, FIR filter design, windowing, convolution, statistical analysis, polyphase resampling, and autocorrelation — without external utilities. 8 actions: dft (default — O(n²) DFT up to 8192 samples; optional sample_rate for frequency-bin labels in Hz; outputs magnitude/phase per bin plus top-5 dominant frequencies), idft (inverse DFT from parallel real+imaginary arrays; reconstructs time-domain signal), convolve (linear convolution of signal × kernel; output length = n+m-1), fir (windowed-sinc FIR design; 'filter_type': lowpass/highpass/bandpass/bandstop; 'cutoff'/'cutoff_low'+'cutoff_high' as normalized 0–1 frequencies; 'taps' count; 'window': rectangular/hanning/hamming/blackman/bartlett/flat_top/kaiser; highpass via spectral inversion, bandpass via LP subtraction, bandstop inverse), window (generate a named window function of N points; 'type': any of 7 windows; optional 'beta' for Kaiser β parameter; reports NENBW, sidelobe level, coherent gain), stats (signal statistics — mean, median, variance, std, RMS, min, max, energy, power, crest factor, zero crossings, Shannon entropy), resample (polyphase rational resampling with anti-alias FIR; 'up'/'down' integer ratio 1–64), autocorr (biased autocorrelation up to 64 lags with dominant period detection). Zero new dependencies — pure Rust stdlib. Routing detects "discrete fourier", "dft of", "idft", "fir filter", "fir design", "lowpass filter", "highpass filter", "bandpass filter", "window function", "hamming window", "kaiser window", "convolve signal", "resample signal", "upsample", "downsample", "autocorrelation", "signal statistics", "signal power", "rms of signal", "zero crossing", "signal processing", "digital filter", and related phrases.
CORS tools — ✓ Done. cors_tools tool parses, validates, generates, and simulates CORS (Cross-Origin Resource Sharing) headers without external utilities. 5 actions: parse (default — decode all Access-Control-* headers with annotations; pass 'headers' object), validate (spec violation check: wildcard+credentials conflict, bad methods, max-age overflow; VALID/WARNINGS/INVALID verdict), generate (build response headers for 'origin' given 'allowed_origins'/'allowed_methods'/'allowed_headers'/'allow_credentials'/'max_age'), explain (plain-English meaning per CORS header; pass 'headers'), preflight (simulate OPTIONS preflight — PASS/FAIL per origin/method/header with full request/response; pass 'origin', 'method', 'request_headers', and server config). Zero new dependencies — pure Rust stdlib. Routing detects "cors header", "cors policy", "cors config", "access-control-allow-origin", "cors preflight", "preflight request", "generate cors", "validate cors", "cross-origin resource sharing", and related phrases.
Web Manifest tools — ✓ Done. web_manifest_tools tool parses, validates, and inspects PWA Web App Manifest files (manifest.json / .webmanifest) without external utilities. 5 actions: parse (default — full manifest field summary including icons/screenshots/shortcuts/share-target counts; pass 'manifest' as JSON object/string or 'file' path), validate (PWA installability check — name, 192×192 and 512×512 icons, maskable icon, display mode; VALID/WARNINGS/INVALID verdict), icons (tabular listing of all icons with src, sizes, type, and purpose), screenshots (list screenshots with sizes, form_factor, label, platform), info (concise install/display summary: display mode, orientation, scope, theme/background colors, advanced API declarations, shortcuts). Zero new dependencies — pure Rust stdlib. Routing detects "web manifest", "manifest.json", ".webmanifest", "pwa manifest", "manifest icons", "maskable icon", "installable pwa", "pwa installability", "add to home screen", and related phrases.
.gitignore tools — ✓ Done. gitignore_tools tool parses, checks, generates, and explains .gitignore files without external utilities. 4 actions: parse (default — list all patterns grouped by comment sections; counts patterns/comments/negations; [DIR] and [UNIGNORE] flags), check (test if a file path is IGNORED or NOT IGNORED — applies all rules in order including negation; pass 'path'), generate (produce a standard .gitignore for a language; pass 'language': rust/node/python/go/java/dotnet/react/docker), explain (plain-English description of each pattern — negation, directory-only scope, anchoring, glob semantics). Zero new dependencies — pure Rust stdlib. Routing detects ".gitignore", "gitignore pattern", "is this file ignored", "ignored by git", "generate gitignore", "explain gitignore", and related phrases.
GraphQL tools — ✓ Done. graphql_tools tool parses, inspects, and validates GraphQL schema definitions and query documents without external utilities. 4 actions: info (default — document kind detection (schema definition / query document / mixed), counts for types/interfaces/inputs/enums/unions/scalars/directives/operations/fragments, schema root type bindings), types (list all type definitions with fields, args, implements, and deprecation flags; optional 'filter' for name-substring filtering), queries (list all operations and fragments with top-level field names), validate (warn on: empty types, empty interfaces, empty unions, union members referencing undefined types, field types referencing undefined types, missing query root). Handles inline field arguments, aliases, variables, directives, descriptions (triple-quoted strings), extensions, and fragment spreads. Custom recursive-descent parser over a compact token stream (GTok). Zero new dependencies — pure Rust stdlib. Routing detects "graphql", ".graphql", "gql", "graphql schema", "graphql query", "graphql mutation", "graphql type", "introspection", "apollo schema", "sdl", and related phrases.
License tools — ✓ Done. license_tools tool looks up, detects, compares, and lists 14 SPDX software licenses without external utilities. 4 actions: info (default — full detail: SPDX ID, category, copyleft/patent-grant/commercial/sublicensing flags, summary, permissions/conditions/limitations; pass 'license'), detect (identify license from raw file text; pass 'text'), compare (side-by-side property table for two licenses; pass 'a' and 'b'), list (all 14 licenses grouped by Permissive/Weak Copyleft/Strong Copyleft/Public Domain; optional 'category' filter). Covers: MIT, Apache-2.0, GPL-2.0, GPL-3.0, LGPL-2.1, LGPL-3.0, MPL-2.0, AGPL-3.0, BSD-2-Clause, BSD-3-Clause, ISC, Unlicense, CC0-1.0, EUPL-1.2. Zero new dependencies — pure Rust stdlib. Routing detects "software license", "open source license", "MIT license", "copyleft", "spdx", "detect license", "compare licenses", "permissive license", and related phrases.
Lock file tools — ✓ Done. lock_file_tools tool analyzes dependency lock files — Cargo.lock, package-lock.json (v1/v2/v3), yarn.lock, and poetry.lock — without external utilities. 4 actions: info (default — format, lockfile version, total package count, and multi-version packages summary), list (all packages with name, version, and source; 'limit' to cap output), search ('query' substring filter on package name), duplicates (packages appearing at more than one version — the most actionable deduplication view). Auto-detects format from filename or content heuristics (JSON → npm, # yarn lockfile header → yarn, [[package]] → Cargo/Poetry). Pass 'file' for a path or 'text' for inline content. Zero new dependencies — pure Rust stdlib + serde_json. Routing detects "cargo.lock", "package-lock.json", "yarn.lock", "poetry.lock", "lock file", "lockfile", "lock file analysis", "analyze lock", "parse lock", "dependency lock", "duplicate dependencies", "duplicate packages", "dedupe", and related phrases.
Makefile tools — ✓ Done. make_tools tool parses and analyzes Makefiles without external utilities. 4 actions: list (default — all targets with dependencies, phony flag, and inline comment in a tabular view), explain (full detail for one target — description from comment, phony flag, deps list, numbered command list; pass 'target'), deps (dependency graph — all targets or a single target; pass optional 'target'), vars (all variable assignments — name, operator (=/:=/?=/+=), and truncated value). Handles .PHONY declarations, comment-to-target association, and command lines. Zero new dependencies — pure Rust stdlib. Routing detects "makefile", "make target", "make deps", "make variables", "parse makefile", "makefile target", and related phrases.
Changelog tools — ✓ Done. changelog_tools tool parses, queries, and validates CHANGELOG.md files in Keep a Changelog format without external utilities. 4 actions: list (default — all releases with version, date, section names, item counts, and YANKED flag), get (full body of a specific version; pass 'version' — partial match supported), latest (full body of the most recent non-Unreleased release), validate (Keep a Changelog compliance check — warns on missing Unreleased section, missing dates, non-standard section names, empty releases, YANKED releases). Zero new dependencies — pure Rust stdlib. Routing detects "changelog", "release notes", "parse changelog", "latest release", "changelog.md", "keep a changelog", "what changed in version", and related phrases.
SSH config tools — ✓ Done. ssh_config_tools tool parses, queries, explains, and validates ~/.ssh/config files without external utilities. 4 actions: list (default — summary of all Host blocks with HostName, User, Port, IdentityFile, and ProxyJump), get (all options for a named host; pass 'host' — partial match supported), explain (plain-English description of every option using 25 known SSH directives including ProxyJump, ForwardAgent, StrictHostKeyChecking, ServerAliveInterval, ControlMaster; optional 'host' filter), validate (warn on duplicate Host patterns, StrictHostKeyChecking=no MITM risk, and relative IdentityFile paths). Auto-detects: host present → get, else → list. Zero new dependencies — pure Rust stdlib. Routing detects "ssh config", "/.ssh/config", "ssh configuration", "proxyjump", "identityfile", "stricthostkeychecking", and related phrases.
Docker Compose tools — ✓ Done. docker_compose_tools tool parses, inspects, and validates docker-compose.yml files without running Docker or external tools. 7 actions: services (default — all services with image/build, ports, restart policy, depends_on, volume/env counts), inspect (full detail for one service including command, entrypoint, healthcheck; pass 'service'), ports (host:container port mappings across services with well-known port annotations: 80=HTTP, 5432=PostgreSQL, 6379=Redis, 27017=MongoDB, etc.), volumes (named top-level volumes + per-service bind mount vs named-volume classification), networks (defined network drivers + service→network membership), env (environment variables per service with credential-shaped values redacted; optional 'service' filter), validate (missing image/build, undefined depends_on references, privileged mode, host network_mode). Uses serde_yaml (existing dep). Routing detects "docker-compose.yml", "compose file", "docker compose services", "parse docker-compose", "docker compose ports", "explain docker-compose", and related phrases.
Nginx config tools — ✓ Done. nginx_conf_tools tool parses, inspects, and validates nginx.conf files without external utilities. 5 actions: list (default — all server blocks with server_name, listen ports, root/proxy, SSL state, location count), inspect (full detail for one server block with all directives and location blocks; pass 'server' as server_name or 1-based index), locations (all location blocks with proxy_pass/root/alias targets; optional 'server' filter), directives (global and http-context directives plus upstream definitions), validate (warn on missing server_name, SSL without certificate, proxy_pass without Host header, multiple default servers). Custom tokenizer handles comments, quoted strings, nested blocks. Zero new dependencies — pure Rust stdlib. Routing detects "nginx.conf", "nginx config", "nginx server block", "nginx location", "proxy_pass", "nginx upstream", "nginx vhost", and related phrases.
OpenAPI tools — ✓ Done. openapi_tools tool parses, queries, searches, and validates OpenAPI 3.x / Swagger 2.x specs (YAML or JSON) without external utilities. 5 actions: info (default — title, API version, description, servers list, endpoint/schema counts, tag summary, auth schemes), endpoints (all paths+methods with summary, tags, deprecated flag; pass 'tag' to filter), schemas (schema/definition names with type, description, properties with required flags; pass 'schema' to filter), search (filter endpoints by path, summary, operationId, tag, or HTTP method; pass 'query'), validate (missing info section, empty paths, missing summaries/operationIds, duplicate operationIds, deprecated endpoints). Uses serde_yaml (existing dep). Routing detects "openapi", "swagger", "api spec", "oas3", "swagger.yaml", "openapi.yaml", "api endpoints", "api schemas", and related phrases.
Dockerfile tools — ✓ Done. dockerfile_tools tool parses, inspects, and validates Dockerfiles without external utilities. 3 actions: info (default — base image and tag per stage, multi-stage alias, WORKDIR, USER, exposed ports, CMD/ENTRYPOINT, HEALTHCHECK flag, instruction counts), layers (all instructions in order with type and content), validate (best-practice checks: latest tag on FROM, running as root with no USER, ADD instead of COPY, curl/wget piped to shell, secrets in ENV/ARG, missing CMD/ENTRYPOINT, no HEALTHCHECK). Custom line-continuation parser handles backslash continuations and comment stripping. Zero new dependencies — pure Rust stdlib. Routing detects "dockerfile", "docker file", "dockerfile layers", "dockerfile best practices", "healthcheck instruction", "entrypoint instruction", and related phrases.
Kubernetes tools — ✓ Done. k8s_tools tool parses, inspects, and validates Kubernetes manifests (Deployment, Service, Pod, StatefulSet, DaemonSet, Job, CronJob, Ingress, ConfigMap) without external utilities. 4 actions: info (default — kind, apiVersion, name, namespace, labels, replicas/selector/strategy for workloads, port list for Services, key list for ConfigMaps, container summary), containers (per-container detail: image, ports, resource requests/limits, env vars, volume mounts, liveness/readiness/startup probes, security context), volumes (all volume types with source detail: ConfigMap, Secret, PVC, HostPath, EmptyDir, NFS, Projected), validate (checks: missing kind/apiVersion/name, image without pinned tag, missing resource limits, privileged containers, no runAsNonRoot/runAsUser, missing liveness/readiness probes, hostPath volumes, hostNetwork/hostPID, single replica). Uses serde_yaml (existing dep). Routing detects "kubernetes", "k8s", "kubectl", "kubernetes manifest", "kubernetes deployment", "kubernetes pod spec", "validate k8s", "resource limits", "livenessProbe", "readinessProbe", and related phrases.
GitHub Actions tools — ✓ Done. github_actions_tools tool parses, inspects, and validates GitHub Actions workflow YAML without external utilities. 5 actions: info (default — workflow name, triggers summary, and per-job overview with runs-on/step count/needs), jobs (detailed job listing with runs-on, step count, needs dependencies, matrix and concurrency indicators, env var counts), steps (all steps per job with name, uses, run command preview, and if condition; optional 'job' filter for a specific job), triggers (full trigger detail including branches/tags/paths filters per event, cron schedules, workflow_dispatch input counts, concurrency group), validate (warn on missing 'on' triggers, missing runs-on, undefined needs references, steps with neither uses nor run, missing top-level permissions). Uses serde_yaml (existing dep). Routing detects "github actions", "github workflow", ".github/workflows", "workflow triggers", "workflow jobs", "workflow steps", "runs-on", "uses: actions/", and related phrases.
Systemd unit tools — ✓ Done. systemd_tools tool parses, inspects, and validates systemd unit files (.service/.timer/.socket/.mount) without external utilities. 4 actions: info (default — unit type detection, description, all section summaries: [Unit] deps/ordering, [Service] type+exec+restart+user, [Timer] trigger schedule, [Socket] listeners, [Install] WantedBy/RequiredBy), service (detailed [Service] breakdown grouped by: exec commands ExecStartPre/Start/Post/Reload/Stop, identity User/Group/DynamicUser, restart policy with RestartSec/StartLimitBurst, environment variables and EnvironmentFile, security hardening NoNewPrivileges/PrivateTmp/ProtectSystem/ProtectHome/CapabilityBoundingSet), timer (all timer triggers with human-readable explanations for OnCalendar named shortcuts daily/weekly/hourly/monthly, Persistent flag with miss-recovery note, AccuracySec, RandomizedDelaySec), validate (warn on missing Description, missing ExecStart for service units, Type=forking without PIDFile, no Restart= directive, running as root, missing NoNewPrivileges/PrivateTmp security hardening, missing [Install] section, timer with no trigger directive). Zero new dependencies — pure Rust stdlib. Routing detects "systemd unit", "systemd service", "systemd timer", ".service file", ".timer file", "unit file", "execstart", "wantedby=", "oncalendar", "systemd hardening", "privatetmp", and related phrases.
Terraform tools — ✓ Done. terraform_tools tool parses, inspects, and validates Terraform HCL files (.tf) without external utilities. 5 actions: info (default — required_version, provider list with source/version, block counts for resource/data/module/variable/output/local), resources (list all resource blocks with type, name, and key attributes: ami, instance_type, name, location, etc.), variables (list all variable blocks with type, description, default value or '(required)', SENSITIVE flag), outputs (list all output blocks with value expression and SENSITIVE flag), validate (warn on: missing required_version, permissive/wildcard provider versions, hardcoded credentials in resource bodies, sensitive-named outputs/variables without sensitive=true). Custom character-level HCL parser handles comments, quoted string labels, and brace-depth tracking for body collection. Zero new dependencies — pure Rust stdlib. Routing detects "terraform", ".tf file", "hcl file", "main.tf", "terraform resource", "terraform variable", "terraform module", "terraform provider", "infrastructure as code", and related phrases.
package.json tools — ✓ Done. package_json_tools tool parses, inspects, and validates package.json files without external utilities. 4 actions: info (default — name, version, description, license, author, main/module/types, engine requirements, script/dep/devDep counts, keywords, repository), scripts (list all npm scripts with their command strings; optional 'filter' to narrow by name or command), deps (list dependencies by section — prod/dev/peer/optional — with version ranges and URL-dep/wildcard/local flags; optional 'kind' filter), validate (check for missing name/version/description/license, no engines field, wildcard dep versions, http:// URL deps, missing test/build scripts, no files whitelist for published packages, duplicate deps across sections). Uses serde_json (existing dep). Routing detects "package.json", "npm scripts", "node dependencies", "npm deps", "npm package", "devDependencies", "peerDependencies", "list npm scripts", and related phrases.
SQL migration tools — ✓ Done. sql_migrate_tools tool analyzes SQL migration files for risk, operation types, and safety issues without external utilities. 4 actions: analyze (default — per-statement risk classification with overall risk verdict: SAFE/LOW RISK/MEDIUM RISK/HIGH RISK/CRITICAL RISK, critical and high-risk statement counts, per-statement [RISK_LABEL] annotations and notes), risk (show only medium/high/critical operations filtered from the full migration, useful for pre-flight review), ops (operation-type summary table — counts per kind like CREATE TABLE ×2, DROP TABLE ×1 — plus a detailed listing), validate (transaction wrapping check, destructive-ops-without-transaction warning, CONCURRENTLY index-in-transaction detection, per-statement notes as warnings). 5-tier risk scoring: Safe (CREATE TABLE, CREATE INDEX CONCURRENTLY, BEGIN/COMMIT), Low (INSERT, CREATE INDEX), Medium (UPDATE with WHERE, CREATE INDEX without CONCURRENTLY, ALTER TABLE ADD COLUMN), High (DROP TABLE, ALTER TABLE DROP/ALTER COLUMN, DELETE with WHERE, TRUNCATE), Critical (DROP TABLE without IF EXISTS, DELETE without WHERE, DROP DATABASE, DROP SCHEMA). Accepts 'text' for inline SQL or 'file' for a path. Zero new dependencies — pure Rust stdlib. Routing detects "sql migration", "migration file", "migration risk", "flyway", "liquibase", "alembic", "schema migration", "db migration", ".sql migration", "migration script", and related phrases.
SQL tools — ✓ Done. sql_tools tool parses, explains, and validates SQL statements (DDL and DML) without external utilities. 4 actions: parse (default — count statements by type, list each with referenced tables, join count, and subquery flag), tables (extract CREATE TABLE definitions with column names, types, NOT NULL/PK/FK flags, table-level primary keys, and foreign key relationships), explain (plain-English explanation per statement — what it reads/writes, tables involved, joins, filters, subqueries, CTEs, modifying vs read-only), validate (warn on: SELECT *, DELETE/UPDATE without WHERE, DROP TABLE without IF EXISTS, implicit cross joins from comma-separated FROM, NOT IN NULL risk, leading-wildcard LIKE, CREATE TABLE without PK). Custom SQL tokenizer handles line/block comments, backtick/bracket identifiers, string literals, and nested parentheses for statement splitting. Zero new dependencies — pure Rust stdlib. Routing detects "sql query", "sql file", "sql statement", "create table", "explain this sql", "validate sql", "sql schema", "check this query", and .sql extension.
Protocol Buffer tools — ✓ Done. proto_tools tool parses, inspects, and validates Protocol Buffer (.proto) files without external utilities. 4 actions: info (default — syntax version, package, imports, file options, message/enum/service counts with per-item summaries), messages (detailed message and enum listing with field names, types, field numbers, labels, and inline field options), services (all service definitions with RPC method signatures and streaming classification: unary/client-streaming/server-streaming/bidirectional), validate (checks: unrecognised syntax, missing package declaration, empty messages, duplicate field numbers, field number 0 or reserved range 19000–19999, proto2 required fields, proto3 enum first value ≠ 0, empty services). Custom block extractor handles nested message/enum/service blocks. Zero new dependencies — pure Rust stdlib. Routing detects "proto file", ".proto", "protobuf", "protocol buffer", "grpc", "proto message", "proto service", "rpc method", "validate proto", and related phrases.
PEM certificate tools — ✓ Done. pem_tools tool inspects, decodes, and validates PEM-encoded certificates, certificate chains, and private keys without external utilities — no openssl or crypto library required. 3 actions: info (default — per-block type label, certificate subject/issuer DN, validity window, expiry countdown, Subject Alternative Names, public key algorithm + RSA bit size, CA flag from basicConstraints), chain (ordered chain display with issuer→subject linkage verification, self-signed root detection, chain completeness check), validate (checks: expired certs, expiring within 30 days, self-signed leaf cert, weak SHA-1/MD5 signature algorithm, RSA key < 2048 bits, missing SANs on leaf v3 cert, private key bundled alongside cert, chain presented out of order). Implements a custom pure-Rust base64 decoder and minimal DER/ASN.1 parser sufficient to extract all relevant X.509 v3 metadata without any external dependencies. Routing detects "pem file", ".pem", "tls cert", "ssl cert", "x509", "certificate chain", "cert expir", "inspect cert", "validate cert", "-----begin", "subject alternative name", and related phrases.
Env schema tools — ✓ Done. env_schema_tools tool validates a .env file against a .env.example schema — checks for missing required keys, extra keys, and empty required values — without external utilities. 4 actions: validate (default — compare .env against .env.example, VALID/INVALID verdict with per-key findings grouped as missing/empty-required/extra), diff (keys present in .env.example but absent from .env, flagged as REQUIRED or optional), required (list which .env.example keys are required — empty or placeholder value — vs optional with their defaults), info (overview of both files — key counts, coverage percentage, required vs optional breakdown). Placeholder detection covers empty values and common patterns: <your-...>, CHANGE_ME, YOUR_..., xxx, todo, placeholder, secret. Secret-named keys are redacted in output. Pass 'example'/'env' for inline text or 'example_file'/'env_file' for paths. Zero new dependencies — pure Rust stdlib + serde_json. Routing detects ".env.example", "validate .env", "missing env", "env schema", "env completeness", "required env vars", "check env", and related phrases.
File tree tools — ✓ Done. file_tree_tools tool generates visual file tree representations and directory statistics without external utilities — no tree command needed. 5 actions: tree (default — ASCII directory tree with ├──/└── branches, depth limit, file sizes), flat (sorted flat file listing with sizes), stats (file/dir/size breakdown grouped by extension), json (structured JSON tree for programmatic use), sizes (files ranked largest first with % share bars). Options: path, depth (default 4; 0=unlimited), show_hidden, extensions (filter by ext), skip_dirs (extra dirs to exclude), limit, top. Skips target/.git/node_modules/vendor/dist/build/cache dirs by default. Zero new dependencies — pure Rust stdlib. Routing detects "file tree", "directory tree", "show directory structure", "generate tree", "ascii tree", "project structure", "tree command", "visualize directory", and related phrases.
Find tools — ✓ Done. find_tools tool finds files and directories matching criteria without external utilities — no find command needed. 4 actions: list (default — matching paths with size and human-readable age), count (match count + total size), sizes (size summary sorted largest first), recent (sorted by modification time, newest first). Filters: name (glob-style *.rs or substring), ext (extension without dot), type (file/dir/all), min_size/max_size (bytes), newer_than/older_than (days), depth (0=unlimited), show_hidden. Skips target/.git/node_modules/vendor/dist/build and cache dirs by default. Zero new dependencies — pure Rust stdlib. Routing detects "find files", "find all files", "find files named", "find files with extension", "files larger than", "recently modified files", "find command", "search for files", and related phrases.
TODO annotation scanner — ✓ Done. todo_tools tool scans source files for TODO, FIXME, HACK, XXX, NOTE, DEPRECATED, BUG, OPTIMIZE, WORKAROUND, TEMP, KLUDGE, and NB comments without external utilities. Word-boundary detection (does not match "TODOLIST"). 5 actions: scan (default — grouped by label with file:line context), stats (count per label with bar chart), list (flat chronological list of all findings), filter (specific label only; pass 'label'), files (top N files by annotation count). Configurable path, extensions, and limit. Skips target/, .git/, node_modules/, .hematite/, vendor/, dist/, build/, and cache dirs. Routing detects "todo", "fixme", "find todos", "scan for todos", "code annotation", "annotated comment", "deprecated comment", "technical debt comment", and related phrases.
Grep tools — ✓ Done. grep_tools tool searches files for patterns using regular expressions without external utilities. 4 actions: search (default — matching lines with file:line context and optional before/after context lines), count (match count per file, sorted by frequency), files (list files with at least one match), matches (flat list of every match with capture group extraction). Options: case_insensitive, fixed (literal string mode via regex::escape), whole_word (wraps pattern in \b...\b), before/after (context lines with -- separators), invert, extensions, limit. Zero new dependencies — regex crate already in Cargo.toml. Routing detects "grep for", "grep files", "search files for", "search code for", "find in files", "search for pattern", "regex search", "find occurrences of", "ripgrep", and related phrases.
Text extract tools — ✓ Done. text_extract_tools tool extracts structured entities from unstructured text without external utilities. 9 actions: emails, urls, ips (IPv4 and IPv6), phones (US/international), dates (ISO/US/EU formats), uuids, hashes (MD5/SHA-1/SHA-256), all (default — every entity type at once), custom (user-supplied regex pattern). Each action returns a deduplicated list with occurrence counts. Hash extraction uses position masking (SHA-256 > SHA-1 > MD5) to prevent shorter hashes from matching substrings of longer ones. Options: unique (default true), limit (max per type), case_insensitive (for custom). Zero new dependencies — regex crate already in Cargo.toml. Routing detects "extract emails", "extract urls", "find phone numbers in", "extract ip addresses", "extract hashes", "scan for emails", "custom pattern extract", and related phrases.
Interval tools — ✓ Done. interval_tools tool performs date interval operations without external utilities. 6 actions: overlap (check if two intervals overlap — shows overlap range and duration), contains (check if a date is within an interval — shows distance from boundaries), union (merge overlapping intervals from a list), intersect (find the intersection of two intervals), duration (time between two dates — full breakdown in seconds/minutes/hours/days/weeks), schedule (generate N recurring dates from a start date at a regular step). Step formats: '1d', '2w', '1m', '1y', '6h', '30min'. Accepts ISO 8601 dates (YYYY-MM-DD) and datetimes (YYYY-MM-DDTHH:MM:SS). Pure Rust date arithmetic with no external dependencies. Routing detects "date range overlap", "merge intervals", "date schedule", "recurring dates", "duration between dates", "days between dates", and related phrases.
JSON Patch tools — ✓ Done. json_patch_tools tool applies and generates JSON Patch (RFC 6902) and JSON Merge Patch (RFC 7396) documents without external utilities. 5 actions: apply (default — apply a JSON Patch operation array to a 'document'; ops: add/remove/replace/move/copy/test; shows per-operation log), generate (generate a JSON Patch from 'original' and 'modified' JSON documents via recursive diff), merge_apply (apply a JSON Merge Patch object — null values remove keys, others set/replace), merge_generate (create a JSON Merge Patch from 'original' and 'modified'), test (run 'test' operations from a patch against a document and report PASS/FAIL per path; overall ALL PASS or SOME FAILED verdict). Implements RFC 6901 JSON Pointer navigation including ~0/~1 escaping, array index '-' for append, and nested path traversal. Zero new dependencies — pure Rust stdlib + serde_json. Routing detects "json patch", "rfc 6902", "apply patch", "json diff", "json pointer", "merge patch", "rfc 7396", "json merge", "patch document", "json operations", and related phrases.
Markdown gen tools — ✓ Done. markdown_gen_tools tool generates Markdown constructs programmatically without external utilities — the complement to markdown_tools which reads/parses Markdown. 6 actions: table (default — GitHub-flavored Markdown table; 'headers' string array + 'rows' 2D array; optional 'align' per column: left/right/center; auto-sizes column widths), badge (shields.io-style Markdown badge; 'label' + 'message' + 'color'; optional 'url' to wrap badge in a click-through link), toc (table of contents from 'headings' array; accepts '# Heading' or plain text; GitHub-style anchors; indented by heading level), admonition (GitHub >[!KIND] callout block; 'kind': NOTE/TIP/IMPORTANT/WARNING/CAUTION; 'label' for body text), link (Markdown link; 'text' + 'url'; 'style': inline/reference/image/image_link; optional 'title' tooltip), doc (full Markdown document; 'title' + 'sections' array of {heading, body, level?, code?, lang?}). Zero new dependencies — pure Rust stdlib. Routing detects "generate markdown", "markdown table", "create markdown table", "markdown badge", "shields.io badge", "markdown toc", "table of contents markdown", "markdown admonition", "github admonition", "[!note]", "[!warning]", "markdown link", "generate markdown doc", and related phrases.
TLS tools — ✓ Done. tls_tools tool parses and decodes TLS records and handshake messages from hex bytes without external utilities. 5 actions: parse (default — auto-detect record type and decode; content-type, version, length, handshake summary), client_hello (full ClientHello breakdown: all cipher suites graded STRONG/GOOD/WEAK/BROKEN, all extensions with explanations, SNI hostname, ALPN protocols, Heartbleed and GREASE detection), server_hello (chosen cipher suite grade, negotiated TLS version from supported_versions extension), cipher_suites (enumerate and grade all cipher suites from a ClientHello hex), extensions (list all extensions with type, length, and explanation). Pass 'hex' for raw hex bytes or 'file' for a binary file. Zero new dependencies — pure Rust stdlib. Routing detects "tls record", "tls handshake", "client hello", "server hello", "tls cipher suite", "tls extension", "decode tls", "parse tls", "heartbleed", "tls hex", and related phrases.
Protobuf wire tools — ✓ Done. protobuf_wire_tools tool decodes raw protobuf wire format bytes without a .proto schema. 4 actions: decode (default — recursive field-by-field decode; field number, wire type, and value; auto-expands nested messages and labels UTF-8 strings), fields (field number + wire type summary table), strings (extract all UTF-8 string candidates from length-delimited fields), explain (verbose: all type interpretations per field — uint64/int64/sint64/bool/float for wire type 0; raw hex + UTF-8 attempt for wire type 2). Optional 'depth' parameter (default 3) controls nested message recursion. Pass 'hex' for hex-encoded bytes or 'file' for a binary file. Zero new dependencies — pure Rust stdlib. Routing detects "protobuf wire", "proto wire", "decode protobuf", "protobuf hex", "grpc payload", "grpc bytes", "wire type", "varint protobuf", "protobuf field", "length-delimited", "raw protobuf", "proto binary", and related phrases.
SSH key tools — ✓ Done. ssh_key_tools tool parses and inspects SSH public keys without external utilities. 4 actions: info (default — key type, bit size, SHA256/MD5 fingerprints, comment, security assessment), fingerprint (SHA256 and MD5 fingerprints only), validate (VALID/INVALID verdict with weak-key warnings for DSA and RSA<2048), authorized_keys (tabular multi-key summary for an authorized_keys file — type/bits/fingerprint/comment per key). Handles ssh-rsa, ssh-dss, ecdsa-sha2-nistp256/384/521, ssh-ed25519. Wire format parsed from base64 payload per RFC 4253. Zero new dependencies — sha2/md-5/base64 already in Cargo.toml. Routing detects "ssh public key", "ssh key fingerprint", "authorized_keys", ".pub file", "ssh-rsa", "ssh-ed25519", "ecdsa-sha2-nistp", "parse ssh key", "validate ssh key", "key fingerprint sha", and related phrases.
WireGuard tools — ✓ Done. wireguard_tools tool parses, inspects, and validates WireGuard configuration files without external utilities. 4 actions: info (default — interface summary with Address/ListenPort/DNS/MTU and peer table with public key prefix/endpoint/allowed IPs), peers (detailed per-peer listing with all fields), validate (VALID/INVALID verdict — Curve25519 key format, CIDR notation, endpoint host:port, AllowedIPs presence; full issue list), keys (redacted key presence summary — shows which interface/peer slots are populated without exposing private or preshared keys). Handles [Interface] and [Peer] INI sections; comment-based peer names. Zero new dependencies — base64 already in Cargo.toml. Routing detects "wireguard", "wg-quick", "wg0.conf", "wireguard config", "allowedips", "persistentkeepalive", "presharedkey", "wireguard peer", "wireguard key", "wireguard tunnel", "wireguard vpn", and related phrases.
Prometheus tools — ✓ Done. prometheus_tools tool parses, inspects, and analyzes Prometheus/OpenMetrics exposition format text without external utilities. 4 actions: parse/list (default — all metric families with TYPE, HELP, and sample counts), metrics/detail (per-family breakdown with all label sets and sample values; optional 'metric' filter by name or prefix), labels (label key distribution across all metric families with unique value counts), filter (filter families by name substring or metric type — counter/gauge/histogram/summary/untyped; pass 'query' or 'type'). Two-pass parser: first collects TYPE family names to enable correct histogram suffix stripping (_bucket/_count/_sum/_created); second pass assigns samples. stats action: total families, total samples, type distribution table. Accepts 'text' for inline Prometheus text or 'file' for a path. Zero new dependencies — pure Rust stdlib. Routing detects "prometheus metrics", "openmetrics", "metrics exposition", "parse metrics file", "scrape output", "# HELP", "# TYPE", "gauge metric", "counter metric", "histogram metric", "metric labels", and related phrases.
HTTP cache tools — ✓ Done. http_cache_tools tool parses, explains, and analyzes HTTP caching headers without external utilities. 4 actions: parse/explain (default — break Cache-Control into directive-by-directive plain-English descriptions: max-age/s-maxage/no-store/no-cache/must-revalidate/stale-while-revalidate/stale-if-error/immutable/public/private/only-if-cached/must-understand), analyze (compute freshness state — FRESH/STALE/REVALIDATE — from Cache-Control + Age header; shows stale-while-revalidate grace window, stale-if-error fallback, Expires header fallback, CDN vs browser age split), etag (parse ETags: strong vs weak W/ prefix, wildcard; simulate conditional request verdict 304 Not Modified vs 200 OK from If-None-Match), vary (explain Vary header: list request headers the cache key varies on; flags Vary:* as uncacheable). Accepts 'headers' as object or comma-separated string. Zero new dependencies — pure Rust stdlib. Routing detects "cache-control header", "max-age directive", "no-store", "etag header", "vary header", "304 not modified", "conditional request", "cache freshness", "cache expiry", "stale-while-revalidate", "http caching", "cdn cache", "browser cache", and related phrases.
Webhook tools — ✓ Done. webhook_tools tool verifies webhook signatures and inspects webhook payloads without external utilities. 4 actions: verify (default — verify HMAC-SHA256 signature for GitHub/X-Hub-Signature-256, Stripe/Stripe-Signature, Slack/X-Slack-Signature, Shopify/X-Shopify-Hmac-Sha256, or generic HMAC-SHA256; constant-time comparison prevents timing attacks; pass 'provider'/'payload'/'secret'/'signature'), parse (detect provider from headers, decode payload, extract key fields: GitHub event type/repository/sender, Stripe event type/object, Slack command/team, Shopify topic), replay (check replay-attack risk — timestamp freshness for Stripe t= field and Slack v0= timestamp; configurable 'max_age_seconds' tolerance), headers (explain each webhook header — X-Hub-Signature-256/X-Github-Event, Stripe-Signature, X-Slack-Signature, X-Shopify-Hmac-Sha256). Zero new dependencies — hmac/sha2/hex already in Cargo.toml. Routing detects "webhook signature", "verify webhook", "hmac sha256 webhook", "github webhook", "stripe webhook", "slack webhook", "shopify webhook", "webhook secret", "replay attack webhook", "x-hub-signature", "stripe-signature", "x-slack-signature", and related phrases.
JWK tools — ✓ Done. jwk_tools tool parses, validates, and computes RFC 7638 thumbprints for JSON Web Keys (JWK) and JWKS sets without external utilities. 4 actions: info/parse (default — key type, algorithm, use, key_ops, curve, bit size, kid, private/symmetric key presence; handles both single JWK and JWKS {"keys":[...]} format), validate/check (required field check per kty: RSA requires n/e, EC requires crv/x/y, OKP requires crv/x, oct requires k; warns on RSA<2048 bits, oct<128 bits, use vs key_ops conflicts, missing kid), thumbprint/tp (RFC 7638 SHA-256 thumbprint — canonical sorted minimal JSON of required members per kty, hashed and base64url-encoded per spec; works for RSA/EC/OKP/oct), list (tabular summary for all keys in a JWKS — kid/kty/alg/use/bits per row). RSA bit size derived from base64url-decoded modulus length. Zero new dependencies — sha2/base64 already in Cargo.toml. Routing detects "jwk", "jwks", "json web key", "jwk thumbprint", "rfc 7638", "rsa public key jwk", "ec key jwk", "okp key", "jwks endpoint", "key set", "validate jwk", and related phrases.
GitLab CI tools — ✓ Done. gitlab_ci_tools tool parses, inspects, and validates GitLab CI/CD pipeline files (.gitlab-ci.yml) without external utilities. 4 actions: info/parse (default — pipeline overview: stages list, global image, variable count, include count, and job/template counts), jobs/list (all jobs with stage, image, script line count, needs dependencies, rules count, extends parent, allow_failure, parallel, tags, and when; template jobs prefixed with '.'), stages (stage execution order with job assignments per stage; flags undefined stages and empty stages), validate/check (VALID/INVALID verdict — missing script/trigger on non-template jobs, undeclared stages, unknown needs references, deprecated only:/except: usage, image:latest warnings, empty rules arrays, duplicate stage names; full issue list). Distinguishes pipeline-level keys (stages/variables/default/include/workflow/image/services/before_script/after_script/cache/artifacts) from job definitions. Uses serde_yaml (existing dep). Zero new dependencies. Routing detects "gitlab-ci.yml", ".gitlab-ci.yml", "gitlab ci", "gitlab pipeline", "ci pipeline yaml", "ci stages", "gitlab job", "gitlab needs", "gitlab rules", "extends gitlab", "gitlab include", "validate gitlab ci", and related phrases.
JUnit/xUnit tools — ✓ Done. junit_tools tool parses and analyzes JUnit/xUnit XML test result files without external utilities. 4 actions: parse (default — suite overview with total tests/passed/failed/errors/skipped/time; per-suite breakdown with failing test names and first-line message highlighted), failures (only failing and erroring test cases with status, class name, message, and up to 12 lines of stack trace body), summary (aggregate stats with ASCII pass-rate progress bar and PASSED/FAILED verdict), list (all test cases with status icon, time, and class::name; optional 'status' filter: passed/failed/error/skipped). Input: 'xml' for inline JUnit XML content, 'file' for path to .xml test result file. Uses quick-xml (existing dep). Zero new dependencies. Routing detects "junit", "xunit", "test result", "test results xml", "failing tests", "junit xml", "testsuite xml", "parse test xml", "test report xml", and related phrases.
Ansible tools — ✓ Done. ansible_tools tool parses and inspects Ansible playbooks without external utilities. 5 actions: parse (default — play overview with hosts, task/handler/var/role counts, and module usage frequency; supports pre_tasks/post_tasks), tasks (all tasks with module name, display name, tags, when condition, notify, loop flag, delegate_to; optional 'tag' filter), vars (all variables from vars:/vars_files: across all plays), handlers (all handlers with module and listen/notify info), validate (warn on: missing hosts, missing task names, bare variable usage without quotes, become_user without become enabled). Handles block/rescue/always nesting. Uses serde_yaml (existing dep). Zero new dependencies. Routing detects "ansible", "ansible playbook", "playbook.yml", "parse playbook", "ansible tasks", "ansible vars", "ansible handlers", "ansible validate", "ansible modules", "inspect playbook", and related phrases.
gRPC tools — ✓ Done. grpc_tools tool looks up gRPC status codes, explains error causes, and lists well-known gRPC metadata headers without external utilities. 4 actions: status (default — look up a code by number 0–16 or name like NOT_FOUND; shows code, name, HTTP equivalent, summary), explain (detailed breakdown: description, common causes, fix steps, and retryability — CANCELLED/DEADLINE_EXCEEDED/RESOURCE_EXHAUSTED/UNAVAILABLE are retryable with backoff; ABORTED=restart transaction; others=not retryable), list (all 17 gRPC status codes from OK to UNAUTHENTICATED with HTTP equivalent and one-line summary), headers (13 well-known gRPC metadata headers with direction request/response/trailer and description). Zero new dependencies — pure static tables. Routing detects "grpc status", "grpc code", "grpc error", "NOT_FOUND grpc", "DEADLINE_EXCEEDED", "grpc metadata headers", "list grpc codes", "explain grpc", and related phrases.
HAProxy tools — ✓ Done. haproxy_tools tool parses, inspects, and validates HAProxy configuration files without external utilities. 5 actions: parse (default — overview: global directives, defaults, and frontend/backend/listen counts), frontends (per-frontend: bind addresses, ACL rules with name and pattern, use_backend/default_backend mappings), backends (per-backend: balance algorithm, option directives, server list with name/address/options), servers (flat tabular listing of all servers across all backends with backend name/server name/address:port/options), validate (warn on: frontends without bind, use_backend referencing undefined backend, unreferenced backends, duplicate section names). Handles inline # comments, multi-word directives, and continuation lines. Zero new dependencies — pure Rust stdlib. Routing detects "haproxy", "haproxy.cfg", "haproxy config", "parse haproxy", "haproxy frontend", "haproxy backend", "haproxy servers", "haproxy acl", "haproxy validate", "load balancer config", and related phrases.
Helm tools — ✓ Done. helm_tools tool inspects Helm charts without external utilities — no helm binary or Kubernetes cluster required. 5 actions: chart (default — Chart.yaml metadata: name, version, appVersion, apiVersion, chart type, description, keywords, maintainers, dependency count), values (top-level keys from values.yaml with type label and value preview; type distribution summary; detected features: image/ingress/service/resources/replicas/autoscaling/serviceAccount/security), deps (dependency table: name, version, repository URL, condition, alias — reads Chart.yaml dependencies or requirements.yaml), validate (required field checks, non-semver version warning, apiVersion v1 deprecation warning, empty description warning), templates (list template files under templates/ dir with detected Kubernetes resource type; requires 'chart_dir'). Input: 'chart_dir' for chart root path; or 'chart_yaml'/'values_yaml' for inline YAML content. Uses serde_yaml (existing dep). Zero new dependencies. Routing detects "helm chart", "helm values", "helm template", "chart.yaml", "values.yaml helm", "parse helm", "inspect helm", "helm deps", "helm dependencies", "helm validate", "kubernetes helm", and related phrases.
CVSS tools — ✓ Done. cvss_tools tool scores and decodes CVSS v3.1 vectors without external utilities. 4 actions: decode (default — parse a CVSS:3.1/... vector string into all 8 metric abbreviations with full names and selected values; shows computed Base Score and severity label), score (compute the numeric Base Score from a full vector string or from individual metric fields AV/AC/PR/UI/S/C/I/A), severity (classify a numeric score 0.0–10.0 as None/Low/Medium/High/Critical per NIST thresholds), compare (side-by-side comparison of two vectors with per-metric diff and score delta). Implements full CVSS v3.1 formula: ISS, ISCBase (scope-adjusted), Exploitability subformula, Roundup, and PR values that differ by Scope. Zero new dependencies — pure Rust stdlib. Routing detects "cvss", "cvss:3.", "av:n/ac:", "base score", "nvd score", "cve score", "cvss vector", "cvss score", and related phrases.
Nmap tools — ✓ Done. nmap_tools tool parses and analyzes nmap XML output without external utilities — no nmap binary required at runtime. 5 actions: parse (default — per-host port table with open ✓ / closed ✗ / filtered ? icons, OS guess, and service versions), hosts (summary table of all hosts with IP, hostname, status, open port count, and OS guess), ports (flat sorted port list across all hosts filtered by state — default open — with host, protocol, service, and version), services (service distribution table: service name, count, and host:port preview samples), summary (scan totals: hosts up/down, open/filtered port counts, top-10 services by count, OS identification count). Accepts 'xml' for inline nmap XML or 'file' for a .xml path. Pure line-by-line XML state machine — no XML library required. Zero new dependencies. Routing detects "nmap", "nmap xml", "nmap scan", "port scan result", "nmap output", "nmap -ox", "nmap report", "open ports nmap", "parse nmap", and related phrases.
Postman tools — ✓ Done. postman_tools tool parses and analyzes Postman Collection v2.1 files without external utilities. 5 actions: parse (default — tabular METHOD/NAME/FOLDER/AUTH/URL view with optional folder, method, and query substring filters; limit), requests (detailed per-request view: URL, auth type, body mode, headers count, query params count, test/pre-request script presence), folders (folder hierarchy with request counts per folder), vars (collection-level variables with key/token/secret/pass values redacted), summary (totals: request count, folder count, variables, with-tests, HTTP method breakdown, auth type breakdown). Handles both direct collection JSON and {"collection": {...}} wrapped export format. Accepts 'json' for inline JSON or 'file' for a .json path. Zero new dependencies. Routing detects "postman", "postman collection", "collection.json", "api collection", "postman requests", "postman variables", "parse postman", "postman export", and related phrases.
LDIF tools — ✓ Done. ldif_tools tool parses and analyzes LDIF (LDAP Data Interchange Format) files without external utilities. 5 actions: parse (default — entries with DN, objectClass list, changetype, and all attributes; password/secret/token attributes redacted; dn/query filters; limit), search (filter entries by keyword across DN and attribute values; shows compact DN/cn/uid/mail summary per match), attrs (attribute coverage table: name, count, and fill-bar percentage showing how often each attribute appears across entries), schema (schema/subschema entries decoded; falls back to objectClass distribution from data), summary (total entries, changetype count, avg attributes, objectClass distribution, DC domain inference). Handles RFC 2849 line unfolding (continuation lines starting with space/tab), base64-encoded values (:: prefix), and URL references (< prefix). Custom base64 decoder — no external crate. Accepts 'ldif'/'text' for inline content or 'file' for a .ldif path. Zero new dependencies. Routing detects "ldif", ".ldif", "ldap data", "openldap", "objectclass ldap", "ldap export", "ldif file", "parse ldif", "directory ldif", and related phrases.
iptables tools — ✓ Done. iptables_tools tool parses and analyzes iptables-save output without external utilities. 5 actions: parse (default — tabular rule listing per table/chain with target icons ✓ ACCEPT / ✗ DROP/REJECT / L LOG / ↩ RETURN / ⇄ NAT; optional table/chain/target filters), chains (chain summary: policy with icon, packet/byte counters formatted K/M, and rule count per chain), stats (rule count by table and target type with percentage bars), summary (total rules, chains, tables, chain policies, broad-accept warnings, FORWARD-accept warnings), security (flag suspicious rules: broad ACCEPT without src/dst/port, FORWARD blanket accepts, INPUT accepting all with no interface restriction, disabled logging for DROP chains). Handles *table headers, :CHAIN POLICY [packets:bytes] chain definitions, and -A CHAIN ... rule lines with full option tokenization (-j/-p/-s/-d/-i/-o/--dport/--sport/--comment). Accepts 'text' for inline iptables-save output or 'file' for a path. Zero new dependencies. Routing detects "iptables", "iptables-save", "netfilter", "linux firewall rules", "iptables rules", "parse iptables", "iptables output", "filter table", "nat table", "iptables chains", and related phrases.
SPDX tools — ✓ Done. spdx_tools tool parses, validates, and analyzes SPDX license expressions and identifiers without external utilities. 5 actions: info (default — full detail for a license by SPDX ID or name: category, OSI approval, FSF approval, copyleft flag, deprecated flag, full name), parse (recursive descent SPDX expression parser for 'MIT AND Apache-2.0 OR GPL-2.0-only' style compound expressions — AST display, copyleft detection, compatibility analysis), validate (VALID/INVALID verdict for any expression string; catches malformed expressions), list (browse all 52 known SPDX licenses; optional 'category' filter: permissive/copyleft/weak-copyleft/public-domain/other), check (check if an expression satisfies a target license requirement). ExprNode AST with License/With/And/Or nodes. 52-license static table with OSI/FSF/copyleft/deprecated flags. Zero new dependencies. Routing detects "spdx", "spdx license", "spdx expression", "spdx identifier", "license expression", "license compatibility", "parse license expression", "osi approved", "copyleft license", and related phrases.
AWS tools — ✓ Done. aws_tools tool parses and analyzes AWS ARNs and S3 URLs without external utilities or AWS credentials. 4 actions: arn (default — decode an ARN into partition/service/region/account-id/resource with resource type hint and service category), s3 (parse an S3 URI or bucket URL into bucket name, object key, region, and URL style — supports s3:// URIs, virtual-hosted bucket.s3.region.amazonaws.com, and path-style s3.region.amazonaws.com/bucket/key), region (look up an AWS region by code or name; list all 33 regions when omitted), service (look up an AWS service by code or name with category; list all 42 services when omitted). Partition values: aws/aws-cn/aws-us-gov. Zero new dependencies. Routing detects "arn:", "aws arn", "parse arn", "decode arn", "amazon resource name", "s3://", "s3 uri", "s3 url", "aws region", "aws service", "list aws regions", "s3.amazonaws.com", and related phrases.
curl tools — ✓ Done. curl_tools tool parses, builds, and converts curl commands without external utilities. 3 actions: parse (default — decode a curl command string into method, URL, headers, body, auth type, flags, and all curl options; authorization header values redacted for security), build (generate a well-formed curl command from 'url', 'method', 'headers' object, 'body', 'auth_user'/'auth_pass', 'insecure', 'follow_redirects', 'timeout', 'output' options), convert (translate a parsed curl command to idiomatic code in Python requests, Go net/http, or JavaScript fetch; 'language': python/go/javascript). Shell tokenizer handles single-quoted, double-quoted, and backslash-continued multi-line curl commands. Pass 'command' for the curl command string. Zero new dependencies. Routing detects "parse curl", "convert curl", "curl command", "curl to python", "curl to go", "curl to javascript", "build curl", "generate curl", "curl request", "explain curl", and related phrases.
OAuth tools — ✓ Done. oauth_tools tool handles OAuth 2.0 flows, PKCE, authorization URLs, and token decoding without external utilities or network calls. 5 actions: pkce (default — generate a PKCE code_verifier + code_challenge pair per RFC 7636 using SHA-256 S256 method; optional 'verifier' override; 'method': S256/plain), grant (explain an OAuth 2.0 grant type with flow steps, use case, and security notes; 'grant_type': authorization_code/client_credentials/device_code/implicit/password/refresh_token — 2 deprecated grants flagged), url (build an authorization URL from client_id/redirect_uri/scope/state with auto-generated PKCE pair; pass 'auth_endpoint' for IdP URL), token (decode a JWT access/id token without signature verification — header algorithm, all claims, human-readable exp/iat/nbf timestamps), explain (plain-English OAuth 2.0 and PKCE concept overview). Uses sha2 + rand (already in Cargo.toml). Zero new dependencies. Routing detects "pkce", "code verifier", "code challenge", "oauth", "oauth2", "oauth 2.0", "oauth grant", "authorization code flow", "client credentials flow", "authorization url", "oauth token", "rfc 7636", "openid connect", and related phrases.
SAML tools — ✓ Done. saml_tools tool parses and inspects SAML 2.0 assertions and responses without external utilities. 4 actions: parse (default — full SAML document summary: response ID/issueInstant/status, assertion issuer, subject NameID with format, conditions NotBefore/NotOnOrAfter/audience URIs, attribute table with all name→value pairs, assertion ID, signature presence), attributes (extract all SAML attribute name→value pairs as a clean table), validate (check NotBefore/NotOnOrAfter validity window against current system time — VALID/EXPIRED/NOT_YET_VALID verdict; flag missing signatures and audience restrictions), explain (plain-English breakdown of each SAML field and its security role). Input: 'xml' for raw SAML XML, 'base64' for base64-encoded SAMLResponse (HTTP POST binding), 'file' for a file path (auto-detects base64-encoded file content). Custom recursive XmlNode tree parser using quick-xml (already in Cargo.toml). Standard-alphabet base64 decoder (not URL-safe). Zero new dependencies. Routing detects "saml", "saml response", "saml assertion", "parse saml", "decode saml", "saml token", "saml attributes", "saml validate", "samlresponse", "saml2", "saml 2.0", "identity provider saml", "sso saml", and related phrases.
Multipart/form-data tools — ✓ Done. multipart_tools tool parses, inspects, validates, and builds multipart/form-data (RFC 2046) bodies without external utilities. 6 actions: parse (default — tabular part summary with name/content-type/size/filename), parts (detailed per-part view with all headers and body preview), files (only file-upload parts with filename=), form (only non-file form fields as name=value), validate (RFC 2046 compliance: boundary length ≤70 chars, final delimiter present, Content-Disposition on all parts, name or filename present), build (generate well-formed multipart body from fields array of {name, value, filename?, content_type?} objects). Boundary auto-detected from first 1 KB of body or pass boundary= explicitly or content_type= full header string. Zero new dependencies — pure Rust stdlib + serde_json. Routing detects "multipart", "form-data", "multipart/form-data", "parse multipart", "file upload body", "parse form-data", "rfc 2046", "content-disposition", "multipart body", "multipart boundary", "build multipart", "generate multipart", "validate multipart", and related phrases.
OpenID Connect tools — ✓ Done. openid_tools tool inspects OIDC discovery documents, ID tokens, userinfo responses, and scopes without external utilities. 5 actions: discover (default — all endpoints authorization/token/userinfo/jwks/end_session; response types; grant types; scopes; claims; signing algorithms; PKCE methods; subject types), id_token (decode OIDC ID token JWT: algorithm, core claims iss/sub/aud/azp/nonce/acr/amr, time claims iat/exp/auth_time with VALID/EXPIRED status, at_hash/c_hash/s_hash, profile claims, custom claims; signature NOT verified), userinfo (parse userinfo JSON and explain each standard claim with its scope source), scopes (explain all 6 standard OIDC scopes openid/profile/email/address/phone/offline_access with full claim lists), client (generate Python authlib client config from discovery document with PKCE setup, env var template, and key endpoint summary). Zero new dependencies — pure Rust stdlib + serde_json. Routing detects "openid connect", "oidc", "openid configuration", "openid discovery", ".well-known/openid", "id token", "id_token", "oidc scope", "userinfo endpoint", "userinfo claims", "oidc client", "oidc discovery", "decode id token", "openid token", and related phrases.
EXIF tools — ✓ Done. exif_tools tool parses EXIF/IPTC metadata from JPEG and TIFF images without external tools. 4 actions: info (default — all EXIF fields grouped by IFD: Image, Camera Settings, GPS), camera (make/model/lens/exposure/ISO/focal length summary), gps (latitude, longitude, altitude, speed, bearing, and Google Maps URL when GPS IFD is present), thumbnail (detect embedded IFD1 thumbnail with dimensions and compression type). Accepts 'file' (JPEG or TIFF path) or 'hex' (hex-encoded bytes). Pure Rust TIFF IFD parser with full little-endian/big-endian support, JPEG APP1 marker scanning (skips stuffed bytes and RST markers), and sub-IFD pointer following (tag 0x8769 ExifIFD, tag 0x8825 GPSIFD, IFD1 thumbnail). GPS decimal-degree conversion from rational triplets with Google Maps URL output. Zero new dependencies. Routing detects "exif", "exif data", "exif metadata", "image metadata", "jpeg metadata", "photo metadata", "gps from photo", "gps from image", "photo location", "tiff metadata", "read exif", "parse exif", "camera model photo", "shutter speed photo", "aperture photo", "iso photo", and related phrases.
Office tools — ✓ Done. office_tools tool inspects DOCX, XLSX, and PPTX Office Open XML documents without Microsoft Office. 4 actions: info (default — format detection from [Content_Types].xml, core metadata from docProps/core.xml: title/creator/last-modified/created/modified/description, document stats: page/word/character counts for DOCX, sheet count for XLSX, slide count for PPTX), content (extract full body text for DOCX, sheet names with dimension and cell counts for XLSX, slide titles for PPTX), structure (list all ZIP parts with compressed and uncompressed sizes), validate (check required Open XML parts are present: [Content_Types].xml, _rels/.rels, the main document XML). Accepts 'file' path to a .docx, .xlsx, or .pptx file. Uses the existing zip crate — zero new dependencies. Routing detects ".docx", ".xlsx", ".pptx", "docx file", "xlsx file", "pptx file", "word document", "excel workbook", "powerpoint", "office document", "open xml", "inspect docx", "inspect xlsx", "inspect pptx", "parse docx", "parse xlsx", "read docx", "read xlsx", "extract text from word", "sheet names", "slide count", "presentation slides", and related phrases.
Font tools — ✓ Done. font_tools tool inspects TrueType (TTF), OpenType (OTF), and WOFF/WOFF2 font files without external tools. 4 actions: info (default — font format, family name, subfamily/style, full name, PostScript name, version string, copyright, glyph count from maxp table, units per em from head table, weight class and bold/italic/condensed flags from OS/2 and head, embedding/license restrictions from OS/2 fsType), names (all name table records with platform label and human-readable name ID: Copyright/Family/Subfamily/UniqueID/FullName/Version/PostScriptName/Trademark/Manufacturer/Designer/License/LicenseURL/etc.), tables (SFNT table directory: tag, offset, length, checksum for each table), chars (Unicode character coverage from cmap: total mapped code points, cmap format used, Latin Basic/Extended/Greek/CJK presence). WOFF containers are unwrapped to SFNT before parsing; WOFF2 (Brotli) returns a graceful note without crashing. Zero new dependencies — pure Rust stdlib. Routing detects "font file", ".ttf", ".otf", ".woff", "woff2", "truetype", "opentype", "font metadata", "font family", "font name", "font tables", "glyph count", "glyphs", "font glyphs", "inspect font", "parse font", "font license", "font embedding", "font copyright", "unicode coverage", "cmap table", "font version", "sfnt", "font weight", and related phrases.
SVG tools — ✓ Done. svg_tools tool parses, inspects, and validates SVG (Scalable Vector Graphics) documents without external utilities. 6 actions: info (default — width/height/viewBox dimensions, xmlns/version, <title>/ presence, top-level element count, total element count, feature flags: defs/symbols/use/clipPath/mask/filter/animation/text/image), elements (frequency table of all distinct element types sorted by occurrence count), ids (list of all id= attributes with element type for selector/animation targeting), links (external references from href/xlink:href on /// and CSS url() in style attributes), styles (inline style= and class= attribute counts plus embedded <style> block character size), validate (viewBox presence, xmlns presence, <title>/ WCAG accessibility, <script> XSS risk, deprecated xlink:href and xml:space, embedding risk, duplicate id detection). Accepts 'text'/'svg' for inline SVG content or 'file' for a .svg path. Custom char-level XML tokenizer, zero new dependencies — pure Rust stdlib. Routing detects ".svg", "svg file", "svg document", "svg image", "scalable vector", "parse svg", "inspect svg", "svg elements", "svg ids", "svg viewbox", "svg width", "svg height", "svg namespace", "svg validate", "svg links", "svg styles", "svg animation", "svg script", "svg accessibility", "svg xlink", "svg structure", "vector graphic", and related phrases.
Image tools — ✓ Done. image_tools tool parses image file metadata (PNG, JPEG, GIF, WebP, BMP) without external utilities. 5 actions: info (default — format, dimensions, color type, bit depth, DPI, animation frames, ICC/sRGB/EXIF/XMP presence, file size, embedded text/comment tags), dimensions (width x height and aspect ratio), color (color mode, bit depth, palette size, transparency, DPI, color space), metadata (JFIF density, EXIF/XMP/ICC presence, sRGB intent, gamma, PNG tEXt/iTXt chunks, GIF comments, WebP chunk flags), validate (structural checks: magic bytes, IHDR/SOF0 presence, dimension sanity, PLTE consistency, BMP header integrity). Zero new dependencies — pure Rust stdlib. Routing detects "image metadata", "png metadata", "jpeg metadata", "gif metadata", "webp metadata", "bmp metadata", "image dimensions", "image color", "image dpi", "image resolution", "parse image", "inspect image", "animated gif", "apng", "gif frames", "webp info", "webp file", "png file", "jpeg file", "validate image", and related phrases.
Audio file tools — ✓ Done. audio_file_tools tool parses audio file metadata (WAV, MP3 with ID3v1/v2, FLAC, Ogg Vorbis/Opus) without external utilities. 3 actions: info (default — format/encoding, channels, sample rate, bit depth, duration, bitrate, tags/comments), tags (ID3 or Vorbis comment fields: title, artist, album, year, genre, track, composer, BPM, etc.), validate (WAV byte-rate consistency; MP3 MPEG frame presence and tag completeness; FLAC STREAMINFO validity; Ogg codec detection). Zero new dependencies — pure Rust stdlib. Routing detects "audio metadata", "wav metadata", "mp3 metadata", "flac metadata", "ogg metadata", "id3 tags", "id3 tag", "vorbis comment", "audio sample rate", "audio channels", "audio bitrate", "parse mp3", "parse wav", "parse flac", "parse ogg", "inspect mp3", "mp3 tags", "flac tags", "song tags", "music tags", and related phrases.
Video file tools — ✓ Done. video_file_tools tool parses video file metadata (MP4/MOV, MKV/WebM, AVI) without external utilities or ffprobe. 4 actions: info (default — format, duration, overall bitrate, video/audio track counts, container brand/version), streams (per-track breakdown: codec, dimensions, frame rate, bitrate, language for video; codec, channels, sample rate, language for audio), metadata (embedded tags: title, artist, comment, encoder, creation date), validate (magic bytes, key atom/chunk presence). Handles MP4/MOV box walking (ftyp/moov/mvhd/trak/hdlr/stsd), EBML variable-length encoding for MKV/WebM, and RIFF chunk structure for AVI (avih/strh/strf). Accepts 'file' path or 'hex' hex-encoded bytes. Zero new dependencies — pure Rust stdlib. Routing detects "video metadata", "mp4 metadata", "mkv file", "mkv metadata", "avi file", "avi metadata", "video streams", "video codec", "video duration", "matroska", "webm file", "mov file", "quicktime metadata", "inspect video", "parse video", "video file info", "video resolution", "video frame rate", "video bitrate", "video tracks", and related phrases.
PDF tools — ✓ Done. pdf_tools tool parses and inspects PDF file metadata and structure without external utilities. 5 actions: info (default — PDF version, page count, file size, page dimensions in pt/mm/in with A4/Letter/Legal detection, linearization, xref type), pages (page count and MediaBox dimensions), metadata (Info dictionary: title, author, subject, keywords, creator, producer, creation date, mod date — dates decoded from PDF D:YYYYMMDDHHmmSS format), structure (object count, xref type, linearized flag, %%EOF position), validate (PDF magic header, %%EOF marker, page count sanity). Decodes both literal (with backslash escapes) and hex-encoded PDF strings; handles UTF-16 BOM for Unicode fields. Accepts 'file' path or 'hex' hex-encoded bytes. Zero new dependencies — pure Rust stdlib. Routing detects "pdf metadata", "parse pdf", "inspect pdf", "pdf page count", "pdf file", "pdf author", "pdf title", "pdf info", "pdf structure", "validate pdf", "pdf version", "pdf creator", "pdf producer", "pdf creation date", "pdf linearized", "pdf xref", "pdf object count", "pdf document info", "extract pdf metadata", "read pdf metadata", and related phrases.
EPUB tools — ✓ Done. epub_tools tool parses and inspects EPUB 2/3 ebook files without external utilities. 5 actions: info (default — EPUB version, title, author, publisher, language, identifier, cover present flag, spine item count, TOC entry count, manifest file count), metadata (full OPF Dublin Core fields: title, language, identifier, date, publisher, subject, description, rights, all authors), toc (table of contents from NCX or nav.xhtml, numbered list of chapter titles), spine (reading order of content documents with resolved hrefs), validate (mimetype entry present, container.xml present, dc:title/dc:language/dc:identifier present, non-empty spine). Accepts 'file' (path to .epub) or 'hex' (hex-encoded EPUB bytes). Pure Rust ZIP central-directory parser; only stored entries are extractable without an inflate library. Zero new dependencies — pure Rust stdlib. Routing detects "epub", ".epub", "ebook metadata", "ebook file", "kindle book", "parse epub", "inspect epub", "epub metadata", "epub toc", "epub table of contents", "epub spine", "epub author", "epub chapters", "epub validate", "open ebook", "oebps", "opf metadata", "ncx toc", "digital book metadata", "epub version", "epub publisher", and related phrases.
SBOM tools — ✓ Done. sbom_tools tool parses and analyzes Software Bill of Materials (SBOM) files in CycloneDX JSON, SPDX JSON, and SPDX tag-value formats without external utilities. 5 actions: info (default — SBOM format, spec version, serial number, component count, vulnerability count, tool name, timestamp, metadata component name), components (tabular listing with name/version/license/purl/type; optional limit), licenses (unique license summary sorted by usage count), vulnerabilities (vulnerability table with ID/severity/description/affected component), validate (required fields per format — VALID/WARNINGS/INVALID verdict). Accepts 'text' for inline SBOM content or 'file' for a path. Zero new dependencies — pure Rust stdlib + serde_json. Routing detects "sbom", "software bill of materials", "bill of materials", "cyclonedx", "spdx", "bom.json", "sbom.json", ".spdx", "spdx license", "spdx document", "parse sbom", "inspect sbom", "sbom components", "sbom licenses", "sbom vulnerabilities", "supply chain", "component licenses", "dependency licenses", "license inventory", "sbom format", "software composition", "purl ecosystem", "sbom validate", "bom format", and related phrases.
Git log analysis tools — ✓ Done. git_log_tools tool parses and analyzes git log output without running git. 5 actions: parse (default — tabular commit table with hash/author/date/subject; 'author' and 'limit' filters), authors (ranked leaderboard with commit count, first/last date, unique active days), frequency (day-of-week commit bar chart + hour-of-day heatmap — "when does this team commit?"), files (churn ranking from --stat output: files changed/insertions/deletions per path), summary (total commits, date range, author count, busiest day and hour). Detects three log formats: pipe-delimited %H|%an|%ae|%ai|%s (primary), oneline, and traditional verbose. Absorbs --stat summary lines. Pass 'log' (inline text) or 'file'. Routing detects "git log output", "parse git log", "commit history", "commit frequency", "commit authors", "author leaderboard", "git log --stat", "file churn", "git history", and related phrases. Pure Rust stdlib, zero new deps.
journald log analysis tools — ✓ Done. journald_tools tool parses and analyzes journalctl -o json NDJSON output without external utilities. 5 actions: parse (default — tabular entry listing with timestamp/unit/priority icon/message; 'unit' substring and 'priority' threshold filters, 'limit'), units (systemd unit frequency table with entry count and worst priority seen), errors (critical and above entries only; priority ≤ 3 — EMERG/ALERT/CRIT/ERR), filter ('unit' and 'priority' combined filter with limit), summary (total entries, priority distribution bar chart, unique units, date range). Handles MESSAGE as string or byte array (binary/non-UTF-8 journal entries). Priority scale: EMERG=0 through DEBUG=7. Pass 'log' (inline NDJSON) or 'file'. Routing detects "journalctl", "journald", "systemd journal", "journal log", "parse journal", "journal errors", "journal units", "journal priority", "systemd log", "linux system log", and related phrases. Pure Rust stdlib + serde_json, zero new deps.
tsconfig tools — ✓ Done. tsconfig_tools tool parses, inspects, and validates tsconfig.json files (JSONC with comment stripping) without external utilities. 5 actions: info (default — extends chain, compilerOptions summary: target/module/strict/outDir/baseUrl, include/exclude/files counts), compiler (all compilerOptions by category: type checking, module resolution, emit, JS support, language/environment, paths), includes (include/exclude/files/paths arrays), references (project references list with composite flag), validate (strict not enabled, missing outDir, noEmit+outDir conflict, paths without baseUrl, deprecated moduleResolution: node, experimentalDecorators without emitDecoratorMetadata, composite missing on referenced projects). Strips // and /* */ comments before JSON parsing. Pass 'tsconfig' (inline JSONC) or 'file' (path to tsconfig.json). Zero new dependencies. Routing detects "tsconfig.json", "tsconfig.base.json", "typescript config", "typescript configuration", "compilerOptions", "typescript target", "typescript module", "typescript strict", "typescript paths", "project references typescript", "ts project references", and related phrases.
ESLint tools — ✓ Done. eslint_tools tool parses, inspects, and validates ESLint configuration files — both legacy (.eslintrc.json object format) and flat (eslint.config.js array format) — without external utilities. Auto-detects format by checking if the parsed JSON is an array (flat) or object (legacy). 5 actions: info (default — format, root flag, parser, environments, globals count, plugins, extends, rule count, overrides count), rules (tabular listing with ✗/⚠/· severity icons; optional 'filter' for name substring), plugins (all configured plugins with usage notes), extends (base config inheritance chain), validate (missing parser for TypeScript rules, @typescript-eslint rules without the plugin, react rules without react plugin, duplicate extends, security/unicorn plugins without prefix). Pass 'config' (inline JSON) or 'file' (path). Zero new dependencies. Routing detects ".eslintrc.json", ".eslintrc.js", "eslint.config.js", "eslint.config.mjs", "eslint config", "eslint configuration", "eslint rules", "eslint plugins", "eslint extends", "eslint flat config", and related phrases.
Prettier tools — ✓ Done. prettier_tools tool parses, inspects, validates, and explains Prettier configuration files without external utilities. Auto-detects JSON vs YAML format for .prettierrc, .prettierrc.json, .prettierrc.yaml. 4 actions: info (default — all configured options with current values + defaults-not-configured listing), validate (deprecated options jsxBracketSameLine/experimentalTernaries, invalid endOfLine/trailingComma/quoteProps/arrowParens/proseWrap values, insertPragma+requirePragma conflict, rangeStart>rangeEnd, unknown options, overrides missing files/options fields), explain (plain-English per-option: Set-to/Default/Effect), overrides (file-pattern override blocks). Pass 'config' (inline JSON or YAML) or 'file' (path to .prettierrc or similar). Zero new dependencies. Routing detects ".prettierrc", "prettierrc.json", "prettierrc.yaml", "prettier config", "prettier configuration", "prettier options", "prettier rules", "prettier overrides", "trailing comma prettier", and related phrases.
Jest tools — ✓ Done. jest_tools tool parses, inspects, and validates Jest configuration without external utilities. Auto-detects package.json by checking for 'name'+'version' keys and extracts the 'jest' key. 6 actions: info (default — preset, testEnvironment, transform count, module mappings, setupFiles, coverage flag), testmatch (test file patterns and ignore paths; shows defaults when not configured), transforms (file transformer rules with options), modules (moduleNameMapper entries, moduleDirectories, setupFiles), coverage (collectCoverage, reporters, directory, provider, thresholds per scope), validate (conflicting testMatch+testRegex, testTimeout=0, threshold without collectCoverage, ts-jest preset+transform redundancy, unknown keys). Pass 'config' (inline JSON) or 'file' (path). Zero new dependencies. Routing detects "jest.config.json", "jest.config.js", "jest.config.ts", "jest config", "jest configuration", "jest preset", "jest transforms", "jest coverage", "jest threshold", "jest testmatch", "jest moduleNameMapper", and related phrases.
Babel tools — ✓ Done. babel_tools tool parses, inspects, and validates Babel configuration files without external utilities. Auto-detects JSON vs YAML; auto-detects package.json by checking for 'name'+'version' keys and extracts the 'babel' key. 5 actions: info (default — preset/plugin/env/override counts with tables and options annotation), presets (numbered preset listing with options from [name, {opts}] array form), plugins (numbered plugin listing with options), env (per-environment blocks: production/development/test with their presets/plugins), validate (@babel/preset-env without targets WARN, deprecated babel-preset-es2015/react/stage-x WARNs, deprecated transform-class-properties/transform-object-rest-spread INFOs, duplicate preset/plugin detection WARNs). Pass 'config' (inline JSON or YAML) or 'file' (path to babel.config.json, .babelrc, .babelrc.json, .babelrc.yaml, or package.json). Zero new dependencies. Routing detects "babel.config.json", "babel.config.js", "babel.config.ts", ".babelrc", "babel config", "babel configuration", "babel preset", "babel plugin", "@babel/preset-env", "@babel/preset-react", "@babel/preset-typescript", "babel transform", "babel env config", and related phrases.
Stylelint tools — ✓ Done. stylelint_tools tool parses, inspects, and validates Stylelint configuration files without external utilities. Auto-detects JSON vs YAML; JS config files (.js/.mjs/.cjs) return a clear error. Auto-detects package.json by checking for 'name'+'version' keys and extracts the 'stylelint' key. 5 actions: info (default — rule/plugin/extends/override counts, extends chain, rule severity summary), rules (grouped by severity error/warning/disabled with options from [severity, opts] form), plugins (numbered list), extends (inheritance chain with base-to-top ordering note), validate (empty config warning, deprecated v15+ rules, SCSS rules without stylelint-scss plugin, order rules without stylelint-order plugin, invalid severity values, unknown top-level keys, no extends baseline suggestion). Pass 'config' (inline JSON or YAML) or 'file' (path to .stylelintrc, .stylelintrc.json, .stylelintrc.yaml, or package.json). Zero new dependencies. Routing detects ".stylelintrc", "stylelint.config.json", "stylelint.config.js", "stylelint config", "stylelint configuration", "stylelint rules", "stylelint plugins", "stylelint extends", "stylelint overrides", "scss/ rule", "order/ rule", and related phrases.
LSP code intelligence tools — ✓ Done. lsp_tools module provides six agent-callable tools wired through the active language server: lsp_definitions (go-to-definition — returns file path, line, and column for a symbol), lsp_references (find-all-references across the workspace), lsp_hover (hover documentation — doc comments, type signatures, inferred types), lsp_search_symbol (workspace-wide symbol search by name prefix), lsp_rename_symbol (safe rename with edits across all affected files), lsp_get_diagnostics (live error and warning diagnostics for a file or the whole workspace). All six delegate to the running LSP process so navigation and understanding are grounded in the actual AST — not pattern matching or training-data approximations. Implemented in src/tools/lsp_tools.rs; LSP server lifecycle managed by src/tools/lsp.rs.
Active context pinning — ✓ Done. scoping_tools module provides two internal harness tools: auto_pin_context (pin 1–3 core files to model memory for the duration of a complex refactor — the model calls this when it identifies the key architectural files for the task so they are not evicted under retrieval pressure) and list_pinned (show currently pinned files). Used internally by conversation.rs, inference.rs, and architecture_summary.rs to maintain a stable working set during multi-step editing sessions. Implemented in src/tools/scoping_tools.rs.
Python-sandbox data analysis CLI — ✓ Done. data_tools module provides nine headless CLI analysis commands against CSV/TSV/JSON/SQLite files: --sample (random sample with optional train/test split and stratified sampling), --correlate (Pearson/Spearman correlation matrix with ASCII heatmap), --timeseries (trend, seasonality, moving averages, and change-point detection), --fourier (FFT frequency analysis), --cluster (k-means clustering with --cluster-k), --normalize (feature scaling: z-score, min-max, robust, L2), --pca (principal component analysis with --pca-components), --hypothesis (t-tests, chi-square, ANOVA, Mann-Whitney, Pearson correlation, proportion z-test, confidence intervals via --hypothesis-test), --polyfit (polynomial curve fitting with R²/RMSE/MAE and ASCII scatter chart). All commands run via the Python stdlib sandbox — no external libraries required. Implemented in src/tools/data_tools.rs; wired into the main CLI dispatch in src/main.rs.

Recently Shipped (0.8.0 wave)

Enterprise enrollment diagnostics — ✓ Done. inspect_host(topic: “mdm_enrollment”) covers dsregcmd AAD/MDM join state, registry enrollment accounts with UPN/type/server URL, Intune Management Extension service health, recent MDM event log errors, and plain-English findings for enrolled/unenrolled/stalled states.
Storage Spaces / Windows RAID diagnostics — ✓ Done. inspect_host(topic: “storage_spaces”) covers Windows Storage Spaces pool inventory (pool name, health, operational status, resiliency type, virtual disk health, physical disk member count and media type). Linux fallback reads /proc/mdstat and lvs. Also aliases: storage_pool, virtual_disk, windows_raid. Routing detects natural-language variants including “storage pool”, “virtual disk health”, “Windows RAID degraded”.
Defender quarantine / threat history diagnostics — ✓ Done. inspect_host(topic: “defender_quarantine”) covers Windows Defender threat detection history (threat name, severity, action taken, detection timestamp, affected file path, remediation status) via Get-MpThreatDetection/Get-MpThreat, plus recent scan and real-time protection activity from Get-MpComputerStatus. Linux fallback checks ClamAV quarantine log. Routing detects natural-language variants including “defender quarantine”, “defender found malware”, “threat history”, “detected threats”.
Domain health / DC connectivity — ✓ Done. inspect_host(topic: “domain_health”) covers domain controller discovery (nltest /dsgetdc), live LDAP/LDAPS/Kerberos/GC port tests to the DC, dsregcmd AAD and domain join state, and GPO last machine refresh time. Distinct from domain (basic join status) — this actively tests reachability.
Service dependency graph — ✓ Done. inspect_host(topic: “service_dependencies”) lists which services require which other services and which services depend on a given one — restart cascade planning. Linux fallback uses systemctl list-dependencies.
WMI repository health — ✓ Done. inspect_host(topic: “wmi_health”) runs a live Win32_OperatingSystem query, winmgmt /verifyrepository, checks winmgmt service state and repository size, and includes recovery steps. WMI corruption is a classic hidden root cause on Windows.
Local security policy — ✓ Done. inspect_host(topic: “local_security_policy”) covers local password/lockout policy via net accounts, LAN Manager / NTLM authentication level (LmCompatibilityLevel), and UAC enabled state and prompt behavior.
USB device history — ✓ Done. inspect_host(topic: “usb_history”) reads the USBSTOR registry key to list USB storage devices ever connected to this machine. Useful for security/forensics audits.
Print Spooler / PrintNightmare check — ✓ Done. inspect_host(topic: “print_spooler”) covers Spooler service state, CVE-2021-34527 hardening (RpcAuthnLevelPrivacyEnabled and Point and Print policy), and pending print queue. Flags unmitigated configurations.
IPv6 routing fix — ✓ Done. ipv6 topic was orphaned in the routing engine (variable existed but was never dispatched). Now routes correctly for all IPv6/SLAAC/DHCPv6 queries.
Shadow copies age — ✓ Done. shadow_copies topic now shows the most recent snapshot's creation date and age in days via Get-WmiObject Win32_ShadowCopy, making disaster recovery confidence visible at a glance.
RDP security layer and encryption level — ✓ Done. rdp topic now includes Security Layer (RDP/Negotiate/SSL-TLS) and MinEncryptionLevel (Low/ClientCompat/High/FIPS) from the RDP-Tcp registry key.
New fix recipes — ✓ Done. Added: service start failure, RDP disabled/unreachable, Windows Update service broken, PrintNightmare not mitigated, TCP/IP stack reset, WLAN AutoConfig stopped, Windows Firewall stopped, No audio, Bluetooth not working, App installation failing, VPN not connecting, screen flickering, microphone not working, login/PIN/Hello not working, disk at 100%, USB not recognized, no Wi-Fi networks visible, network share not accessible, Microsoft Store not working, sleep/wake issues, keyboard/mouse not working, high network usage, audio crackling/distortion, browser slow/crashing, Windows startup slow, Windows Update stuck/failing, GPU driver crash (TDR failure), access denied/file permissions, and Wi-Fi keeps dropping. Total: 67 recipes, 12 sweep-eligible auto-fixes.

Deferred — implement if users request it

Per-workspace model profiles — let .hematite/settings.json specify a preferred model, context ceiling, and embed model per project; useful when different repos need different size/speed tradeoffs. LM Studio makes manual model swaps easy and Hematite detects the active model automatically, so this is low priority until users hit the friction.
Whisper voice input — closes the voice loop (TTS out already ships; this adds STT in). Deferred because Hematite's primary users are keyboard-comfortable developers where typing is faster and more accurate than voice for code-specific terminology. If you want to add it: use whisper-rs (Rust bindings to whisper.cpp, statically linked — no extra DLLs), cpal for audio capture, and embed the tiny.en or base.en GGUF model via include_bytes! at compile time following the same pattern as Kokoro's ONNX model. Wire a Ctrl+M hotkey in tui.rs, add a recording loop in src/ui/voice.rs, and pipe the transcript into the TUI input field. The result is a single self-contained binary with no install requirements — the binary just grows by ~75–150 MB depending on which model you embed. Enable it behind --features embedded-whisper so users who don't want the size increase can skip it.

Tier 2 — Worth doing when local models handle it reliably

Workflow engine — encode multi-step coding workflows (read → edit → verify → commit) as explicit typed state machines that the harness drives, not the model re-plans each turn.
Tool dependency graph — before executing a plan, check whether its tool sequence is valid (no write before read, no verify before edit). Block impossible plans before they waste a turn.
Context budget ledger — track token cost per tool call and per turn; surface a real budget breakdown so the operator can see why a session hit the ceiling, not just that it did.
Multi-model routing — for tasks that need a faster or smaller model (search, classification, label generation), route specific tool calls to a lightweight model while keeping the main session on the primary coding model. The groundwork for this already exists: --semantic-redact accepts any --url endpoint, so a dedicated compact model (e.g. Bonsai 8B Q1_0 at 1.15 GB) can run as the privacy summarizer alongside Qwen3.5 9B + nomic-embed on a single RTX 4070 with VRAM to spare. The next step is exposing a swarm_url config key so swarm workers can be dispatched to a separate lightweight endpoint — enabling a local agent web with no cloud required at any layer.

Tier 3 — Revisit when local 9B models catch frontier capability

The Vein as an explicit knowledge base — manual remember this and forget this operator commands with durable, typed knowledge entries that survive /new and workspace resets.
Hardware-aware autonomy — let the harness self-limit swarm fanout, tool parallelism, and context depth based on live VRAM and context-pressure readings without requiring operator intervention.
Privacy audit layer — before shell or run_code runs, scan for credential patterns (API keys, tokens, env vars) in arguments and offer a redact-and-confirm path.
Session continuity across restarts — ✓ Done (see Shipped above). Goal, working set, running summary, and last verification result all survive restarts via .hematite/session.json.

FilesExpand file tree

CLAUDE.md

Latest commit

History