refactor: split tools.ts into registry-based domain files

Replaces the single 800-line tools.ts and its switch dispatcher with a
Theia-inspired registry pattern — each tool domain is its own file, and
dispatch is a plain Map.get() call with no central routing function.

New structure in src/tools/:
  registry.ts   — ToolDefinition (with handler), registerTool(), executeTool(), ALL_TOOLS
  context.ts    — ToolContext, MemoryUpdate interfaces
  security.ts   — PROTECTED_* constants + assertGiteaWritable/assertCoolifyDeployable
  utils.ts      — safeResolve(), EXCLUDED set
  file.ts       — read_file, write_file, replace_in_file, list_directory, find_files, search_code
  shell.ts      — execute_command
  git.ts        — git_commit_and_push
  coolify.ts    — coolify_*, list_all_apps, get_app_status, deploy_app
  gitea.ts      — gitea_*, list_repos, list_all_issues, read_repo_file
  agent.ts      — spawn_agent, get_job_status
  memory.ts     — save_memory
  index.ts      — barrel with side-effect imports + re-exports

Adding a new tool now requires only a new file + registerTool() call.
No switch statement, no shared array to edit. External API unchanged.

Made-with: Cursor

dist/tools/shell.js

@@ -0,0 +1,76 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+const cp = __importStar(require("child_process"));
+const util = __importStar(require("util"));
+const registry_1 = require("./registry");
+const utils_1 = require("./utils");
+const execAsync = util.promisify(cp.exec);
+const BLOCKED_COMMANDS = ['rm -rf /', 'mkfs', ':(){:|:&};:'];
+(0, registry_1.registerTool)({
+    name: 'execute_command',
+    description: 'Run a shell command in the workspace and return stdout + stderr. 120s timeout. Use for: npm install, npm test, git status, building, etc.',
+    parameters: {
+        type: 'object',
+        properties: {
+            command: { type: 'string', description: 'Shell command to run' },
+            working_directory: { type: 'string', description: 'Optional: relative subdirectory to run in' }
+        },
+        required: ['command']
+    },
+    async handler(args, ctx) {
+        const command = String(args.command);
+        if (BLOCKED_COMMANDS.some(b => command.includes(b))) {
+            return { error: 'Command blocked for safety.' };
+        }
+        const cwd = args.working_directory
+            ? (0, utils_1.safeResolve)(ctx.workspaceRoot, String(args.working_directory))
+            : ctx.workspaceRoot;
+        try {
+            const { stdout, stderr } = await execAsync(command, {
+                cwd, timeout: 120000, maxBuffer: 1024 * 1024
+            });
+            return { exitCode: 0, stdout: stdout.trim(), stderr: stderr.trim() };
+        }
+        catch (err) {
+            return {
+                exitCode: err.code,
+                stdout: (err.stdout || '').trim(),
+                stderr: (err.stderr || '').trim(),
+                error: err.message
+            };
+        }
+    }
+});