feat(toolsearch): make the cellular identifier triad discoverable by sim/cellular

internal/tools/tool_search_test.go

@@ -185,3 +185,26 @@ func TestToolSearch_FinancialObliqueDiscoverability(t *testing.T) {
 		}
 	}
 }
+
+// TestToolSearch_CellularObliqueDiscoverability locks in that the cellular
+// identifier triad (iccid/imsi/imei) is reachable by the family terms "sim"
+// and "cellular" — both returned nothing before the cellular synonym cluster
+// was added. (The "card"-heavy phrasing "sim card number" is deliberately
+// not pinned: it is dominated by the card-decoder cluster, a legitimate
+// interpretation.)
+func TestToolSearch_CellularObliqueDiscoverability(t *testing.T) {
+	cases := map[string]string{
+		"decode this sim":      "iccid_decode",
+		"cellular identifiers": "imei_decode",
+		"sim swap forensics":   "iccid_decode",
+	}
+	for q, want := range cases {
+		out, err := toolSearchHandler(context.Background(), nil, map[string]any{"query": q, "limit": 8})
+		if err != nil {
+			t.Fatalf("%q: handler: %v", q, err)
+		}
+		if !strings.Contains(out, `"name": "`+want+`"`) {
+			t.Errorf("query %q did not surface %s in the top results:\n%s", q, want, out)
+		}
+	}
+}

internal/toolsearch/search.go

@@ -110,23 +110,32 @@ var synonyms = map[string][]string{ //nolint:gochecknoglobals
 	"securities": {"isin", "securities"},
 	"brokerage":  {"isin", "securities"},
 	"financial":  {"iban", "lei", "isin", "aba"},
-	"bluetooth":  {"ble", "bluetooth", "bt", "gatt"},
-	"ble":        {"ble", "bluetooth", "gatt"},
-	"ir":         {"ir", "infrared", "pronto"},
-	"infrared":   {"ir", "infrared", "pronto"},
-	"jam":        {"jammer", "jam"},
-	"jammer":     {"jammer", "jam"},
-	"replay":     {"replay", "bruteforce", "tx"},
-	"brute":      {"bruteforce", "brute", "crack"},
-	"crack":      {"crack", "hash", "bruteforce", "key"},
-	"decode":     {"decode", "decrypt", "parse"},
-	"decrypt":    {"decrypt", "decode"},
-	"sniff":      {"sniff", "capture", "monitor"},
-	"capture":    {"capture", "sniff", "monitor"},
-	"weather":    {"weather", "tpms", "lacrosse", "acurite"},
-	"pager":      {"pocsag", "pager"},
-	"badusb":     {"badusb", "ducky", "hid", "keystroke"},
-	"keystroke":  {"badusb", "hid", "usb"},
+	// Cellular identifier triad: iccid_decode (SIM serial), imsi_decode
+	// (subscriber) and imei_decode (device) are the identities a SIM-swap /
+	// forensic-seizure / IMSI-catcher engagement enumerates. "phone imei" /
+	// "subscriber identity" already match by name/description, but the
+	// natural family terms "sim" and "cellular" ranked the SIM/subscriber
+	// legs out of the top results. Both are telecom-specific (low collision).
+	"sim":       {"iccid", "imsi"},
+	"cellular":  {"imei", "imsi", "iccid", "gsmtap"},
+	"imsi":      {"imsi", "iccid"},
+	"bluetooth": {"ble", "bluetooth", "bt", "gatt"},
+	"ble":       {"ble", "bluetooth", "gatt"},
+	"ir":        {"ir", "infrared", "pronto"},
+	"infrared":  {"ir", "infrared", "pronto"},
+	"jam":       {"jammer", "jam"},
+	"jammer":    {"jammer", "jam"},
+	"replay":    {"replay", "bruteforce", "tx"},
+	"brute":     {"bruteforce", "brute", "crack"},
+	"crack":     {"crack", "hash", "bruteforce", "key"},
+	"decode":    {"decode", "decrypt", "parse"},
+	"decrypt":   {"decrypt", "decode"},
+	"sniff":     {"sniff", "capture", "monitor"},
+	"capture":   {"capture", "sniff", "monitor"},
+	"weather":   {"weather", "tpms", "lacrosse", "acurite"},
+	"pager":     {"pocsag", "pager"},
+	"badusb":    {"badusb", "ducky", "hid", "keystroke"},
+	"keystroke": {"badusb", "hid", "usb"},
 }
 
 // Search returns the tools whose fields best match query, highest score first,