@aiwg/cli 2026.10.4 → 2026.10.6

package/dist/src/mcp/config-layers.mjs

@@ -17,8 +17,8 @@
 
 import { lstat, mkdtemp, readFile, readlink, realpath, rmdir } from 'fs/promises';
 import { basename, dirname, isAbsolute, posix, relative, resolve, sep, win32 } from 'path';
-import { assertConfigDestination, assertNoSymlinkParents, writeConfigAtomic } from './config-file.mjs';
-import { resolveCredentialPolicy, stricterCredentialPolicy, warnCredentialPolicyRelaxation, warnDroppedOverlayPolicy } from './credentials.mjs';
+import { assertConfigDestination, assertConfigObject, assertNoSymlinkParents, writeConfigAtomic } from './config-file.mjs';
+import { credentialPolicyViolations, resolveCredentialPolicy, stricterCredentialPolicy, warnCredentialPolicyRelaxation, warnDroppedOverlayPolicy } from './credentials.mjs';
 
 /**
  * `platform` lets tests validate Windows path semantics (`C:\org`, UNC
@@ -62,9 +62,15 @@ export function resolveConfigLayers(configDirOverride, env = process.env, { plat
   return layers.length > 0 ? layers : null;
 }
 
-async function readLayer(path) {
+async function readLayer(path, collection) {
   try {
-    return JSON.parse(await readFile(path, 'utf-8'));
+    const parsed = JSON.parse(await readFile(path, 'utf-8'));
+    try {
+      assertConfigObject(parsed, collection);
+    } catch {
+      throw new Error(`Invalid MCP configuration layer ${path}: expected an object root and an object ${collection} map`);
+    }
+    return parsed;
   } catch (error) {
     if (error?.code === 'ENOENT') return null;
     if (error instanceof SyntaxError) throw new Error(`Invalid JSON in MCP configuration layer ${path}`);
@@ -115,7 +121,7 @@ export async function loadLayered(layers, filename, collection, defaults) {
   let lowerPolicySource;
   const writeLayer = layers.length - 1;
   for (const [index, dir] of layers.entries()) {
-    const parsed = await readLayer(resolve(dir, filename));
+    const parsed = await readLayer(resolve(dir, filename), collection);
     if (!parsed) continue;
     const { [collection]: entries, ...rest } = parsed;
     if (index === writeLayer) {
@@ -298,16 +304,26 @@ export async function assertLayerWriteDestination(layers, filename) {
 /** Persist atomically, then refresh ownership only after a successful write. */
 export async function saveLayerData(file, data, collection, layers, layering, explicitPolicy = false) {
   if (layers) await assertLayerWriteDestination(layers, basename(file));
+  // Validate the current bytes even if the caller loaded and cached an older
+  // version, or called save(data) on a fresh standalone registry.
+  await readLayer(file, collection);
   const persisted = layering ? writeLayerData(data, collection, layering, explicitPolicy) : data;
   // The active identity layer file is always 0600: it is the personal write
   // layer of an active AIWG_CONFIG_LAYERS configuration and may carry secrets.
   // Without layering, `file` is whatever single directory the caller
   // configured (which may be a shared, group-readable organisation checkout
   // maintained directly, not a private identity directory): an existing file
-  // keeps its mode, while a newly created file starts private at 0600.
+  // keeps its mode unless the persisted servers carry literal credentials,
+  // while a newly created file starts private at 0600.
+  const info = layers ? null : await assertConfigDestination(file);
+  const tighten = info && (info.mode & 0o077) !== 0 && collection === 'servers'
+    && Object.values(persisted[collection] || {}).some(server => credentialPolicyViolations(server, 'references').length > 0);
   await writeConfigAtomic(file, JSON.stringify(persisted, null, 2) + '\n', layers
     ? { userScope: true, rejectSymlinkParents: true }
-    : { newFileMode: 0o600, rejectSymlinkParents: true });
+    : { newFileMode: 0o600, rejectSymlinkParents: true, ...(tighten ? { mode: 0o600 } : {}) });
+  if (tighten) {
+    console.warn(`Warning: tightened MCP registry ${file} from ${(info.mode & 0o7777).toString(8).padStart(4, '0')} to 0600 because it contains literal credentials.`);
+  }
   if (layering) {
     layering.own = new Set(Object.keys(persisted[collection] || {}));
     layering.ownFields = new Set(Object.keys(persisted).filter(field => field !== collection));

package/dist/src/mcp/profiles.js

@@ -9,10 +9,10 @@
  *
  * @implements #889
  */
-import { resolveCredentialPolicy } from './credentials.mjs';
 import { isLowerLayerEntry, loadLayered, resolveProfileExtends, resolveConfigLayers, saveLayerData } from './config-layers.mjs';
-import { readFile, writeFile } from 'fs/promises';
-import { resolve } from 'path';
+import { writeConfigAtomic } from './config-file.mjs';
+import { readFile } from 'fs/promises';
+import { parse, resolve } from 'path';
 import { resolveConfigDir } from '../config/user-config.js';
 // ─────────────────────────────────────────────
 // Constants
@@ -81,38 +81,21 @@ export class McpProfileRegistry {
     async load() {
         if (this.cache)
             return this.cache;
-        if (this.layers) {
-            const layered = await loadLayered(this.layers, PROFILES_FILENAME, 'profiles', DEFAULT_DATA);
-            this.cache = layered.data;
-            this.layering = layered.layering;
-            return this.cache;
-        }
-        const filePath = this.getPath();
-        try {
-            const content = await readFile(filePath, 'utf-8');
-            const parsed = JSON.parse(content);
-            this.cache = {
-                ...DEFAULT_DATA,
-                ...parsed,
-                profiles: parsed.profiles || {},
-            };
-        }
-        catch {
-            this.cache = { ...DEFAULT_DATA, profiles: {} };
-        }
-        try {
-            resolveCredentialPolicy({ registryPolicy: this.cache.credentialPolicy, env: {} });
-        }
-        catch (error) {
-            this.cache = null;
-            throw new Error(`Invalid MCP credential policy in ${filePath}: ${error instanceof Error ? error.message : String(error)}`);
-        }
+        const loaded = await loadLayered(this.layers ?? [this.configDir], PROFILES_FILENAME, 'profiles', DEFAULT_DATA);
+        this.cache = loaded.data;
+        this.layering = this.layers ? loaded.layering : null;
         return this.cache;
     }
     async save(data = this.cache) {
         if (!data)
             return;
-        await saveLayerData(this.getPath(), data, 'profiles', this.layers, this.layering);
+        // Load ownership before a fresh save so inherited fields stay in their layer.
+        let layering = this.layering;
+        if (this.layers && !layering) {
+            await this.load();
+            layering = this.layering;
+        }
+        await saveLayerData(this.getPath(), data, 'profiles', this.layers, layering);
         this.cache = data;
         if (this.layers) {
             this.clearCache();
@@ -311,7 +294,11 @@ export class McpProfileRegistry {
         const toExport = profileName
             ? { [profileName]: data.profiles[profileName] }
             : data.profiles;
-        await writeFile(filePath, JSON.stringify({ profiles: toExport }, null, 2) + '\n', 'utf-8');
+        await writeConfigAtomic(filePath, JSON.stringify({ profiles: toExport }, null, 2) + '\n', {
+            userScope: true,
+            rejectSymlinkParents: true,
+            symlinkRoot: parse(resolve(filePath)).root,
+        });
     }
     async initPresets() {
         const data = structuredClone(await this.load());

package/dist/src/mcp/profiles.mjs

@@ -10,10 +10,10 @@
  * @implements #889
  */
 
-import { resolveCredentialPolicy } from './credentials.mjs';
 import { isLowerLayerEntry, loadLayered, resolveProfileExtends, resolveConfigLayers, saveLayerData } from './config-layers.mjs';
-import { readFile, writeFile } from 'fs/promises';
-import { resolve } from 'path';
+import { writeConfigAtomic } from './config-file.mjs';
+import { readFile } from 'fs/promises';
+import { parse, resolve } from 'path';
 import { homedir } from 'os';
 import { existsSync } from 'fs';
 
@@ -112,39 +112,21 @@ export class McpProfileRegistry {
   async load() {
     if (this.#cache) return this.#cache;
 
-    if (this.#layers) {
-      const layered = await loadLayered(this.#layers, PROFILES_FILENAME, 'profiles', DEFAULT_DATA);
-      this.#cache = layered.data;
-      this.#layering = layered.layering;
-      return this.#cache;
-    }
-
-    const filePath = this.getPath();
-    try {
-      const content = await readFile(filePath, 'utf-8');
-      const parsed = JSON.parse(content);
-      this.#cache = {
-        ...DEFAULT_DATA,
-        ...parsed,
-        profiles: parsed.profiles || {},
-      };
-    } catch {
-      this.#cache = { ...DEFAULT_DATA, profiles: {} };
-    }
-
-    try {
-      resolveCredentialPolicy({ registryPolicy: this.#cache.credentialPolicy, env: {} });
-    } catch (error) {
-      this.#cache = null;
-      throw new Error(`Invalid MCP credential policy in ${filePath}: ${error instanceof Error ? error.message : String(error)}`);
-    }
-
+    const loaded = await loadLayered(this.#layers ?? [this.#configDir], PROFILES_FILENAME, 'profiles', DEFAULT_DATA);
+    this.#cache = loaded.data;
+    this.#layering = this.#layers ? loaded.layering : null;
     return this.#cache;
   }
 
   async save(data = this.#cache) {
     if (!data) return;
-    await saveLayerData(this.getPath(), data, 'profiles', this.#layers, this.#layering);
+    // Load ownership before a fresh save so inherited fields stay in their layer.
+    let layering = this.#layering;
+    if (this.#layers && !layering) {
+      await this.load();
+      layering = this.#layering;
+    }
+    await saveLayerData(this.getPath(), data, 'profiles', this.#layers, layering);
     this.#cache = data;
     if (this.#layers) {
       this.clearCache();
@@ -402,7 +384,11 @@ export class McpProfileRegistry {
       throw new Error(`Profile "${profileName}" not found.`);
     }
 
-    await writeFile(filePath, JSON.stringify({ profiles: toExport }, null, 2) + '\n', 'utf-8');
+    await writeConfigAtomic(filePath, JSON.stringify({ profiles: toExport }, null, 2) + '\n', {
+      userScope: true,
+      rejectSymlinkParents: true,
+      symlinkRoot: parse(resolve(filePath)).root,
+    });
   }
 
   /** Install preset profiles (does not overwrite existing) */

package/dist/src/mcp/registry.js

@@ -120,32 +120,9 @@ export class McpServerRegistry {
     async load() {
         if (this.cache)
             return this.cache;
-        if (this.layers) {
-            const layered = await loadLayered(this.layers, REGISTRY_FILENAME, 'servers', DEFAULT_REGISTRY);
-            this.cache = layered.data;
-            this.layering = layered.layering;
-            return this.cache;
-        }
-        const filePath = this.getPath();
-        try {
-            const content = await readFile(filePath, 'utf-8');
-            const parsed = JSON.parse(content);
-            this.cache = {
-                ...DEFAULT_REGISTRY,
-                ...parsed,
-                servers: parsed.servers || {},
-            };
-        }
-        catch {
-            this.cache = { ...DEFAULT_REGISTRY, servers: {} };
-        }
-        try {
-            resolveCredentialPolicy({ registryPolicy: this.cache.credentialPolicy, env: {} });
-        }
-        catch (error) {
-            this.cache = null;
-            throw new Error(`Invalid MCP credential policy in ${filePath}: ${error instanceof Error ? error.message : String(error)}`);
-        }
+        const loaded = await loadLayered(this.layers ?? [this.configDir], REGISTRY_FILENAME, 'servers', DEFAULT_REGISTRY);
+        this.cache = loaded.data;
+        this.layering = this.layers ? loaded.layering : null;
         return this.cache;
     }
     /** Save the registry to disk */
@@ -536,6 +513,9 @@ async function injectJson(registry, servers, configPath, provider, dryRun, resul
     return result;
 }
 async function injectToml(registry, servers, configPath, provider, dryRun, result, userScope, projectRoot, toolPlan = null) {
+    // A deliberately aliased Codex home is trusted; descendants below it are not.
+    const destinationRoot = projectRoot ?? (process.env.CODEX_HOME || resolve(process.env.HOME || process.env.USERPROFILE || homedir(), '.codex'));
+    await assertConfigDestination(configPath, destinationRoot);
     let existing = '';
     try {
         existing = await readFile(configPath, 'utf-8');
@@ -553,7 +533,7 @@ async function injectToml(registry, servers, configPath, provider, dryRun, resul
         result.serversInjected.push(server.name);
     }
     if (!dryRun) {
-        await writeConfigAtomic(configPath, existing, { userScope, projectRoot });
+        await writeConfigAtomic(configPath, existing, { userScope, projectRoot: destinationRoot });
         for (const server of servers) {
             await registry.recordInjection(server.name, provider);
         }

package/dist/src/mcp/registry.mjs

@@ -115,33 +115,9 @@ export class McpServerRegistry {
   async load() {
     if (this.#cache) return this.#cache;
 
-    if (this.#layers) {
-      const layered = await loadLayered(this.#layers, REGISTRY_FILENAME, 'servers', DEFAULT_REGISTRY);
-      this.#cache = layered.data;
-      this.#layering = layered.layering;
-      return this.#cache;
-    }
-
-    const filePath = this.getPath();
-    try {
-      const content = await readFile(filePath, 'utf-8');
-      const parsed = JSON.parse(content);
-      this.#cache = {
-        ...DEFAULT_REGISTRY,
-        ...parsed,
-        servers: parsed.servers || {},
-      };
-    } catch {
-      this.#cache = { ...DEFAULT_REGISTRY, servers: {} };
-    }
-
-    try {
-      resolveCredentialPolicy({ registryPolicy: this.#cache.credentialPolicy, env: {} });
-    } catch (error) {
-      this.#cache = null;
-      throw new Error(`Invalid MCP credential policy in ${filePath}: ${error instanceof Error ? error.message : String(error)}`);
-    }
-
+    const loaded = await loadLayered(this.#layers ?? [this.#configDir], REGISTRY_FILENAME, 'servers', DEFAULT_REGISTRY);
+    this.#cache = loaded.data;
+    this.#layering = this.#layers ? loaded.layering : null;
     return this.#cache;
   }
 
@@ -488,6 +464,9 @@ async function injectJson(registry, servers, configPath, provider, dryRun, resul
 }
 
 async function injectToml(registry, servers, configPath, provider, dryRun, result, userScope, projectRoot, toolPlan = null) {
+  // A deliberately aliased Codex home is trusted; descendants below it are not.
+  const destinationRoot = projectRoot ?? (process.env.CODEX_HOME || resolve(process.env.HOME || process.env.USERPROFILE || homedir(), '.codex'));
+  await assertConfigDestination(configPath, destinationRoot);
   let existing = '';
   try {
     existing = await readFile(configPath, 'utf-8');
@@ -504,7 +483,7 @@ async function injectToml(registry, servers, configPath, provider, dryRun, resul
   }
 
   if (!dryRun) {
-    await writeConfigAtomic(configPath, existing, { userScope, projectRoot });
+    await writeConfigAtomic(configPath, existing, { userScope, projectRoot: destinationRoot });
 
     for (const server of servers) {
       await registry.recordInjection(server.name, provider);

package/dist/src/mcp/server.mjs

@@ -34,6 +34,27 @@ const FRAMEWORKS = {
   'media-marketing-kit': path.join(AIWG_ROOT, 'agentic/code/frameworks/media-marketing-kit')
 };
 
+/** Keep the published object contracts stable across native Zod converters. */
+function retainToolJsonSchema(schema, seen = new Set()) {
+  if (!(schema instanceof z.ZodType) || seen.has(schema)) return;
+  seen.add(schema);
+  const definition = schema._zod.def;
+  if (schema instanceof z.ZodObject) {
+    const catchall = definition.catchall;
+    if ((!catchall && Object.keys(schema.shape).length > 0) || catchall instanceof z.ZodNever || catchall instanceof z.ZodUnknown) {
+      z.globalRegistry.add(schema, { ...z.globalRegistry.get(schema), additionalProperties: catchall instanceof z.ZodUnknown });
+    }
+  }
+  if (schema instanceof z.ZodRecord && definition.keyType instanceof z.ZodString && !definition.keyType._zod.def.checks?.length) {
+    z.globalRegistry.add(schema, { ...z.globalRegistry.get(schema), propertyNames: undefined });
+  }
+  for (const value of Object.values(definition)) {
+    if (value instanceof z.ZodType) retainToolJsonSchema(value, seen);
+    else if (Array.isArray(value)) for (const child of value) retainToolJsonSchema(child, seen);
+    else if (value && typeof value === 'object') for (const child of Object.values(value)) retainToolJsonSchema(child, seen);
+  }
+}
+
 /**
  * Create and configure the AIWG MCP Server
  */
@@ -43,6 +64,18 @@ export async function createServer() {
     version: '1.0.0'
   });
 
+  const registerTool = server.registerTool.bind(server);
+  server.registerTool = (name, config, handler) => {
+    const schemas = {};
+    for (const key of ['inputSchema', 'outputSchema']) {
+      if (!config[key]) continue;
+      const schema = config[key] instanceof z.ZodType ? config[key] : z.object(config[key]);
+      retainToolJsonSchema(schema);
+      schemas[key] = schema;
+    }
+    return registerTool(name, { ...config, ...schemas }, handler);
+  };
+
   // ============================================
   // TOOLS
   // ============================================
@@ -248,7 +281,7 @@ export async function createServer() {
     description: 'Render AIWG template with provided variables',
     inputSchema: {
       template: z.string().describe('Template path (e.g., "sdlc/intake/project-intake-template.md")'),
-      variables: z.record(z.string()).optional().describe('Template variable substitutions')
+      variables: z.record(z.string(), z.string()).optional().describe('Template variable substitutions')
     }
   }, async ({ template, variables = {} }) => {
     try {

package/dist/src/mcp/tools/agentic-sandbox.mjs

@@ -10,6 +10,7 @@
 
 import { readFile, stat } from 'node:fs/promises';
 import { z } from 'zod';
+import { integer, dateTime } from '../../schema/zod-validation.mjs';
 import { assertNoWorkerBinding, mcpError, mcpJson } from '../helpers.mjs';
 
 const FLEET_VERSION = 'agentic-orchestration/v1';
@@ -173,15 +174,15 @@ const scopeSchema = {
   instance_id: z.string().min(1).max(255).regex(/^[^\r\n]+$/),
   agent_id: z.string().min(1).max(255).regex(/^[^\r\n]+$/),
 };
-const activityFilterSchema = z.object({
+const activityFilterSchema = z.strictObject({
   event_name: z.string().min(1).max(255).optional(), collector: z.string().min(1).max(255).optional(),
   trust: z.string().min(1).max(255).optional(), plane: z.string().min(1).max(255).optional(),
   outcome: z.string().min(1).max(255).optional(), session_id: z.string().min(1).max(255).optional(),
   mission_id: z.string().min(1).max(255).optional(), task_id: z.string().min(1).max(255).optional(),
   tool_call_id: z.string().min(1).max(255).optional(), command_id: z.string().min(1).max(255).optional(),
   process_id: z.string().min(1).max(255).optional(), trace_id: z.string().regex(/^[0-9a-f]{32}$/).optional(),
-  since: z.string().datetime().optional(), until: z.string().datetime().optional(), limit: z.number().int().min(1).max(1000).optional(),
-}).strict().optional();
+  since: dateTime().optional(), until: dateTime().optional(), limit: integer().min(1).max(1000).optional(),
+}).optional();
 
 function scopeHeaders(args) {
   return Object.fromEntries(Object.entries(SCOPE_HEADERS).map(([key, header]) => [header, args[key]]));
@@ -206,17 +207,17 @@ export function registerAgenticSandboxToolset(server, { client = new AgenticSand
     () => client.request('/api/v2/fleet/workloads', { validate: requireInventory }));
   register('sandbox-fleet-get', { title: 'Get Agentic Sandbox fleet workload', description: 'Read one revisioned fleet workload by child identity.', inputSchema: { contract_version: z.literal(FLEET_VERSION).default(FLEET_VERSION), child_id: z.string().min(1).max(255) }, annotations: { readOnlyHint: true, destructiveHint: false } },
     ({ child_id }) => client.request(`/api/v2/fleet/workloads/${encodeURIComponent(child_id)}`, { validate: requireFleetRecord }));
-  register('sandbox-fleet-reconcile-preview', { title: 'Preview fleet reconciliation', description: 'Compute a read-only reconciliation preview from inventory; never calls POST /reconcile.', inputSchema: { contract_version: z.literal(FLEET_VERSION).default(FLEET_VERSION), before_revision: z.number().int().min(0), child_ids: z.array(z.string().min(1).max(255)).max(1000) }, annotations: { readOnlyHint: true, destructiveHint: false } },
+  register('sandbox-fleet-reconcile-preview', { title: 'Preview fleet reconciliation', description: 'Compute a read-only reconciliation preview from inventory; never calls POST /reconcile.', inputSchema: { contract_version: z.literal(FLEET_VERSION).default(FLEET_VERSION), before_revision: integer().min(0), child_ids: z.array(z.string().min(1).max(255)).max(1000) }, annotations: { readOnlyHint: true, destructiveHint: false } },
     async ({ before_revision, child_ids }) => client.request('/api/v2/fleet/workloads', { validate: (value) => {
       const inventory = requireInventory(value);
       const byId = new Map(inventory.records.map((record) => [record.lineage.child_id, record]));
       return { document_type: 'reconciliation-preview', api_version: FLEET_VERSION, before_revision, inventory_revision: inventory.inventory_revision, stale: before_revision !== inventory.inventory_revision, rows: child_ids.map((child_id) => ({ child_id, present: byId.has(child_id), observed_state: byId.get(child_id)?.status?.observed_state ?? 'unknown', revision: byId.get(child_id)?.status?.revision ?? null })) };
     } }));
-  register('sandbox-fleet-admit', { title: 'Admit Agentic Sandbox fleet workload', description: 'Mutating fleet admission; requires an exact v1 workload and confirmed=true.', inputSchema: { contract_version: z.literal(FLEET_VERSION).default(FLEET_VERSION), workload: z.record(z.unknown()), confirmed: z.boolean().default(false) }, annotations: { readOnlyHint: false, destructiveHint: true } },
+  register('sandbox-fleet-admit', { title: 'Admit Agentic Sandbox fleet workload', description: 'Mutating fleet admission; requires an exact v1 workload and confirmed=true.', inputSchema: { contract_version: z.literal(FLEET_VERSION).default(FLEET_VERSION), workload: z.record(z.string(), z.unknown()), confirmed: z.boolean().default(false) }, annotations: { readOnlyHint: false, destructiveHint: true } },
     ({ workload, confirmed }) => confirmed ? client.request('/api/v2/fleet/workloads', { method: 'POST', body: requireFleetRecord(workload), validate: (value) => ({ replayed: value?.replayed === true, workload: requireFleetRecord(value?.workload) }) }) : confirmationError('sandbox-fleet-admit'));
-  register('sandbox-fleet-observe', { title: 'Record fleet workload observation', description: 'Mutating monotonic observation update; requires confirmed=true and expected revision.', inputSchema: { contract_version: z.literal(FLEET_VERSION).default(FLEET_VERSION), child_id: z.string().min(1).max(255), expected_revision: z.number().int().min(0), status: z.record(z.unknown()), runtime_identity: z.object({ session_id: z.string().optional(), task_id: z.string().optional(), command_id: z.string().optional() }).strict().optional(), confirmed: z.boolean().default(false) }, annotations: { readOnlyHint: false, destructiveHint: true } },
+  register('sandbox-fleet-observe', { title: 'Record fleet workload observation', description: 'Mutating monotonic observation update; requires confirmed=true and expected revision.', inputSchema: { contract_version: z.literal(FLEET_VERSION).default(FLEET_VERSION), child_id: z.string().min(1).max(255), expected_revision: integer().min(0), status: z.record(z.string(), z.unknown()), runtime_identity: z.strictObject({ session_id: z.string().optional(), task_id: z.string().optional(), command_id: z.string().optional() }).optional(), confirmed: z.boolean().default(false) }, annotations: { readOnlyHint: false, destructiveHint: true } },
     ({ child_id, expected_revision, status, runtime_identity, confirmed }) => confirmed ? client.request(`/api/v2/fleet/workloads/${encodeURIComponent(child_id)}/observations`, { method: 'POST', body: requireSafePayload({ expected_revision, status, ...(runtime_identity ? { runtime_identity } : {}) }, 'fleet observation'), validate: requireFleetRecord }) : confirmationError('sandbox-fleet-observe'));
-  register('sandbox-fleet-reconcile', { title: 'Reconcile fleet workloads', description: 'Mutating restart reconciliation; requires confirmed=true.', inputSchema: { contract_version: z.literal(FLEET_VERSION).default(FLEET_VERSION), before_revision: z.number().int().min(0), child_ids: z.array(z.string().min(1).max(255)).max(1000), confirmed: z.boolean().default(false) }, annotations: { readOnlyHint: false, destructiveHint: true } },
+  register('sandbox-fleet-reconcile', { title: 'Reconcile fleet workloads', description: 'Mutating restart reconciliation; requires confirmed=true.', inputSchema: { contract_version: z.literal(FLEET_VERSION).default(FLEET_VERSION), before_revision: integer().min(0), child_ids: z.array(z.string().min(1).max(255)).max(1000), confirmed: z.boolean().default(false) }, annotations: { readOnlyHint: false, destructiveHint: true } },
     ({ before_revision, child_ids, confirmed }) => confirmed ? client.request('/api/v2/fleet/reconcile', { method: 'POST', body: { before_revision, child_ids }, validate: requireReconciliation }) : confirmationError('sandbox-fleet-reconcile'));
 
   for (const [kind, eventsRequired] of [['coverage', false], ['timeline', true]]) {

package/dist/src/mcp/tools/command-run.mjs

@@ -17,6 +17,7 @@
  */
 
 import { z } from 'zod';
+import { integer } from '../../schema/zod-validation.mjs';
 import {
   runAiwgCli,
   loadCommandAllowList,
@@ -31,10 +32,10 @@ export function registerCommandRunTool(server) {
     description: 'Dispatch to any allow-listed AIWG CLI command (`aiwg <command> [args...]`). The full surface of ~94 commands is reachable. Destructive commands require `confirmed: true`.',
     inputSchema: {
       command: z.string().describe('Command name from `command-list` (e.g. "use", "discover", "doctor")'),
-      args: z.array(z.string()).default([]).describe('Argument array (never shell-interpreted)'),
+      args: z.array(z.string()).prefault([]).describe('Argument array (never shell-interpreted)'),
       project_dir: z.string().optional().describe('Working directory for the command'),
       confirmed: z.boolean().default(false).describe('Required for destructive commands (true to proceed)'),
-      timeout_ms: z.number().int().min(1000).max(600_000).default(120_000).describe('Timeout (1s–10min, default 2min)'),
+      timeout_ms: integer().min(1000).max(600_000).default(120_000).describe('Timeout (1s–10min, default 2min)'),
     },
     annotations: {
       destructiveHint: true,  // conservative default; many subcommands are read-only but the surface is broad

package/dist/src/mcp/tools/decision.mjs

@@ -1,102 +1,103 @@
 import { z } from 'zod';
+import { integer, number } from '../../schema/zod-validation.mjs';
 import { mcpError, mcpJson } from '../helpers.mjs';
 
 const STATUS = z.enum(['success', 'abstained', 'denied', 'unavailable', 'error', 'cancelled']);
-const ENVELOPE = z.object({ schema: z.string() }).passthrough();
-const LIVE_PLAN = z.object({ mode: z.literal('live'), status: z.enum(['ready', 'skipped', 'denied']), reason: z.string(), executes: z.literal(false) }).passthrough();
-const PATTERN_SUMMARY = z.object({
+const ENVELOPE = z.looseObject({ schema: z.string() });
+const LIVE_PLAN = z.looseObject({ mode: z.literal('live'), status: z.enum(['ready', 'skipped', 'denied']), reason: z.string(), executes: z.literal(false) });
+const PATTERN_SUMMARY = z.looseObject({
   id: z.string(),
   version: z.string(),
   status: z.string(),
   primitive: z.string().optional(),
-}).passthrough();
-const PATTERN_LIST = z.object({
+});
+const PATTERN_LIST = z.looseObject({
   schema: z.literal('aiwg-decision-pattern-list/v1'),
   patterns: z.array(PATTERN_SUMMARY),
-}).passthrough();
-const PATTERN_SHOW = z.object({
+});
+const PATTERN_SHOW = z.looseObject({
   schema: z.literal('aiwg-decision-pattern-show/v1'),
   pack: PATTERN_SUMMARY,
-  inputSchema: z.unknown(),
-  outputSchema: z.unknown(),
+  inputSchema: z.unknown().optional(),
+  outputSchema: z.unknown().optional(),
   livePlan: LIVE_PLAN,
-}).passthrough();
-const COMPACT_EVALUATION = z.object({
+});
+const COMPACT_EVALUATION = z.looseObject({
   status: STATUS,
   reason: z.string(),
-  attempts: z.number(),
-  value: z.unknown().nullable(),
-}).passthrough();
-const COMPACT_RESULT = z.object({
+  attempts: number(),
+  value: z.unknown().nullable().optional(),
+});
+const COMPACT_RESULT = z.looseObject({
   status: STATUS,
   rulesetStatus: z.string(),
   reason: z.string(),
   matchedRules: z.array(z.string()),
   evaluations: z.record(z.string(), COMPACT_EVALUATION),
-  outcome: z.unknown().nullable(),
-}).passthrough();
-const EVALUATE = z.object({
+  outcome: z.unknown().nullable().optional(),
+});
+const EVALUATE = z.looseObject({
   schema: z.literal('aiwg-decision-evaluate/v1'),
   status: STATUS,
   reason: z.string(),
-  exitCode: z.number(),
+  exitCode: number(),
   compact: COMPACT_RESULT.nullable().optional(),
-  result: z.unknown().nullable(),
-}).passthrough();
-const VALIDATION = z.object({
+  result: z.unknown().nullable().optional(),
+});
+const VALIDATION = z.looseObject({
   schema: z.literal('aiwg-decision-validation/v1'),
   target: z.enum(['request', 'definition', 'ruleset', 'binding']),
   valid: z.boolean(),
-  summary: z.object({
+  summary: z.looseObject({
     kind: z.string().nullable().optional(),
     apiVersion: z.string().nullable().optional(),
     id: z.string().nullable().optional(),
     version: z.string().nullable().optional(),
-  }).passthrough(),
+  }),
   errors: z.array(z.string()),
-}).passthrough();
-const CAPABILITIES = z.object({
+});
+const CAPABILITIES = z.looseObject({
   schema: z.literal('aiwg-decision-driver-capabilities/v1'),
   enabled: z.boolean(),
   offlineReady: z.boolean(),
   primitives: z.array(z.string()),
-  backend: z.object({ configured: z.boolean(), probed: z.boolean(), status: z.literal('not-probed') }).passthrough(),
-}).passthrough();
-const OFFLINE_RUN = z.object({
+  backend: z.looseObject({ configured: z.boolean(), probed: z.boolean(), status: z.literal('not-probed') }),
+});
+const OFFLINE_RUN = z.looseObject({
   schema: z.literal('aiwg-decision-offline-run/v1'),
   status: STATUS,
   route: z.enum(['accept', 'review', 'deny']),
   reason: z.string(),
-  evaluations: z.array(z.object({
+  evaluations: z.array(z.looseObject({
     alias: z.string(),
     primitive: z.string(),
     status: z.string(),
     reason: z.string(),
-    attempts: z.number(),
-    value: z.unknown(),
-  }).passthrough()),
+    attempts: number(),
+    value: z.unknown().optional(),
+  })),
   checks: z.array(z.unknown()),
-}).passthrough();
-const SYNTHETIC_SETUP = z.object({
+});
+const SYNTHETIC_SETUP = z.looseObject({
   schema: z.literal('aiwg-decision-synthetic-setup/v1'),
-  pattern: z.object({ id: z.string(), version: z.string() }).passthrough(),
+  pattern: z.looseObject({ id: z.string(), version: z.string() }),
   files: z.record(z.string(), z.unknown()),
-}).passthrough();
-const ASK = z.object({
+});
+const ASK = z.looseObject({
   schema: z.literal('aiwg-decision-ask/v1'),
   status: z.enum(['answered', 'fallback']),
-  answer: z.union([z.string(), z.boolean(), z.number()]).nullable(),
+  answer: z.union([z.string(), z.boolean(), number()]).nullable(),
   confidence: z.number().min(0).max(1).nullable(),
   probability: z.number().min(0).max(1).optional(),
   fallback: z.enum(['llm']).nullable(),
   reason: z.string(),
   model: z.string().nullable(),
   usage: z.object({
-    inputTokens: z.number().int().nonnegative().nullable(),
-    outputTokens: z.number().int().nonnegative().nullable(),
+    inputTokens: integer().nonnegative().nullable(),
+    outputTokens: integer().nonnegative().nullable(),
   }).nullable(),
-  latencyMs: z.number().nonnegative(),
-}).passthrough();
+  latencyMs: number().check(z.gte(0)).meta({ type: 'number', minimum: 0 }),
+});
 
 let driverPromise;
 
@@ -176,7 +177,7 @@ export function registerDecisionToolset(server) {
     description: 'Validate a request, definition, ruleset or binding without importing modules or resolving secrets.',
     inputSchema: {
       target: z.enum(['request', 'definition', 'ruleset', 'binding']),
-      document: z.unknown().describe('Inline decision document or dispatcher request object'),
+      document: z.unknown().optional().describe('Inline decision document or dispatcher request object'),
     },
     annotations: { readOnlyHint: true },
   }, async ({ target, document }) => (await driver()).validateDecisionValue(target, document, 'mcp-inline'), VALIDATION);
@@ -198,12 +199,12 @@ export function registerDecisionToolset(server) {
       question: z.string().min(1),
       yes_no: z.boolean().default(false),
       choices: z.array(z.string()).min(2).max(255).optional().describe('Choice ids, each optionally written as id=description so Jev knows what the option means'),
-      scale: z.object({ low: z.number().int(), high: z.number().int() }).optional(),
+      scale: z.object({ low: integer(), high: integer() }).optional(),
       context: z.string().optional(),
       threshold: z.number().min(0).max(1).default(0.8),
-      timeout_ms: z.number().int().positive().default(15000),
-      passes: z.number().int().positive().optional(),
-      escalation_passes: z.number().int().positive().optional(),
+      timeout_ms: integer().positive().default(15000),
+      passes: integer().positive().optional(),
+      escalation_passes: integer().positive().optional(),
       caller: z.string().optional().describe('Optional decision-point attribution tag, recorded in the decision ledger (#2946)'),
     },
     annotations: { readOnlyHint: true, destructiveHint: false, openWorldHint: true },