@remnic/core 10.0.84 → 10.0.86

package/src/access-mcp.test.ts

@@ -10,12 +10,16 @@ import assert from "node:assert/strict";
 import { mkdir, mkdtemp, rm, writeFile } from "node:fs/promises";
 import os from "node:os";
 import path from "node:path";
+import { PassThrough } from "node:stream";
 import test from "node:test";
 
 import { EngramMcpServer } from "./access-mcp.js";
+import { MCP_STDIO_MAX_FRAME_BYTES } from "./access-mcp-frames.js";
+import { EngramAccessForbiddenError } from "./access-errors.js";
 import { tokenCapabilityStore } from "./access-token-capabilities.js";
 import { EngramAccessInputError, type EngramAccessService } from "./access-service.js";
 import { parseConfig } from "./config.js";
+import { initLogger, resetLogger } from "./logger.js";
 import { readPair, writePair } from "./contradiction/contradiction-review.js";
 import type { StorageManager } from "./storage.js";
 
@@ -105,6 +109,46 @@ function makeToolRequest(name: string, args: Record<string, unknown> = {}): Reco
     },
   };
 }
+test("MCP reports buffer admission refusal as retryable and does not return success", async () => {
+  let attempts = 0;
+  const refusal = new Error("buffer at session-entry cap");
+  refusal.name = "ReplayAdmissionRefusedError";
+  // SAFETY: the mock overrides only observe; every other MCP dispatch path is unreachable in this test.
+  const service = Object.assign({} as EngramAccessService, {
+    observe: async () => {
+      attempts += 1;
+      if (attempts === 1) throw refusal;
+      return { ok: true };
+    },
+  });
+  const server = new EngramMcpServer(service);
+  const request = makeToolRequest("engram.observe", {
+    sessionKey: "capacity-test-session",
+    messages: [{ role: "user", content: "retry me" }],
+  });
+
+  const refused = await server.handleRequest(request);
+  // SAFETY: a tools/call request always resolves to a JSON-RPC result envelope; only isError and structuredContent are asserted.
+  const refusedResult = refused as {
+    result?: {
+      isError?: boolean;
+      structuredContent?: { code?: string; retryable?: boolean };
+    };
+  };
+  assert.equal(refusedResult.result?.isError, true, "refused admission must not be acknowledged as success");
+  // SAFETY: same tools/call result envelope as the assertion above.
+  assert.deepEqual(refusedResult.result?.structuredContent, {
+    code: "buffer_admission_refused",
+    retryable: true,
+  }, JSON.stringify(refused));
+
+  const retried = await server.handleRequest(request);
+  // SAFETY: same tools/call result envelope as refusedResult above.
+  const retriedResult = retried as typeof refusedResult;
+  assert.equal(retriedResult.result?.isError, false);
+  assert.equal(attempts, 2, "the same request can be retried after capacity is available");
+});
+
 
 // ──────────────────────────────────────────────────────────────────────────
 // Finding 2 (#396 new): invalid MCP briefing format values must be rejected
@@ -1291,6 +1335,17 @@ const FLEET_WIDE_MAINTENANCE_TOOLS = [
   "compounding_promote_candidate",
   "compression_guidelines_optimize",
   "compression_guidelines_activate",
+  // Issue #3225 B3: work and peer ops run against GLOBAL stores, so a
+  // namespace argument cannot isolate them — same fleet-wide rule.
+  "work_task",
+  "work_project",
+  "work_board",
+  "peer_list",
+  "peer_get",
+  "peer_set",
+  "peer_delete",
+  "peer_profile_get",
+  "peer_forget",
 ] as const;
 
 test("MCP fleet-wide maintenance ops: namespace-scoped token denied for every op, no side effect (issue #1850 round 10)", async () => {
@@ -1315,6 +1370,19 @@ test("MCP fleet-wide maintenance ops: namespace-scoped token denied for every op
     compressionGuidelinesOptimize: track,
     compressionGuidelinesActivate: track,
   } as unknown as EngramAccessService;
+  // Issue #3225 B3: track the global-store methods the fleet-wide guard must
+  // block; the dispatch reads them off this same object at call time.
+  Object.assign(service, {
+    workTask: track,
+    workProject: track,
+    workBoard: track,
+    peerList: track,
+    peerGet: track,
+    peerSet: track,
+    peerDelete: track,
+    peerProfileGet: track,
+    peerForget: track,
+  });
   const server = new EngramMcpServer(service, { principal: "ops" });
   try {
     for (const tool of FLEET_WIDE_MAINTENANCE_TOOLS) {
@@ -1451,3 +1519,145 @@ test("MCP external_wiki_search rejects an empty query before service dispatch",
   assert.equal(readMcpResult(response).isError, true);
   assert.equal(configRead, false);
 });
+
+// ===========================================================================
+// Issue #3225 C5 — tools/call catch-all must not leak unexpected Error.message
+// (paths from fs/backend). Intended typed access errors stay readable.
+// ===========================================================================
+
+function serviceWithRecallThrow(error: Error): EngramAccessService {
+  const service = makeMockService();
+  service.recall = async () => {
+    throw error;
+  };
+  return service;
+}
+
+test("MCP tools/call hides unexpected Error.message paths behind internal error", async () => {
+  const secretPath = "/home/secret/vault/token.pem";
+  const service = serviceWithRecallThrow(
+    new Error(`ENOENT: no such file or directory, open '${secretPath}'`),
+  );
+
+  const logLines: string[] = [];
+  initLogger(
+    {
+      info() {},
+      warn() {},
+      error(msg: string) {
+        logLines.push(msg);
+      },
+    },
+    false,
+    { timestamps: false },
+  );
+  try {
+    const server = new EngramMcpServer(service);
+    const outcome = readCallToolOutcome(
+      await server.handleRequest(makeToolRequest("engram.recall", { query: "anything" })),
+    );
+    assert.equal(outcome.isError, true);
+    assert.equal(outcome.text, "internal error");
+    assert.equal(outcome.text.includes(secretPath), false);
+    assert.ok(
+      logLines.some((line) => line.includes(secretPath)),
+      "server log must retain the unexpected detail",
+    );
+  } finally {
+    resetLogger();
+  }
+});
+
+test("MCP tools/call keeps intended EngramAccessInputError and ForbiddenError messages", async () => {
+  const inputOutcome = readCallToolOutcome(
+    await new EngramMcpServer(serviceWithRecallThrow(new EngramAccessInputError("memory not found: mem-42"))).handleRequest(
+      makeToolRequest("engram.recall", { query: "anything" }),
+    ),
+  );
+  assert.equal(inputOutcome.isError, true);
+  assert.equal(inputOutcome.text, "memory not found: mem-42");
+
+  const forbiddenOutcome = readCallToolOutcome(
+    await new EngramMcpServer(
+      serviceWithRecallThrow(new EngramAccessForbiddenError("token is not permitted to call operation: recall")),
+    ).handleRequest(makeToolRequest("engram.recall", { query: "anything" })),
+  );
+  assert.equal(forbiddenOutcome.isError, true);
+  assert.equal(forbiddenOutcome.text, "token is not permitted to call operation: recall");
+});
+
+// ===========================================================================
+// Issue #3225 N1 — stdio framing is bounded, refuses an oversized frame,
+// and keeps answering the frames that follow it.
+// ===========================================================================
+
+type StdioMessage = { id?: number | null; result?: object; error?: { message: string } };
+type StdioRequest = { jsonrpc: "2.0"; id: number; method: string };
+
+function stdioFrame(payload: StdioRequest): string {
+  const body = JSON.stringify(payload);
+  return `Content-Length: ${Buffer.byteLength(body, "utf-8")}\r\n\r\n${body}`;
+}
+
+function readStdioMessages(raw: string): StdioMessage[] {
+  const messages: StdioMessage[] = [];
+  let rest = raw;
+  while (rest.length > 0) {
+    const headerEnd = rest.indexOf("\r\n\r\n");
+    assert.ok(headerEnd >= 0, "server output must be Content-Length framed");
+    const length = Number.parseInt(rest.slice(0, headerEnd).split(":")[1] ?? "", 10);
+    const message: StdioMessage = JSON.parse(rest.slice(headerEnd + 4, headerEnd + 4 + length));
+    messages.push(message);
+    rest = rest.slice(headerEnd + 4 + length);
+  }
+  return messages;
+}
+
+/** Feeds each chunk in its own tick so the server sees separate data events. */
+async function runStdioChunks(chunks: string[]): Promise<StdioMessage[]> {
+  const input = new PassThrough();
+  const output = new PassThrough();
+  output.setEncoding("utf8");
+  let raw = "";
+  output.on("data", (chunk: string) => {
+    raw += chunk;
+  });
+  const running = new EngramMcpServer(makeMockService()).runStdio(input, output);
+  for (const chunk of chunks) {
+    input.write(chunk);
+    await new Promise<void>((resolve) => setImmediate(resolve));
+  }
+  input.end();
+  await running;
+  return readStdioMessages(raw);
+}
+
+const stdioPing = (id: number) => stdioFrame({ jsonrpc: "2.0", id, method: "ping" });
+
+test("MCP stdio refuses an oversized Content-Length, discards its body, and answers the next frame", async () => {
+  const declared = MCP_STDIO_MAX_FRAME_BYTES + 1;
+  const messages = await runStdioChunks([
+    `Content-Length: ${declared}\r\n\r\n`,
+    "x".repeat(1000),
+    "x".repeat(declared - 1000),
+    stdioPing(7),
+  ]);
+  assert.equal(messages.length, 2);
+  assert.match(messages[0]?.error?.message ?? "", /frame too large/);
+  assert.equal(messages[1]?.id, 7);
+  assert.ok(messages[1]?.result, "the frame after the refused one is answered normally");
+});
+
+test("MCP stdio refuses a header that never terminates and answers the next frame", async () => {
+  const messages = await runStdioChunks(["A".repeat(MCP_STDIO_MAX_FRAME_BYTES + 1), stdioPing(8)]);
+  assert.equal(messages.length, 2);
+  assert.match(messages[0]?.error?.message ?? "", /frame too large/);
+  assert.equal(messages[1]?.id, 8);
+});
+
+test("MCP stdio reassembles a frame split inside its header and inside its body", async () => {
+  const frame = stdioPing(9);
+  const messages = await runStdioChunks([frame.slice(0, 6), frame.slice(6, frame.length - 4), frame.slice(frame.length - 4)]);
+  assert.equal(messages.length, 1);
+  assert.equal(messages[0]?.id, 9);
+});

package/src/access-mcp.ts

@@ -30,7 +30,9 @@ import {
   validateRequest,
 } from "./access-schema.js";
 import { EngramAccessInputError, type EngramAccessRecallResponse, type EngramAccessService } from "./access-service.js";
-import { unknownToolError } from "./access-errors.js";
+import { EngramAccessForbiddenError, unknownToolError } from "./access-errors.js";
+import { log } from "./logger.js";
+import { McpFrameReader } from "./access-mcp-frames.js";
 import "./access-operations.js";
 import { validateBriefingFormat } from "./briefing.js";
 import { processChatMessage } from "./chat/chat-factory.js";
@@ -82,12 +84,32 @@ type JsonRpcRequest = {
   params?: Record<string, unknown>;
 };
 
+/** tools/call failure envelope; admission backpressure adds a retryable code. */
+type McpToolErrorResult = {
+  content: Array<{ type: string; text: string }>;
+  isError: boolean;
+  structuredContent?: { code: string; retryable: boolean };
+};
+
 function throwMcpAbort(signal: AbortSignal | undefined, message: string): void {
   if (!signal?.aborted) return;
   if (isAbortError(signal.reason)) throw signal.reason;
   throw abortError(message);
 }
 
+/**
+ * Map tools/call failures to a client-safe message. Unexpected backend/fs
+ * errors become a stable generic string; detail stays in the server log.
+ * Intended EngramAccessInputError / EngramAccessForbiddenError stay readable.
+ */
+function mcpToolErrorMessage(err: Error): string {
+  if (err instanceof EngramAccessInputError || err instanceof EngramAccessForbiddenError) {
+    return err.message;
+  }
+  log.error("engram MCP tools/call internal error", err);
+  return "internal error";
+}
+
 type McpRequestOptions = {
   principalOverride?: string;
   namespaceOverride?: string;
@@ -406,7 +428,7 @@ function parseMcpRequest<N extends SchemaName>(schemaName: N, args: Record<strin
 function optionalNonEmptyString(value: unknown, label: string): string | undefined {
   if (value === undefined || value === null || value === "") return undefined;
   if (typeof value !== "string") {
-    throw new Error(`${label} expects a string; got ${JSON.stringify(value)}`);
+    throw new EngramAccessInputError(`${label} expects a string; got ${JSON.stringify(value)}`);
   }
   return value;
 }
@@ -420,11 +442,11 @@ function optionalNonEmptyString(value: unknown, label: string): string | undefin
 function optionalPositiveInteger(value: unknown, label: string): number | undefined {
   if (value === undefined || value === null || value === "") return undefined;
   if (typeof value !== "number" && typeof value !== "string") {
-    throw new Error(`${label} expects a positive integer; got ${JSON.stringify(value)}`);
+    throw new EngramAccessInputError(`${label} expects a positive integer; got ${JSON.stringify(value)}`);
   }
   const parsed = typeof value === "number" ? value : Number(value);
   if (!Number.isFinite(parsed) || parsed <= 0 || !Number.isInteger(parsed)) {
-    throw new Error(`${label} expects a positive integer; got ${JSON.stringify(value)}`);
+    throw new EngramAccessInputError(`${label} expects a positive integer; got ${JSON.stringify(value)}`);
   }
   return parsed;
 }
@@ -447,7 +469,7 @@ async function getMcpServerVersion(): Promise<string> {
 }
 
 export class EngramMcpServer {
-  private buffer = Buffer.alloc(0);
+  private readonly frames = new McpFrameReader();
   private flushTask: Promise<void> | null = null;
   private readonly tools: McpTool[];
   private readonly resources: McpResource[];
@@ -2402,15 +2424,18 @@ export class EngramMcpServer {
         // Cancellation is transport control flow, not a JSON-RPC tool error.
         // Preserve the original AbortError so HTTP can silently end a dead socket.
         if (isAbortError(err)) throw err;
-        const message = err instanceof Error ? err.message : String(err);
-        return {
-          jsonrpc: "2.0",
-          id,
-          result: {
-            content: [{ type: "text", text: message }],
-            isError: true,
-          },
+        const message = mcpToolErrorMessage(err instanceof Error ? err : new Error(String(err)));
+        const admissionBackpressure =
+          err instanceof Error &&
+          (err.name === "ReplayAdmissionRefusedError" || err.name === "BufferAdmissionRefusedError");
+        const result: McpToolErrorResult = {
+          content: [{ type: "text", text: message }],
+          isError: true,
         };
+        if (admissionBackpressure) {
+          result.structuredContent = { code: "buffer_admission_refused", retryable: true };
+        }
+        return { jsonrpc: "2.0", id, result };
       }
     }
 
@@ -2426,7 +2451,7 @@ export class EngramMcpServer {
 
   async runStdio(input: Readable, output: Writable): Promise<void> {
     input.on("data", (chunk) => {
-      this.buffer = Buffer.concat([this.buffer, Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk)]);
+      this.frames.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk));
       this.scheduleFlush(output);
     });
     await new Promise<void>((resolve, reject) => {
@@ -2455,7 +2480,7 @@ export class EngramMcpServer {
         if (this.flushTask === task) {
           this.flushTask = null;
         }
-        if (this.buffer.length > 0) {
+        if (this.frames.hasUnread()) {
           this.scheduleFlush(output);
         }
       });
@@ -2463,30 +2488,15 @@ export class EngramMcpServer {
   }
 
   private async flushBuffer(output: Writable): Promise<void> {
-    while (true) {
-      const headerEnd = this.buffer.indexOf("\r\n\r\n");
-      if (headerEnd < 0) return;
-      const headerText = this.buffer.slice(0, headerEnd).toString("utf-8");
-      const headers = headerText.split("\r\n");
-      const contentLengthHeader = headers.find((line) => line.toLowerCase().startsWith("content-length:"));
-      if (!contentLengthHeader) {
-        this.buffer = Buffer.alloc(0);
-        return;
-      }
-      const contentLength = Number.parseInt(contentLengthHeader.split(":")[1]?.trim() ?? "0", 10);
-      if (!Number.isFinite(contentLength) || contentLength < 0) {
-        this.buffer = Buffer.alloc(0);
-        return;
+    for (let frame = this.frames.next(); frame; frame = this.frames.next()) {
+      if (frame.kind === "too-large") {
+        this.writeMessage(output, { jsonrpc: "2.0", id: null, error: { code: -32600, message: "frame too large" } });
+        continue;
       }
-      const messageStart = headerEnd + 4;
-      const messageEnd = messageStart + contentLength;
-      if (this.buffer.length < messageEnd) return;
-      const body = this.buffer.slice(messageStart, messageEnd).toString("utf-8");
-      this.buffer = this.buffer.slice(messageEnd);
-
       let parsed: JsonRpcRequest;
       try {
-        parsed = JSON.parse(body) as JsonRpcRequest;
+        // SAFETY: handleRequest defaults missing fields; a non-object body throws and scheduleFlush answers -32700.
+        parsed = JSON.parse(frame.text) as JsonRpcRequest;
       } catch {
         this.writeMessage(output, {
           jsonrpc: "2.0",
@@ -2620,7 +2630,7 @@ export class EngramMcpServer {
             caps?.ops === undefined || capabilityAllowsOp(caps, MCP_MIGRATED_OPERATIONS[toLegacyToolName(t.name)] ?? "")
         )
         .map((t) => t.name);
-      throw new Error(unknownToolError(name, visible));
+      throw new EngramAccessInputError(unknownToolError(name, visible));
     }
     const op = getOperation(migrated);
     if (!op) {

package/src/access-observe-replay-durability.test.ts

@@ -32,7 +32,7 @@ import { EngramAccessService } from "./access-service.js";
 import { SmartBuffer } from "./buffer.js";
 import { ExtractionDeadlineError } from "./orchestration/extraction-run.js";
 import { runExtractionDeferRetention } from "./orchestration/extraction-run-helpers.js";
-import { TurnIngestionCoordinator, type TurnIngestionDeps } from "./orchestration/turn-ingestion.js";
+import { ReplayAdmissionRefusedError, TurnIngestionCoordinator, type TurnIngestionDeps } from "./orchestration/turn-ingestion.js";
 import { resolveScopeProfilePlan } from "./namespaces/scope-profiles.js";
 import { resolveCodingNamespaceOverlay } from "./coding/coding-namespace.js";
 import type { ResolvedScopeProfilePlan } from "./namespaces/scope-profiles.js";
@@ -378,6 +378,40 @@ test("#3251 buffered observe append is durable before accept: a failed save reje
     await cleanupDir(memoryDir);
   }
 });
+test("#3251 multi-session refusal is atomic: earlier sessions are not partially accepted", async () => {
+  const config = parseConfig({
+    bufferMaxSessions: 3,
+    bufferMaxTurns: 100,
+    triggerMode: "every_n",
+    extractionMinChars: 1_000_000,
+    extractionMinUserTurns: 1000,
+  });
+  // SAFETY: SeedStorage implements the loadBuffer/saveBuffer surface this fixture drives.
+  const buffer = new SmartBuffer(config, new SeedStorage() as StorageManager);
+  const occupied = makeReplayTurn("occupied", "existing backlog");
+  await buffer.addTurn("occupied", {
+    role: occupied.role,
+    content: occupied.content,
+    timestamp: occupied.timestamp,
+    sessionKey: occupied.sessionKey,
+  });
+  const coordinator = makeTurnIngestionDouble(config, buffer, []);
+
+  await assert.rejects(
+    coordinator.ingestReplayBatch(
+      [
+        makeReplayTurn("fresh-a", "first in batch"),
+        makeReplayTurn("fresh-b", "second in batch"),
+      ],
+      bufferedObserveOptions({ writeNamespaceOverride: "default", sessionOwnerPrincipal: "alice" }),
+    ),
+    ReplayAdmissionRefusedError,
+  );
+
+  assert.equal(buffer.getTurns("fresh-a").length, 0, "refused batch must not durably accept its first session");
+  assert.equal(buffer.getTurns("fresh-b").length, 0, "refused batch must not durably accept its second session");
+  assert.equal(buffer.getTurns("occupied").length, 1, "pre-existing backlog remains intact");
+});
 
 test("#3251 durable observe admission is bounded: at the entry cap a new session is refused, not evicted", async () => {
   // Real SmartBuffer + real coordinator, NO Orchestrator background actors —
@@ -413,8 +447,10 @@ test("#3251 durable observe admission is bounded: at the entry cap a new session
     // (buffer.ts), each holding an accepted, durably pending capture. The
     // seed turns are PINNED accepted captures — cap pressure must refuse new
     // captures, never evict these (#3251 eviction guard; the pre-existing
-    // `default` mirror entry also occupies the entries map).
-    for (let index = 0; index < 200; index += 1) {
+    // `default` mirror entry also occupies the entries map). 199 seeds +
+    // `default` = 200 entries: the reachable cap boundary (durable ingress
+    // refuses a 200th seed once pinned entries fill the cap).
+    for (let index = 0; index < 199; index += 1) {
       const key = `seed-${index}`;
       await buffer.addTurn(key, {
         role: "user",
@@ -452,7 +488,7 @@ test("#3251 durable observe admission is bounded: at the entry cap a new session
     assert.equal(queued.length, 0, "refused capture must not queue extraction");
 
     const snapshot = await buffer.getBufferSnapshot();
-    assert.equal(snapshot.bufferedSessionCount, 200, "refusal must not evict accepted captures");
+    assert.equal(snapshot.bufferedSessionCount, 199, "refusal must not evict accepted captures");
     assert.ok(
       buffer.getTurns("seed-0").some((turn) => turn.content.includes("accepted seed capture 0")),
     );

package/src/access-observe-write-surface.ts

@@ -51,6 +51,7 @@ import {
   queueExplicitCaptureForReview,
 } from "./explicit-capture.js";
 import { log } from "./logger.js";
+import { embeddingBacklogExceeds, isSearchHealthDegraded } from "./namespaces/search.js";
 import { recordObjectiveStateSnapshotsFromObservedMessages } from "./objective-state-writers.js";
 import type { Orchestrator } from "./orchestrator.js";
 import { displayErrorDetail } from "./runtime/better-sqlite.js";
@@ -289,7 +290,7 @@ export class AccessObserveWriteSurface {
         /* status probe failed — non-fatal */
       }
     }
-    if (threshold > 0 && pendingEmbeddings !== null && pendingEmbeddings > threshold) {
+    if (embeddingBacklogExceeds(pendingEmbeddings, threshold)) {
       degraded = true;
       degradedReason = `embedding-backlog: ${pendingEmbeddings} pending > threshold ${threshold}`;
     }
@@ -355,14 +356,13 @@ export class AccessObserveWriteSurface {
       const pending = health.pendingEmbeddings ?? null;
       const oldest = health.oldestPendingAgeMs ?? null;
       const threshold = this.deps.orchestrator.config.qmdEmbeddingBacklogThreshold;
-      const backlogDegraded = threshold > 0 && pending !== null && pending > threshold;
-      const degraded = !active || health.collectionState === "unknown" || backlogDegraded;
+      const backlogDegraded = embeddingBacklogExceeds(pending, threshold);
       const mode = !active ? "fallback" : health.daemonMode === true ? "daemon" : "cli";
 
       return {
         enabled: true,
         active,
-        degraded,
+        degraded: isSearchHealthDegraded({ ...health, pendingEmbeddings: pending }, threshold),
         mode,
         collection: health.collection || fallbackCollection,
         collectionState: health.collectionState,

package/src/access-operations-batch.ts

@@ -14,7 +14,7 @@ import { z } from "zod";
 import type { DreamsPhase, RecallDisclosure, RecallPlanMode } from "./types.js";
 import type { RemnicChatGptMemoryInspectorInput } from "./mcp-memory-inspector-app.js";
 import { defineOperation } from "./access-boundary.js";
-import { EngramAccessForbiddenError } from "./access-errors.js";
+import { EngramAccessForbiddenError, rejectReservedArgumentKey } from "./access-errors.js";
 import {
   type ObserveRequest,
   observeRequestSchema,
@@ -55,11 +55,15 @@ import { normalizeDreamsStatusWindowHours } from "./maintenance/dreams-ledger.js
 // Shared helpers
 // ---------------------------------------------------------------------------
 
+// Object.create(null): a plain {} lets a copied own `__proto__` member invoke
+// the prototype setter, so an inherited field could reach the zod parse
+// (issue #3225 B1).
 function stripNulls(data: unknown): unknown {
   if (data !== null && typeof data === "object" && !Array.isArray(data)) {
     const obj = data as Record<string, unknown>;
-    const cleaned: Record<string, unknown> = {};
+    const cleaned = Object.create(null);
     for (const [key, value] of Object.entries(obj)) {
+      rejectReservedArgumentKey(key);
       if (value !== null) cleaned[key] = value;
     }
     return cleaned;
@@ -79,8 +83,9 @@ function strictSchema<T extends z.ZodRawShape>(shape: T): z.ZodType<Record<strin
  */
 function stripNullsExcept(data: unknown, preserve: readonly string[]): unknown {
   if (data !== null && typeof data === "object" && !Array.isArray(data)) {
-    const cleaned: Record<string, unknown> = {};
+    const cleaned = Object.create(null);
     for (const [key, value] of Object.entries(data as Record<string, unknown>)) {
+      rejectReservedArgumentKey(key);
       if (value !== null || preserve.includes(key)) cleaned[key] = value;
     }
     return cleaned;
@@ -328,9 +333,15 @@ defineOperation({ name: "identity_anchor_update", description: "Update identity
 defineOperation({ name: "memory_identity", description: "Memory identity.", schema: strictSchema({ namespace: S.str }), handler: async (input, ctx) => ({ result: await ctx.service.memoryIdentity({ namespace: optStr(input.namespace), principal: ctx.authenticatedPrincipal }) }) });
 
 // === WORK/SHARED ===
-defineOperation({ name: "work_task", description: "Manage work task.", schema: strictSchema({ action: S.str, id: S.str, title: S.str, description: S.str, status: S.str, priority: S.str, owner: S.str, assignee: S.str, projectId: S.str, tags: S.strArr, dueAt: S.str }), handler: async (input, ctx) => ({ result: await ctx.service.workTask({ action: (optStr(input.action) as "update" | "list" | "get" | "create" | "delete" | "transition") ?? "list", id: optStr(input.id), title: optStr(input.title), description: optStr(input.description), status: optStr(input.status), priority: optStr(input.priority), owner: optStr(input.owner), assignee: optStr(input.assignee), projectId: optStr(input.projectId), tags: optStrArr(input.tags), dueAt: optStr(input.dueAt) }) }) });
-defineOperation({ name: "work_project", description: "Manage work project.", schema: strictSchema({ action: S.str, id: S.str, name: S.str, description: S.str, status: S.str, owner: S.str, tags: S.strArr, taskId: S.str, projectId: S.str }), handler: async (input, ctx) => ({ result: await ctx.service.workProject({ action: (optStr(input.action) as "update" | "list" | "get" | "create" | "delete" | "link_task") ?? "list", id: optStr(input.id), name: optStr(input.name), description: optStr(input.description), status: optStr(input.status), owner: optStr(input.owner), tags: optStrArr(input.tags), taskId: optStr(input.taskId), projectId: optStr(input.projectId) }) }) });
-defineOperation({ name: "work_board", description: "Manage work board.", schema: strictSchema({ action: S.str, projectId: S.str, snapshotJson: S.str, linkToMemory: S.bool }), handler: async (input, ctx) => ({ result: await ctx.service.workBoard({ action: (optStr(input.action) as "export_markdown" | "export_snapshot" | "import_snapshot") ?? "export_markdown", projectId: optStr(input.projectId) ?? "", snapshotJson: optStr(input.snapshotJson) ?? "", linkToMemory: input.linkToMemory === true }) }) });
+// SAFETY: optStr yields undefined or a string; workTask rejects any action
+// string outside its union with an input error before touching a store.
+defineOperation({ name: "work_task", description: "Manage work task.", fleetWide: true, schema: strictSchema({ action: S.str, id: S.str, title: S.str, description: S.str, status: S.str, priority: S.str, owner: S.str, assignee: S.str, projectId: S.str, tags: S.strArr, dueAt: S.str }), handler: async (input, ctx) => ({ result: await ctx.service.workTask({ action: (optStr(input.action) as "update" | "list" | "get" | "create" | "delete" | "transition") ?? "list", id: optStr(input.id), title: optStr(input.title), description: optStr(input.description), status: optStr(input.status), priority: optStr(input.priority), owner: optStr(input.owner), assignee: optStr(input.assignee), projectId: optStr(input.projectId), tags: optStrArr(input.tags), dueAt: optStr(input.dueAt) }) }) });
+// SAFETY: optStr yields undefined or a string; workProject rejects any action
+// string outside its union with an input error before touching a store.
+defineOperation({ name: "work_project", description: "Manage work project.", fleetWide: true, schema: strictSchema({ action: S.str, id: S.str, name: S.str, description: S.str, status: S.str, owner: S.str, tags: S.strArr, taskId: S.str, projectId: S.str }), handler: async (input, ctx) => ({ result: await ctx.service.workProject({ action: (optStr(input.action) as "update" | "list" | "get" | "create" | "delete" | "link_task") ?? "list", id: optStr(input.id), name: optStr(input.name), description: optStr(input.description), status: optStr(input.status), owner: optStr(input.owner), tags: optStrArr(input.tags), taskId: optStr(input.taskId), projectId: optStr(input.projectId) }) }) });
+// SAFETY: optStr yields undefined or a string; workBoard rejects any action
+// string outside its union with an input error before touching a store.
+defineOperation({ name: "work_board", description: "Manage work board.", fleetWide: true, schema: strictSchema({ action: S.str, projectId: S.str, snapshotJson: S.str, linkToMemory: S.bool }), handler: async (input, ctx) => ({ result: await ctx.service.workBoard({ action: (optStr(input.action) as "export_markdown" | "export_snapshot" | "import_snapshot") ?? "export_markdown", projectId: optStr(input.projectId) ?? "", snapshotJson: optStr(input.snapshotJson) ?? "", linkToMemory: input.linkToMemory === true }) }) });
 // Issue #2920: the envelope controls (authority/expiresAt/supersedes) are
 // parsed by the ONE canonical surface module shared with the OpenClaw tool
 // (write-output-controls.ts); semantics stay in composeWriteEnvelope. A
@@ -451,12 +462,12 @@ defineOperation({ name: "memory_summarize_hourly", description: "Hourly summariz
 defineOperation({ name: "conversation_index_update", description: "Update conv index.", fleetWide: true, schema: strictSchema({ sessionKey: S.str, hours: S.num, embed: S.bool }), handler: async (input, ctx) => { if (input.sessionKey !== undefined && typeof input.sessionKey !== "string") throw new EngramAccessInputError("sessionKey must be a string when provided"); return { result: await ctx.service.conversationIndexUpdate({ sessionKey: optStr(input.sessionKey), hours: optNum(input.hours), embed: optBool(input.embed) }) }; } });
 defineOperation({ name: "profiling_report", description: "Profiling report.", schema: strictSchema({ format: S.str, limit: S.num }), handler: async (input, ctx) => { if (input.format !== undefined && typeof input.format !== "string") throw new EngramAccessInputError("format must be a string when provided"); if (input.limit !== undefined && typeof input.limit !== "number") throw new EngramAccessInputError("limit must be a number when provided"); return { result: await ctx.service.profilingReport({ format: optStr(input.format), limit: optNum(input.limit) }) }; } });
 defineOperation({ name: "live_connectors_run", description: "Run connectors.", fleetWide: true, schema: strictSchema({ force: S.bool }), handler: async (input, ctx) => ({ result: await ctx.service.liveConnectorsRun({ authenticatedPrincipal: ctx.authenticatedPrincipal, force: input.force === true }, ctx.authenticatedPrincipal) }) });
-defineOperation({ name: "peer_list", description: "List peers.", schema: strictSchema({}), handler: async (_i, ctx) => ({ result: await ctx.service.peerList() }) });
-defineOperation({ name: "peer_get", description: "Get peer.", schema: strictSchema({ id: S.str }), handler: async (input, ctx) => { const id = defStr(input.id, ""); if (!id) throw new EngramAccessInputError("peer_get: id is required"); return { result: await ctx.service.peerGet(id) }; } });
-defineOperation({ name: "peer_set", description: "Set peer.", schema: strictSchema({ id: S.str, kind: S.str, displayName: S.str, notes: S.str }), handler: async (input, ctx) => { const id = defStr(input.id, ""); if (!id) throw new EngramAccessInputError("peer_set: id is required"); if (input.kind !== undefined && typeof input.kind !== "string") throw new EngramAccessInputError("peer_set: kind must be a string when provided"); if (input.displayName !== undefined && typeof input.displayName !== "string") throw new EngramAccessInputError("peer_set: displayName must be a string when provided"); if (input.notes !== undefined && typeof input.notes !== "string") throw new EngramAccessInputError("peer_set: notes must be a string when provided"); return { result: await ctx.service.peerSet({ id, kind: optStr(input.kind), displayName: optStr(input.displayName), notes: optStr(input.notes) }) }; } });
-defineOperation({ name: "peer_delete", description: "Delete peer.", schema: strictSchema({ id: S.str }), handler: async (input, ctx) => { const id = defStr(input.id, ""); if (!id) throw new EngramAccessInputError("peer_delete: id is required"); return { result: await ctx.service.peerDelete(id) }; } });
-defineOperation({ name: "peer_profile_get", description: "Get peer profile.", schema: strictSchema({ id: S.str }), handler: async (input, ctx) => { const id = defStr(input.id, ""); if (!id) throw new EngramAccessInputError("peer_profile_get: id is required"); return { result: await ctx.service.peerProfileGet(id) }; } });
-defineOperation({ name: "peer_forget", description: "Forget peer.", schema: strictSchema({ id: S.str, confirm: S.str }), handler: async (input, ctx) => { const id = defStr(input.id, ""); if (!id) throw new EngramAccessInputError("peer_forget: id is required"); const c = optStr(input.confirm) ?? ""; if (c !== "yes") throw new EngramAccessInputError("peer_forget: confirm must be 'yes' to prevent accidental data loss"); return { result: await ctx.service.peerForget(id, { confirm: "yes" }) }; } });
+defineOperation({ name: "peer_list", description: "List peers.", fleetWide: true, schema: strictSchema({}), handler: async (_i, ctx) => ({ result: await ctx.service.peerList() }) });
+defineOperation({ name: "peer_get", description: "Get peer.", fleetWide: true, schema: strictSchema({ id: S.str }), handler: async (input, ctx) => { const id = defStr(input.id, ""); if (!id) throw new EngramAccessInputError("peer_get: id is required"); return { result: await ctx.service.peerGet(id) }; } });
+defineOperation({ name: "peer_set", description: "Set peer.", fleetWide: true, schema: strictSchema({ id: S.str, kind: S.str, displayName: S.str, notes: S.str }), handler: async (input, ctx) => { const id = defStr(input.id, ""); if (!id) throw new EngramAccessInputError("peer_set: id is required"); return { result: await ctx.service.peerSet({ id, kind: optStr(input.kind), displayName: optStr(input.displayName), notes: optStr(input.notes) }) }; } });
+defineOperation({ name: "peer_delete", description: "Delete peer.", fleetWide: true, schema: strictSchema({ id: S.str }), handler: async (input, ctx) => { const id = defStr(input.id, ""); if (!id) throw new EngramAccessInputError("peer_delete: id is required"); return { result: await ctx.service.peerDelete(id) }; } });
+defineOperation({ name: "peer_profile_get", description: "Get peer profile.", fleetWide: true, schema: strictSchema({ id: S.str }), handler: async (input, ctx) => { const id = defStr(input.id, ""); if (!id) throw new EngramAccessInputError("peer_profile_get: id is required"); return { result: await ctx.service.peerProfileGet(id) }; } });
+defineOperation({ name: "peer_forget", description: "Forget peer.", fleetWide: true, schema: strictSchema({ id: S.str, confirm: S.str }), handler: async (input, ctx) => { const id = defStr(input.id, ""); if (!id) throw new EngramAccessInputError("peer_forget: id is required"); const c = optStr(input.confirm) ?? ""; if (c !== "yes") throw new EngramAccessInputError("peer_forget: confirm must be 'yes' to prevent accidental data loss"); return { result: await ctx.service.peerForget(id, { confirm: "yes" }) }; } });
 defineOperation({ name: "console_state", description: "Console state.", schema: strictSchema({ namespace: S.str }), handler: async (input, ctx) => ({ result: await ctx.service.consoleState(optStr(input.namespace), ctx.authenticatedPrincipal) }) });
 defineOperation({ name: "dreams_status", description: "Dreams status.", schema: strictSchema({ windowHours: S.num, namespace: S.str }), handler: async (input, ctx) => { let wh = 24; try { wh = normalizeDreamsStatusWindowHours(input.windowHours); } catch { throw new EngramAccessInputError("dreams_status: windowHours must be a positive integer. Got: " + String(input.windowHours)); } return { result: await ctx.service.dreamsStatus({ windowHours: wh, namespace: optStr(input.namespace), principal: ctx.authenticatedPrincipal }) }; } });
 defineOperation({ name: "dreams_run", description: "Run dreams.", schema: strictSchema({ phase: S.str, dryRun: S.bool, namespace: S.str }), handler: async (input, ctx) => { const VP = ["lightSleep", "rem", "deepSleep"]; const ph = optStr(input.phase) ?? ""; if (!ph || !VP.includes(ph)) throw new EngramAccessInputError("dreams_run: phase must be one of: " + VP.join(", ")); if (input.dryRun !== undefined && typeof input.dryRun !== "boolean") throw new EngramAccessInputError("dreams_run: dryRun must be boolean"); return { result: await ctx.service.dreamsRun({ phase: ph as DreamsPhase, dryRun: input.dryRun === true, namespace: optStr(input.namespace), authenticatedPrincipal: ctx.authenticatedPrincipal }) }; } });