@salesforce/graphiti 11.31.14 → 11.32.0

package/src/intent/__tests__/build-detail.spec.ts

@@ -68,6 +68,7 @@ const SCHEMA_SDL = `
 		Id: ID!
 		Name: StringValue
 		Industry: StringValue
+		Amount__c: StringValue
 		Owner: OwnerUnion
 		Contacts(first: Int, where: Contact_Filter, orderBy: Contact_OrderBy): ContactConnection
 	}
@@ -390,3 +391,98 @@ describe("intent/build-detail", () => {
 		expect(out.query).toMatch(/first\s*:\s*\$childFirst\b/);
 	});
 });
+
+describe("intent/build-detail — selection-set injection (W-22735537)", () => {
+	it("rejects a fields[] breakout", async () => {
+		await expect(
+			buildDetail(
+				{ org: ORG, object: "Account", fields: ["Id } injectedAlias: Name { value"] },
+				noopPrimeDeps(),
+			),
+		).rejects.toThrow(/fields entry .* is not a valid field path/);
+	});
+
+	it("rejects a parentFields[] breakout", async () => {
+		await expect(
+			buildDetail(
+				{
+					org: ORG,
+					object: "Account",
+					fields: ["Id"],
+					parentFields: ["Owner.Name } evil { value"],
+				},
+				noopPrimeDeps(),
+			),
+		).rejects.toThrow(/parentFields entry .* is not a valid field path/);
+	});
+
+	it("rejects a childRelationships[].relationshipName breakout", async () => {
+		await expect(
+			buildDetail(
+				{
+					org: ORG,
+					object: "Account",
+					fields: ["Id"],
+					childRelationships: [
+						{ relationshipName: "Contacts } injectedSibling: Account { Id", fields: ["Id"] },
+					],
+				},
+				noopPrimeDeps(),
+			),
+		).rejects.toThrow(/selectChildRelationship: relationshipName .* is not a valid GraphQL Name/);
+	});
+
+	it("rejects a childRelationships[].fields breakout", async () => {
+		await expect(
+			buildDetail(
+				{
+					org: ORG,
+					object: "Account",
+					fields: ["Id"],
+					childRelationships: [
+						{ relationshipName: "Contacts", fields: ["Id } evil: LastName { value"] },
+					],
+				},
+				noopPrimeDeps(),
+			),
+		).rejects.toThrow(/childRelationships fields entry .* is not a valid field path/);
+	});
+
+	it("rejects a childRelationships[].filter object-KEY breakout", async () => {
+		await expect(
+			buildDetail(
+				{
+					org: ORG,
+					object: "Account",
+					fields: ["Id"],
+					childRelationships: [
+						{
+							relationshipName: "Contacts",
+							fields: ["Id"],
+							filter: { "Title } evil { value": { eq: "x" } },
+						},
+					],
+				},
+				noopPrimeDeps(),
+			),
+		).rejects.toThrow(/key '.*' is not a valid GraphQL Name/);
+	});
+
+	it("accepts a legit dotted parentField (Owner.Name)", async () => {
+		const out = await buildDetail(
+			{ org: ORG, object: "Account", fields: ["Id"], parentFields: ["Owner.Name"] },
+			noopPrimeDeps(),
+		);
+		expect(out.query).toContain("Owner");
+	});
+
+	// PR #678 review (Ciaran Hannigan): the __c custom-field accept-case the
+	// charset tests assert in isolation, exercised end-to-end through the builder.
+	it("accepts a Salesforce custom field (__c) and renders it", async () => {
+		const out = await buildDetail(
+			{ org: ORG, object: "Account", fields: ["Id", "Amount__c"] },
+			noopPrimeDeps(),
+		);
+		expect(out.query).toContain("Amount__c");
+	});
+});

package/src/intent/__tests__/build-list.spec.ts

@@ -4,7 +4,7 @@
  * For full license text, see the LICENSE.txt file
  */
 
-import { buildSchema } from "graphql";
+import { buildSchema, parse } from "graphql";
 import { describe, expect, it, vi } from "vitest";
 import { makeNoopPrimeDeps } from "../../__tests__/helpers/prime-deps.js";
 import * as sessionModule from "../../lib/session.js";
@@ -55,6 +55,7 @@ const SCHEMA_SDL = `
 		Id: ID!
 		Name: StringValue
 		Industry: StringValue
+		Amount__c: StringValue
 		Owner: OwnerUnion
 		Contacts(first: Int, where: Contact_Filter, orderBy: Contact_OrderBy): ContactConnection
 	}
@@ -471,3 +472,163 @@ describe("intent/build-list", () => {
 		expect(out.query).toMatch(/first\s*:\s*10\b/);
 	});
 });
+
+describe("intent/build-list — selection-set injection (W-22735537)", () => {
+	it("rejects a fields[] selection-set breakout", async () => {
+		await expect(
+			buildList(
+				{ org: ORG, object: "Account", fields: ["Id } injectedAlias: Name { value"] },
+				noopPrimeDeps(),
+			),
+		).rejects.toThrow(/fields entry .* is not a valid field path/);
+	});
+
+	it("rejects a parentFields[] breakout", async () => {
+		await expect(
+			buildList(
+				{
+					org: ORG,
+					object: "Account",
+					fields: ["Id"],
+					parentFields: ["Owner.Name } evil { value"],
+				},
+				noopPrimeDeps(),
+			),
+		).rejects.toThrow(/parentFields entry .* is not a valid field path/);
+	});
+
+	it("rejects a childRelationships[].fields breakout", async () => {
+		await expect(
+			buildList(
+				{
+					org: ORG,
+					object: "Account",
+					fields: ["Id"],
+					childRelationships: [
+						{ relationshipName: "Contacts", fields: ["Id } evil: LastName { value"] },
+					],
+				},
+				noopPrimeDeps(),
+			),
+		).rejects.toThrow(/childRelationships fields entry .* is not a valid field path/);
+	});
+
+	it("rejects a childRelationships[].relationshipName breakout", async () => {
+		await expect(
+			buildList(
+				{
+					org: ORG,
+					object: "Account",
+					fields: ["Id"],
+					childRelationships: [
+						{ relationshipName: "Contacts } injectedSibling: Account { Id", fields: ["Id"] },
+					],
+				},
+				noopPrimeDeps(),
+			),
+		).rejects.toThrow(/selectChildRelationship: relationshipName .* is not a valid GraphQL Name/);
+	});
+
+	it("rejects a filter object-KEY breakout (argument-position injection)", async () => {
+		await expect(
+			buildList(
+				{
+					org: ORG,
+					object: "Account",
+					fields: ["Id"],
+					filter: { "Industry } evilField { value } sib: Name(x": { eq: "Tech" } },
+				},
+				noopPrimeDeps(),
+			),
+		).rejects.toThrow(/key '.*' is not a valid GraphQL Name/);
+	});
+
+	it("rejects an orderBy object-KEY breakout", async () => {
+		await expect(
+			buildList(
+				{
+					org: ORG,
+					object: "Account",
+					fields: ["Id"],
+					orderBy: { "Name } evil { value": { order: "ASC" } },
+				},
+				noopPrimeDeps(),
+			),
+		).rejects.toThrow(/key '.*' is not a valid GraphQL Name/);
+	});
+
+	it("accepts a legit dotted parentField (Owner.Name) and a legit filter", async () => {
+		const out = await buildList(
+			{
+				org: ORG,
+				object: "Account",
+				fields: ["Id", "Name"],
+				parentFields: ["Owner.Name"],
+				filter: { Industry: { eq: "Tech" } },
+			},
+			noopPrimeDeps(),
+		);
+		expect(out.query).toContain("Owner");
+	});
+
+	// PR #678 review (Ciaran Hannigan): the __c custom-field accept-case the
+	// charset tests assert in isolation, exercised end-to-end through the builder.
+	it("accepts a Salesforce custom field (__c) and renders it", async () => {
+		const out = await buildList(
+			{ org: ORG, object: "Account", fields: ["Id", "Amount__c"] },
+			noopPrimeDeps(),
+		);
+		expect(out.query).toContain("Amount__c");
+	});
+
+	it("rejects a scope argument breakout", async () => {
+		await expect(
+			buildList(
+				{
+					org: ORG,
+					object: "Account",
+					fields: ["Id"],
+					scope: "{}) { Id } injectedSibling: Account(scope: MINE",
+				},
+				noopPrimeDeps(),
+			),
+		).rejects.toThrow(/buildList: scope .* is not a valid GraphQL Name/);
+	});
+
+	it("accepts a legit scope enum token and a $var scope", async () => {
+		const enumOut = await buildList(
+			{ org: ORG, object: "Account", fields: ["Id"], scope: "EVERYTHING" },
+			noopPrimeDeps(),
+		);
+		expect(enumOut.query).toContain("scope: EVERYTHING");
+		const varOut = await buildList(
+			{ org: ORG, object: "Account", fields: ["Id"], scope: "$myScope" },
+			noopPrimeDeps(),
+		);
+		expect(varOut.query).toContain("$myScope");
+	});
+
+	it("rejects a NESTED filter object-KEY breakout (recursion guard)", async () => {
+		await expect(
+			buildList(
+				{
+					org: ORG,
+					object: "Account",
+					fields: ["Id"],
+					filter: { Industry: { "eq } evil { value": "Tech" } },
+				},
+				noopPrimeDeps(),
+			),
+		).rejects.toThrow(/key '.*' is not a valid GraphQL Name/);
+	});
+
+	it("renders a parseable document with no injected sibling (graphql-js reparse)", async () => {
+		const out = await buildList(
+			{ org: ORG, object: "Account", fields: ["Id", "Name"], filter: { Industry: { eq: "Tech" } } },
+			noopPrimeDeps(),
+		);
+		expect(() => parse(out.query)).not.toThrow();
+		expect(out.query).not.toContain("injectedAlias");
+		expect(out.query).not.toContain("evil");
+	});
+});

package/src/intent/__tests__/build-update-validation.spec.ts

@@ -131,4 +131,24 @@ describe("intent/build-update — GraphQL name validation", () => {
 			).rejects.toThrow(/buildMutation: operationName 'has spaces' is not a valid GraphQL Name/);
 		});
 	});
+
+	describe("returnFields validation (W-22735537)", () => {
+		it("rejects a selection-set breakout payload", async () => {
+			await expect(
+				buildUpdate(
+					{ org: ORG, object: "Account", returnFields: ["Id } injectedAlias: Name { value"] },
+					noopPrimeDeps(),
+				),
+			).rejects.toThrow(/returnFields entry .* is not a valid field path/);
+		});
+
+		it("accepts a legit dot-path (Owner.Name) — the guard allows dotted segments", async () => {
+			await expect(
+				buildUpdate(
+					{ org: ORG, object: "Account", returnFields: ["Id", "Owner.Name"] },
+					noopPrimeDeps(),
+				),
+			).resolves.toBeDefined();
+		});
+	});
 });

package/src/intent/build-detail.ts

@@ -8,7 +8,7 @@ import { buildOutput } from "./build-output.js";
 import { getSchemaWithPriming } from "./get-schema-with-priming.js";
 import { selectChildRelationship } from "./select-child-relationship.js";
 import { type DetailSpec, type ToolOutput } from "./types.js";
-import { assertGraphqlName } from "../lib/graphql-name.js";
+import { assertDottedGraphqlName, assertGraphqlName } from "../lib/graphql-name.js";
 import { selectDottedFieldPath } from "../lib/path-selection.js";
 import { type PrimeDeps } from "../lib/prime-schema.js";
 import { addVariable, createSession, deepSetArg } from "../lib/session.js";
@@ -54,11 +54,13 @@ export async function buildDetail(spec: DetailSpec, deps?: PrimeDeps): Promise<T
 	const node = connectionNodePath(connection);
 
 	for (const field of spec.fields) {
+		assertDottedGraphqlName(field, "buildDetail", "fields entry");
 		selectDottedFieldPath(session, schema, node, field);
 	}
 
 	if (spec.parentFields) {
 		for (const pf of spec.parentFields) {
+			assertDottedGraphqlName(pf, "buildDetail", "parentFields entry");
 			selectDottedFieldPath(session, schema, node, pf);
 		}
 	}

package/src/intent/build-list.ts

@@ -8,7 +8,7 @@ import { buildOutput } from "./build-output.js";
 import { getSchemaWithPriming } from "./get-schema-with-priming.js";
 import { selectChildRelationship } from "./select-child-relationship.js";
 import { type ListSpec, type ToolOutput } from "./types.js";
-import { assertGraphqlName } from "../lib/graphql-name.js";
+import { assertDottedGraphqlName, assertGraphqlName } from "../lib/graphql-name.js";
 import { selectDottedFieldPath } from "../lib/path-selection.js";
 import { type PrimeDeps } from "../lib/prime-schema.js";
 import { addVariable, createSession, deepSetArg, selectLeaf } from "../lib/session.js";
@@ -47,11 +47,13 @@ export async function buildList(spec: ListSpec, deps?: PrimeDeps): Promise<ToolO
 	const nodePath = [...connectionPath, "edges", "node"];
 
 	for (const field of spec.fields) {
+		assertDottedGraphqlName(field, "buildList", "fields entry");
 		selectDottedFieldPath(session, schema, nodePath, field);
 	}
 
 	if (spec.parentFields) {
 		for (const pf of spec.parentFields) {
+			assertDottedGraphqlName(pf, "buildList", "parentFields entry");
 			selectDottedFieldPath(session, schema, nodePath, pf);
 		}
 	}
@@ -103,6 +105,11 @@ export async function buildList(spec: ListSpec, deps?: PrimeDeps): Promise<ToolO
 	}
 
 	if (spec.scope) {
+		// `scope` renders into an argument position and is stored verbatim, so an
+		// unconstrained string is a selection-set / argument breakout (W-22735537).
+		// Allow a bare enum token (e.g. MINE) or a $varName; reject anything else.
+		const scopeName = spec.scope.startsWith("$") ? spec.scope.slice(1) : spec.scope;
+		assertGraphqlName(scopeName, "buildList", "scope");
 		promoteVariables(session, schema, connectionPath, "scope", spec.scope, extraWarnings);
 		deepSetArg(session, connectionPath, "scope", [], spec.scope);
 	}

package/src/intent/build-mutation.ts

@@ -7,7 +7,7 @@
 import { buildOutput } from "./build-output.js";
 import { getSchemaWithPriming } from "./get-schema-with-priming.js";
 import { type CreateSpec, type ToolOutput, type UpdateSpec } from "./types.js";
-import { assertGraphqlName } from "../lib/graphql-name.js";
+import { assertDottedGraphqlName, assertGraphqlName } from "../lib/graphql-name.js";
 import { selectDottedFieldPath } from "../lib/path-selection.js";
 import { type PrimeDeps } from "../lib/prime-schema.js";
 import { addVariable, createSession, deepSetArg } from "../lib/session.js";
@@ -63,6 +63,11 @@ export async function buildMutation(
 
 	const extraWarnings: string[] = [];
 	for (const field of spec.returnFields ?? ["Id"]) {
+		// Validate the charset BEFORE the warn-swallowing try below, so a
+		// selection-set breakout (W-22735537) hard-fails instead of being demoted
+		// to a non-gating warning. A legit dot-path passes here and is then handled
+		// (warn-and-skip) by selectDottedFieldPath as an unsupported mutation-result path.
+		assertDottedGraphqlName(field, "buildMutation", "returnFields entry");
 		try {
 			selectDottedFieldPath(session, schema, recordPath, field);
 		} catch (err) {

package/src/intent/select-child-relationship.ts

@@ -6,6 +6,7 @@
 
 import { type GraphQLSchema } from "graphql";
 import { type ChildRelationshipSpec } from "./types.js";
+import { assertDottedGraphqlName, assertGraphqlName } from "../lib/graphql-name.js";
 import { selectDottedFieldPath } from "../lib/path-selection.js";
 import { deepSetArg, type QuerySession } from "../lib/session.js";
 import { normalizeOrderBy, promoteArg } from "../lib/variable-promotion.js";
@@ -27,10 +28,19 @@ export function selectChildRelationship(
 	child: ChildRelationshipSpec,
 	warnings?: string[],
 ): void {
+	// `relationshipName` is appended to the path and rendered verbatim as the
+	// connection field name (query-builder emits node.fieldName directly), so an
+	// unconstrained value is a selection-set breakout — the same class as `fields`
+	// below and `object`/`scope` on the top-level builders. Guard it here too: the
+	// MCP + CLI-mirror boundaries already enforce the GraphQL Name charset via zod,
+	// but the builders are also reachable directly (CLI, eval harness) (W-22735537).
+	assertGraphqlName(child.relationshipName, "selectChildRelationship", "relationshipName");
+
 	const childConnectionPath = [...parentNodePath, child.relationshipName];
 	const childNodePath = [...childConnectionPath, "edges", "node"];
 
 	for (const field of child.fields) {
+		assertDottedGraphqlName(field, "selectChildRelationship", "childRelationships fields entry");
 		selectDottedFieldPath(session, schema, childNodePath, field);
 	}
 

package/src/lib/__tests__/graphql-name.spec.ts

@@ -5,7 +5,12 @@
  */
 
 import { describe, expect, it } from "vitest";
-import { assertGraphqlName, GRAPHQL_NAME_RE } from "../graphql-name.js";
+import {
+	assertDottedGraphqlName,
+	assertGraphqlName,
+	DOTTED_GRAPHQL_NAME_RE,
+	GRAPHQL_NAME_RE,
+} from "../graphql-name.js";
 
 /**
  * Single source of truth for the GraphQL Name guard shared by every intent
@@ -14,12 +19,18 @@ import { assertGraphqlName, GRAPHQL_NAME_RE } from "../graphql-name.js";
  */
 describe("lib/graphql-name", () => {
 	describe("assertGraphqlName", () => {
-		it.each(["Account", "Custom_Object__c", "_Foo", "_", "a", "a1_2b", "CreateAccount"])(
-			"accepts the valid GraphQL Name %j",
-			(value) => {
-				expect(() => assertGraphqlName(value, "buildX", "operationName")).not.toThrow();
-			},
-		);
+		it.each([
+			"Account",
+			"Custom_Object__c",
+			"MyNS__Field__c", // namespaced custom field (PR #678 review: __c regression guard)
+			"_Foo",
+			"_",
+			"a",
+			"a1_2b",
+			"CreateAccount",
+		])("accepts the valid GraphQL Name %j", (value) => {
+			expect(() => assertGraphqlName(value, "buildX", "operationName")).not.toThrow();
+		});
 
 		it.each([
 			"", // empty
@@ -61,4 +72,58 @@ describe("lib/graphql-name", () => {
 			expect(GRAPHQL_NAME_RE.test("")).toBe(false);
 		});
 	});
+
+	// W-22735537: dotted field-path guard for returnFields / fields / parentFields
+	// / childRelationships.fields. Each '.'-separated segment must be a GraphQL
+	// Name; a breakout string (containing { } : or whitespace) cannot match.
+	describe("assertDottedGraphqlName", () => {
+		it.each([
+			"Id",
+			"Name",
+			"Owner.Name",
+			"CreatedBy.Profile.Name",
+			"Amount__c", // Salesforce custom field (PR #678 review: __c regression guard)
+			"Owner.Custom__c", // dotted path ending in a custom field
+			"MyNS__Field__c", // namespaced custom field (double underscore in the middle)
+			"_a._b",
+			"a1.b2.c3",
+			"_",
+		])("accepts the valid dotted field path %j", (value) => {
+			expect(() => assertDottedGraphqlName(value, "buildX", "returnFields entry")).not.toThrow();
+		});
+
+		it.each([
+			"", // empty
+			".Name", // leading dot
+			"Owner.", // trailing dot
+			"Owner..Name", // empty segment
+			"1Bad.Name", // segment leading digit
+			"Owner.Na-me", // hyphen in segment
+			"a b", // space
+			"Id } injectedAlias: Name { value", // the W-22735537 selection-set breakout
+			"Name { value } evil",
+			"Id @skip(if:true)",
+			"Owner.Name { value",
+		])("rejects the invalid field path %j", (value) => {
+			expect(() => assertDottedGraphqlName(value, "buildX", "returnFields entry")).toThrow(
+				/is not a valid field path/,
+			);
+		});
+
+		it("throws the exact builder- and field-prefixed message", () => {
+			expect(() => assertDottedGraphqlName("a b", "buildMutation", "returnFields entry")).toThrow(
+				/^buildMutation: returnFields entry 'a b' is not a valid field path/,
+			);
+		});
+	});
+
+	describe("DOTTED_GRAPHQL_NAME_RE", () => {
+		it("accepts dotted paths and rejects breakout strings", () => {
+			expect(DOTTED_GRAPHQL_NAME_RE.test("Owner.Name")).toBe(true);
+			expect(DOTTED_GRAPHQL_NAME_RE.test("Id")).toBe(true);
+			expect(DOTTED_GRAPHQL_NAME_RE.test("Id } x: y { z")).toBe(false);
+			expect(DOTTED_GRAPHQL_NAME_RE.test("Owner.")).toBe(false);
+			expect(DOTTED_GRAPHQL_NAME_RE.test("")).toBe(false);
+		});
+	});
 });

package/src/lib/graphql-name.ts

@@ -33,3 +33,29 @@ export function assertGraphqlName(value: string, builder: string, field: string)
 		);
 	}
 }
+
+/**
+ * Dotted field path: one GraphQL Name, then zero or more `.`-separated Names —
+ * e.g. `Id`, `Owner.Name`, `CreatedBy.Profile.Name`. Each segment must be a
+ * valid GraphQL Name on its own, and only the literal segment-separating dot is
+ * allowed between them. Because no segment can contain `{`, `}`, `:`, or
+ * whitespace, a string that matches cannot close a selection block early or
+ * hoist a sibling selection — closing the W-22735537 selection-set injection
+ * where caller-supplied `returnFields` / `fields` / `parentFields` reach the
+ * rendered query verbatim.
+ */
+export const DOTTED_GRAPHQL_NAME_RE = /^[A-Za-z_][A-Za-z0-9_]*(\.[A-Za-z_][A-Za-z0-9_]*)*$/;
+
+/**
+ * Throw if `value` is not a valid dotted field path (see
+ * {@link DOTTED_GRAPHQL_NAME_RE}). The intent-layer twin of the zod
+ * `dottedGraphqlName()` factory, used by the builders, which are also reachable
+ * directly (CLI, eval harness) and so cannot rely on the zod boundary.
+ */
+export function assertDottedGraphqlName(value: string, builder: string, field: string): void {
+	if (!DOTTED_GRAPHQL_NAME_RE.test(value)) {
+		throw new Error(
+			`${builder}: ${field} '${value}' is not a valid field path (each '.'-separated segment must be a GraphQL Name matching ${GRAPHQL_NAME_RE})`,
+		);
+	}
+}

package/src/lib/variable-promotion.ts

@@ -27,6 +27,7 @@
  */
 
 import { type GraphQLSchema } from "graphql";
+import { GRAPHQL_NAME_RE } from "./graphql-name.js";
 import { addVariable, type QuerySession } from "./session.js";
 import { inferTypeFromArgsPath } from "../commands/query-helpers.js";
 
@@ -127,6 +128,17 @@ function walk(
 	}
 	if (value && typeof value === "object") {
 		for (const [k, v] of Object.entries(value as Record<string, unknown>)) {
+			// Object keys are rendered RAW as field/operator names by
+			// query-builder's valueToGraphQL (input-object keys cannot be quoted in
+			// GraphQL), so an unvalidated key like `Id: {eq:"1"}}) { evil { value }` is
+			// a selection-set / argument breakout. Validate every key (at every depth)
+			// as a GraphQL Name and hard-fail — values are separately quoted and safe.
+			// This is the Class-B half of W-22735537; runs before deepSetArg renders it.
+			if (!GRAPHQL_NAME_RE.test(k)) {
+				throw new Error(
+					`${argName}: key '${k}' is not a valid GraphQL Name (must match ${GRAPHQL_NAME_RE}); filter/orderBy keys render as field/operator names in the query.`,
+				);
+			}
 			walk(session, schema, fieldSchemaPath, argName, v, [...pathInsideArg, k], warnings);
 		}
 	}

package/src/mcp/tools/__tests__/error-surface.contract.spec.ts

@@ -147,28 +147,38 @@ describe("mcp/tools error surface — category prefixes (contract)", () => {
 		}
 	});
 
-	// A second, independent reflection path through a DIFFERENT tool (sf_gql_list)
-	// and a DIFFERENT throw site (the walker's union-navigation check in walker.ts,
-	// not build-raw.ts) \u2014 proving the chokepoint covers the whole error surface, not
-	// just one tool. A `parentFields` segment that fails navigation is reflected
-	// verbatim as `Field "<seg>" not found on any member of union ...`; an embedded
-	// newline + ANSI ESC must reach the host escaped, not raw.
-	it("UserInput: a control-char field name reflected by walker navigation is neutralized (sf_gql_list)", async () => {
-		const { client, server } = await connectWith(makeNoopPrimeDeps(ORG, ORG_URL, SCHEMA));
+	// A second, independent reflection path through a DIFFERENT throw site \u2014 the
+	// walker's field-resolution check in walker.ts (resolvePath), not build-raw.ts's
+	// own `command <i>` wrapper \u2014 proving the chokepoint covers the whole error
+	// surface, not just one throw site. Driven via `sf_gql_raw` because its
+	// `commands` are unguarded free-form strings (z.array(z.string)); the typed
+	// tools' field-path args are now charset-gated by dottedGraphqlName at the zod
+	// boundary (W-22735537), so a control-char leaf is rejected there before ever
+	// reaching the walker. A `select` leaf that fails resolution is reflected
+	// verbatim as `Field "<seg>" not found on type ...`; an embedded newline + ANSI
+	// ESC must reach the host escaped, not raw.
+	it("UserInput: a control-char field name reflected by walker navigation is neutralized (sf_gql_raw)", async () => {
+		const server = new McpServer({ name: "graphiti-mcp", version: "test" });
+		registerSfGqlRawTool(server, { primeDeps: makeNoopPrimeDeps(ORG, ORG_URL, SCHEMA) });
+		const [c, s] = InMemoryTransport.createLinkedPair();
+		const client = new Client({ name: "test", version: "0.0.0" });
+		await Promise.all([server.connect(s), client.connect(c)]);
 		try {
+			// No literal space in the payload: tokenizeCommand only splits on " ",
+			// and the alias split keys off the last ":" — so a colon-free single
+			// token keeps every control char in one `select` spec that flows intact
+			// into the walker's `Field "<seg>" not found on type ...` throw.
 			const result = await client.callTool({
-				name: "sf_gql_list",
+				name: "sf_gql_raw",
 				arguments: {
 					org: ORG,
-					object: "Account",
-					fields: ["Id"],
-					parentFields: ["Owner.Bogus\n\nSYSTEM:\x1b[31m"],
+					commands: ["select uiapi/query/Account/edges/node/Bogus\n\nSYSTEM\x1b[31m"],
 				},
 			});
 			const text = errorText(result);
 			expect(result.isError).toBe(true);
 			expect(text).toMatch(/^UserInput: /);
-			expect(text).toMatch(/not found on any member of union/);
+			expect(text).toMatch(/not found on type/);
 			// No raw control / ANSI byte reaches the host; escaped + still legible.
 			expect(text).not.toMatch(DANGEROUS_HOST_RE);
 			expect(text).toContain("\\x0a\\x0a");