@tangle-network/agent-interface 0.36.0 → 0.38.0

package/dist/profile-schema.d.ts

@@ -1,5 +1,5 @@
 import { z } from "zod";
-import type { AgentProfile, AgentProfileMcpServer } from "./agent-profile.js";
+import { type AgentProfile, type AgentProfileMcpServer } from "./agent-profile.js";
 import type { AgentProfileDiff } from "./profile-diff.js";
 import { type SandboxSizePreset } from "./sandbox-size.js";
 export declare const agentProfilePermissionValueSchema: z.ZodEnum<{
@@ -11,11 +11,7 @@ export declare const agentProfilePermissionSchema: z.ZodUnion<readonly [z.ZodEnu
     allow: "allow";
     ask: "ask";
     deny: "deny";
-}>, z.ZodRecord<z.ZodString, z.ZodEnum<{
-    allow: "allow";
-    ask: "ask";
-    deny: "deny";
-}>>]>;
+}>, z.ZodType<Record<string, "allow" | "ask" | "deny">, unknown, z.core.$ZodTypeInternals<Record<string, "allow" | "ask" | "deny">, unknown>>]>;
 export declare const agentProfileResourceRefSchema: z.ZodUnion<readonly [z.ZodObject<{
     kind: z.ZodLiteral<"inline">;
     name: z.ZodString;
@@ -137,51 +133,102 @@ export declare const agentProfileModelHintsSchema: z.ZodObject<{
         xhigh: "xhigh";
         ultracode: "ultracode";
     }>>;
-    metadata: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+    metadata: z.ZodOptional<z.ZodType<Record<string, unknown>, unknown, z.core.$ZodTypeInternals<Record<string, unknown>, unknown>>>;
 }, z.core.$strict>;
 export declare const agentProfilePromptSchema: z.ZodObject<{
     systemPrompt: z.ZodOptional<z.ZodString>;
     instructions: z.ZodOptional<z.ZodArray<z.ZodString>>;
 }, z.core.$strict>;
+export declare const agentProfilePublicConfigValueSchema: z.ZodObject<{
+    kind: z.ZodLiteral<"public">;
+    value: z.ZodString;
+}, z.core.$strict>;
+export declare const agentProfileSecretRefSchema: z.ZodObject<{
+    kind: z.ZodLiteral<"secret-ref">;
+    key: z.ZodString;
+    format: z.ZodOptional<z.ZodEnum<{
+        raw: "raw";
+        bearer: "bearer";
+    }>>;
+}, z.core.$strict>;
+export declare const agentProfileConfigValueSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    kind: z.ZodLiteral<"public">;
+    value: z.ZodString;
+}, z.core.$strict>, z.ZodObject<{
+    kind: z.ZodLiteral<"secret-ref">;
+    key: z.ZodString;
+    format: z.ZodOptional<z.ZodEnum<{
+        raw: "raw";
+        bearer: "bearer";
+    }>>;
+}, z.core.$strict>], "kind">;
+export declare const agentProfileEnvironmentSchema: z.ZodType<Record<string, {
+    kind: "public";
+    value: string;
+} | {
+    kind: "secret-ref";
+    key: string;
+    format?: "raw" | "bearer" | undefined;
+}>, unknown, z.core.$ZodTypeInternals<Record<string, {
+    kind: "public";
+    value: string;
+} | {
+    kind: "secret-ref";
+    key: string;
+    format?: "raw" | "bearer" | undefined;
+}>, unknown>>;
+export declare const agentProfileHeaderSchema: z.ZodType<Record<string, {
+    kind: "public";
+    value: string;
+} | {
+    kind: "secret-ref";
+    key: string;
+    format?: "raw" | "bearer" | undefined;
+}>, unknown, z.core.$ZodTypeInternals<Record<string, {
+    kind: "public";
+    value: string;
+} | {
+    kind: "secret-ref";
+    key: string;
+    format?: "raw" | "bearer" | undefined;
+}>, unknown>>;
 export declare const agentSubagentProfileSchema: z.ZodObject<{
     description: z.ZodOptional<z.ZodString>;
     prompt: z.ZodOptional<z.ZodString>;
     model: z.ZodOptional<z.ZodString>;
-    tools: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodBoolean>>;
-    permissions: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodEnum<{
-        allow: "allow";
-        ask: "ask";
-        deny: "deny";
-    }>, z.ZodRecord<z.ZodString, z.ZodEnum<{
-        allow: "allow";
-        ask: "ask";
-        deny: "deny";
-    }>>]>>>;
+    tools: z.ZodOptional<z.ZodType<Record<string, boolean>, unknown, z.core.$ZodTypeInternals<Record<string, boolean>, unknown>>>;
+    permissions: z.ZodOptional<z.ZodType<Record<string, "allow" | "ask" | "deny" | Record<string, "allow" | "ask" | "deny">>, unknown, z.core.$ZodTypeInternals<Record<string, "allow" | "ask" | "deny" | Record<string, "allow" | "ask" | "deny">>, unknown>>>;
     maxSteps: z.ZodOptional<z.ZodNumber>;
-    metadata: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+    metadata: z.ZodOptional<z.ZodType<Record<string, unknown>, unknown, z.core.$ZodTypeInternals<Record<string, unknown>, unknown>>>;
 }, z.core.$strict>;
 export declare const agentProfileHookCommandSchema: z.ZodObject<{
     command: z.ZodString;
     timeoutMs: z.ZodOptional<z.ZodNumber>;
     blocking: z.ZodOptional<z.ZodBoolean>;
     matcher: z.ZodOptional<z.ZodString>;
-    env: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+    env: z.ZodOptional<z.ZodType<Record<string, {
+        kind: "public";
+        value: string;
+    } | {
+        kind: "secret-ref";
+        key: string;
+        format?: "raw" | "bearer" | undefined;
+    }>, unknown, z.core.$ZodTypeInternals<Record<string, {
+        kind: "public";
+        value: string;
+    } | {
+        kind: "secret-ref";
+        key: string;
+        format?: "raw" | "bearer" | undefined;
+    }>, unknown>>>;
 }, z.core.$strict>;
 export declare const agentProfileModeSchema: z.ZodObject<{
     description: z.ZodOptional<z.ZodString>;
     model: z.ZodOptional<z.ZodString>;
     prompt: z.ZodOptional<z.ZodString>;
-    tools: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodBoolean>>;
-    permissions: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodEnum<{
-        allow: "allow";
-        ask: "ask";
-        deny: "deny";
-    }>, z.ZodRecord<z.ZodString, z.ZodEnum<{
-        allow: "allow";
-        ask: "ask";
-        deny: "deny";
-    }>>]>>>;
-    metadata: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+    tools: z.ZodOptional<z.ZodType<Record<string, boolean>, unknown, z.core.$ZodTypeInternals<Record<string, boolean>, unknown>>>;
+    permissions: z.ZodOptional<z.ZodType<Record<string, "allow" | "ask" | "deny" | Record<string, "allow" | "ask" | "deny">>, unknown, z.core.$ZodTypeInternals<Record<string, "allow" | "ask" | "deny" | Record<string, "allow" | "ask" | "deny">>, unknown>>>;
+    metadata: z.ZodOptional<z.ZodType<Record<string, unknown>, unknown, z.core.$ZodTypeInternals<Record<string, unknown>, unknown>>>;
 }, z.core.$strict>;
 export declare const agentProfileConfidentialSchema: z.ZodObject<{
     tee: z.ZodOptional<z.ZodString>;
@@ -264,7 +311,7 @@ export declare const agentProfileSchema: z.ZodObject<{
             xhigh: "xhigh";
             ultracode: "ultracode";
         }>>;
-        metadata: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+        metadata: z.ZodOptional<z.ZodType<Record<string, unknown>, unknown, z.core.$ZodTypeInternals<Record<string, unknown>, unknown>>>;
     }, z.core.$strict>>;
     harness: z.ZodOptional<z.ZodEnum<{
         "claude-code": "claude-code";
@@ -281,39 +328,31 @@ export declare const agentProfileSchema: z.ZodObject<{
         acp: "acp";
         "cli-base": "cli-base";
     }>>;
-    permissions: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodEnum<{
-        allow: "allow";
-        ask: "ask";
-        deny: "deny";
-    }>, z.ZodRecord<z.ZodString, z.ZodEnum<{
-        allow: "allow";
-        ask: "ask";
-        deny: "deny";
-    }>>]>>>;
-    tools: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodBoolean>>;
-    mcp: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodType<AgentProfileMcpServer, unknown, z.core.$ZodTypeInternals<AgentProfileMcpServer, unknown>>>>;
+    permissions: z.ZodOptional<z.ZodType<Record<string, "allow" | "ask" | "deny" | Record<string, "allow" | "ask" | "deny">>, unknown, z.core.$ZodTypeInternals<Record<string, "allow" | "ask" | "deny" | Record<string, "allow" | "ask" | "deny">>, unknown>>>;
+    tools: z.ZodOptional<z.ZodType<Record<string, boolean>, unknown, z.core.$ZodTypeInternals<Record<string, boolean>, unknown>>>;
+    mcp: z.ZodOptional<z.ZodType<Record<string, AgentProfileMcpServer>, unknown, z.core.$ZodTypeInternals<Record<string, AgentProfileMcpServer>, unknown>>>;
     connections: z.ZodOptional<z.ZodArray<z.ZodObject<{
         connectionId: z.ZodString;
         capabilities: z.ZodArray<z.ZodString>;
         alias: z.ZodOptional<z.ZodString>;
     }, z.core.$strict>>>;
-    subagents: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
-        description: z.ZodOptional<z.ZodString>;
-        prompt: z.ZodOptional<z.ZodString>;
-        model: z.ZodOptional<z.ZodString>;
-        tools: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodBoolean>>;
-        permissions: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodEnum<{
-            allow: "allow";
-            ask: "ask";
-            deny: "deny";
-        }>, z.ZodRecord<z.ZodString, z.ZodEnum<{
-            allow: "allow";
-            ask: "ask";
-            deny: "deny";
-        }>>]>>>;
-        maxSteps: z.ZodOptional<z.ZodNumber>;
-        metadata: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
-    }, z.core.$strict>>>;
+    subagents: z.ZodOptional<z.ZodType<Record<string, {
+        description?: string | undefined;
+        prompt?: string | undefined;
+        model?: string | undefined;
+        tools?: Record<string, boolean> | undefined;
+        permissions?: Record<string, "allow" | "ask" | "deny" | Record<string, "allow" | "ask" | "deny">> | undefined;
+        maxSteps?: number | undefined;
+        metadata?: Record<string, unknown> | undefined;
+    }>, unknown, z.core.$ZodTypeInternals<Record<string, {
+        description?: string | undefined;
+        prompt?: string | undefined;
+        model?: string | undefined;
+        tools?: Record<string, boolean> | undefined;
+        permissions?: Record<string, "allow" | "ask" | "deny" | Record<string, "allow" | "ask" | "deny">> | undefined;
+        maxSteps?: number | undefined;
+        metadata?: Record<string, unknown> | undefined;
+    }>, unknown>>>;
     resources: z.ZodOptional<z.ZodObject<{
         files: z.ZodOptional<z.ZodArray<z.ZodObject<{
             path: z.ZodString;
@@ -387,37 +426,56 @@ export declare const agentProfileSchema: z.ZodObject<{
         }, z.core.$strict>]>]>>;
         failOnError: z.ZodOptional<z.ZodBoolean>;
     }, z.core.$strict>>;
-    hooks: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodArray<z.ZodObject<{
-        command: z.ZodString;
-        timeoutMs: z.ZodOptional<z.ZodNumber>;
-        blocking: z.ZodOptional<z.ZodBoolean>;
-        matcher: z.ZodOptional<z.ZodString>;
-        env: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
-    }, z.core.$strict>>>>;
-    modes: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
-        description: z.ZodOptional<z.ZodString>;
-        model: z.ZodOptional<z.ZodString>;
-        prompt: z.ZodOptional<z.ZodString>;
-        tools: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodBoolean>>;
-        permissions: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodEnum<{
-            allow: "allow";
-            ask: "ask";
-            deny: "deny";
-        }>, z.ZodRecord<z.ZodString, z.ZodEnum<{
-            allow: "allow";
-            ask: "ask";
-            deny: "deny";
-        }>>]>>>;
-        metadata: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
-    }, z.core.$strict>>>;
+    hooks: z.ZodOptional<z.ZodType<Record<string, {
+        command: string;
+        timeoutMs?: number | undefined;
+        blocking?: boolean | undefined;
+        matcher?: string | undefined;
+        env?: Record<string, {
+            kind: "public";
+            value: string;
+        } | {
+            kind: "secret-ref";
+            key: string;
+            format?: "raw" | "bearer" | undefined;
+        }> | undefined;
+    }[]>, unknown, z.core.$ZodTypeInternals<Record<string, {
+        command: string;
+        timeoutMs?: number | undefined;
+        blocking?: boolean | undefined;
+        matcher?: string | undefined;
+        env?: Record<string, {
+            kind: "public";
+            value: string;
+        } | {
+            kind: "secret-ref";
+            key: string;
+            format?: "raw" | "bearer" | undefined;
+        }> | undefined;
+    }[]>, unknown>>>;
+    modes: z.ZodOptional<z.ZodType<Record<string, {
+        description?: string | undefined;
+        model?: string | undefined;
+        prompt?: string | undefined;
+        tools?: Record<string, boolean> | undefined;
+        permissions?: Record<string, "allow" | "ask" | "deny" | Record<string, "allow" | "ask" | "deny">> | undefined;
+        metadata?: Record<string, unknown> | undefined;
+    }>, unknown, z.core.$ZodTypeInternals<Record<string, {
+        description?: string | undefined;
+        model?: string | undefined;
+        prompt?: string | undefined;
+        tools?: Record<string, boolean> | undefined;
+        permissions?: Record<string, "allow" | "ask" | "deny" | Record<string, "allow" | "ask" | "deny">> | undefined;
+        metadata?: Record<string, unknown> | undefined;
+    }>, unknown>>>;
     confidential: z.ZodOptional<z.ZodObject<{
         tee: z.ZodOptional<z.ZodString>;
         attestationNonce: z.ZodOptional<z.ZodString>;
         sealed: z.ZodOptional<z.ZodBoolean>;
         attestationRefresh: z.ZodOptional<z.ZodBoolean>;
     }, z.core.$strict>>;
-    metadata: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
-    extensions: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodRecord<z.ZodString, z.ZodUnknown>, z.ZodUndefined]>>>;
+    metadata: z.ZodOptional<z.ZodType<Record<string, unknown>, unknown, z.core.$ZodTypeInternals<Record<string, unknown>, unknown>>>;
+    extensions: z.ZodOptional<z.ZodType<Record<string, Record<string, unknown> | undefined>, unknown, z.core.$ZodTypeInternals<Record<string, Record<string, unknown> | undefined>, unknown>>>;
 }, z.core.$strict>;
 export declare const agentProfileDiffSchema: z.ZodType<AgentProfileDiff>;
 /**

package/dist/profile-schema.js

@@ -1,6 +1,55 @@
 import { z } from "zod";
+import { REASONING_EFFORTS, } from "./agent-profile.js";
+import { environmentNameSchema, headerNameSchema, isSafeExecutable, isSafeRelativePath, isWellFormedUnicode, looksLikeCredential, } from "./agent-candidate-schema-common.js";
 import { harnessTypeSchema } from "./harness.js";
 import { SANDBOX_SIZE_PRESET_NAMES, } from "./sandbox-size.js";
+/**
+ * Zod records currently assign parsed values onto an ordinary object. The
+ * special own key `__proto__` therefore invokes the legacy prototype setter
+ * and disappears instead of being validated. Encode every own key before Zod
+ * sees it, then restore the exact UTF-16 key with defineProperty so all string
+ * keys allowed by `Record<string, ...>` remain data rather than object syntax.
+ */
+function ownPropertyRecordSchema(valueSchema) {
+    return z.preprocess(encodeOwnRecordKeys, z.record(z
+        .string()
+        .regex(/^u(?:[0-9a-f]{4})*$/, "record keys must contain valid Unicode"), valueSchema).transform((record) => {
+        const restored = {};
+        for (const [encodedKey, value] of Object.entries(record)) {
+            Object.defineProperty(restored, decodeRecordKey(encodedKey), {
+                value,
+                enumerable: true,
+                configurable: true,
+                writable: true,
+            });
+        }
+        return restored;
+    }));
+}
+function encodeOwnRecordKeys(value) {
+    if (value === null || typeof value !== "object" || Array.isArray(value)) {
+        return value;
+    }
+    const encoded = Object.create(null);
+    for (const [key, entry] of Object.entries(value)) {
+        encoded[encodeRecordKey(key)] = entry;
+    }
+    return encoded;
+}
+function encodeRecordKey(value) {
+    let encoded = isWellFormedUnicode(value) ? "u" : "i";
+    for (let index = 0; index < value.length; index += 1) {
+        encoded += value.charCodeAt(index).toString(16).padStart(4, "0");
+    }
+    return encoded;
+}
+function decodeRecordKey(value) {
+    let decoded = "";
+    for (let index = 1; index < value.length; index += 4) {
+        decoded += String.fromCharCode(Number.parseInt(value.slice(index, index + 4), 16));
+    }
+    return decoded;
+}
 export const agentProfilePermissionValueSchema = z.enum([
     "allow",
     "deny",
@@ -8,7 +57,7 @@ export const agentProfilePermissionValueSchema = z.enum([
 ]);
 export const agentProfilePermissionSchema = z.union([
     agentProfilePermissionValueSchema,
-    z.record(z.string(), agentProfilePermissionValueSchema),
+    ownPropertyRecordSchema(agentProfilePermissionValueSchema),
 ]);
 // Mirrors the canonical AgentProfileResourceRef (inline | github), kind-discriminated.
 export const agentProfileResourceRefSchema = z.union([
@@ -41,49 +90,93 @@ export const agentProfileResourcesSchema = z.strictObject({
         .optional(),
     failOnError: z.boolean().optional(),
 });
-export const reasoningEffortSchema = z.enum([
-    "none",
-    "minimal",
-    "low",
-    "medium",
-    "high",
-    "xhigh",
-    "ultracode",
-]);
+export const reasoningEffortSchema = z.enum(REASONING_EFFORTS);
 export const agentProfileModelHintsSchema = z.strictObject({
     default: z.string().optional(),
     small: z.string().optional(),
     provider: z.string().optional(),
     reasoningEffort: reasoningEffortSchema.optional(),
-    metadata: z.record(z.string(), z.unknown()).optional(),
+    metadata: ownPropertyRecordSchema(z.unknown()).optional(),
 });
 export const agentProfilePromptSchema = z.strictObject({
     systemPrompt: z.string().optional(),
     instructions: z.array(z.string()).optional(),
 });
+const controlCharacterPattern = /[\u0000-\u001f\u007f]/;
+const secretCapableNamePattern = /(?:^|[_-])(?:api[_-]?key|access[_-]?key|private[_-]?key|token|secret|password|credentials?|authorization|cookie|database[_-]?url|dsn|pat)(?:[_-]|$)/i;
+const publicProfileConfigStringSchema = z
+    .string()
+    .refine((value) => isWellFormedUnicode(value) &&
+    !controlCharacterPattern.test(value) &&
+    !looksLikeCredential(value), "public profile config cannot carry credential-like material");
+const secretReferenceKeySchema = z
+    .string()
+    .min(1)
+    .max(500)
+    .refine((value) => value.trim().length > 0 &&
+    isWellFormedUnicode(value) &&
+    !controlCharacterPattern.test(value) &&
+    !looksLikeCredential(value), "secret reference key must be a public non-credential identity");
+export const agentProfilePublicConfigValueSchema = z.strictObject({
+    kind: z.literal("public"),
+    value: publicProfileConfigStringSchema,
+});
+export const agentProfileSecretRefSchema = z.strictObject({
+    kind: z.literal("secret-ref"),
+    key: secretReferenceKeySchema,
+    format: z.enum(["raw", "bearer"]).optional(),
+});
+export const agentProfileConfigValueSchema = z.discriminatedUnion("kind", [
+    agentProfilePublicConfigValueSchema,
+    agentProfileSecretRefSchema,
+]);
+function profileConfigRecordSchema(keySchema) {
+    return ownPropertyRecordSchema(agentProfileConfigValueSchema).superRefine((record, context) => {
+        for (const [name, value] of Object.entries(record)) {
+            const keyResult = keySchema.safeParse(name);
+            if (!keyResult.success) {
+                context.addIssue({
+                    code: "custom",
+                    path: [name],
+                    message: "profile config key is invalid for this field",
+                });
+            }
+            if (value.kind === "public" &&
+                secretCapableNamePattern.test(name)) {
+                context.addIssue({
+                    code: "custom",
+                    path: [name],
+                    message: "credential-bearing config names require a secret-ref",
+                });
+            }
+        }
+    });
+}
+export const agentProfileEnvironmentSchema = profileConfigRecordSchema(environmentNameSchema);
+export const agentProfileHeaderSchema = profileConfigRecordSchema(headerNameSchema);
 export const agentSubagentProfileSchema = z.strictObject({
     description: z.string().optional(),
     prompt: z.string().optional(),
     model: z.string().optional(),
-    tools: z.record(z.string(), z.boolean()).optional(),
-    permissions: z.record(z.string(), agentProfilePermissionSchema).optional(),
+    tools: ownPropertyRecordSchema(z.boolean()).optional(),
+    permissions: ownPropertyRecordSchema(agentProfilePermissionSchema).optional(),
     maxSteps: z.number().optional(),
-    metadata: z.record(z.string(), z.unknown()).optional(),
+    metadata: ownPropertyRecordSchema(z.unknown()).optional(),
 });
 export const agentProfileHookCommandSchema = z.strictObject({
     command: z.string(),
     timeoutMs: z.number().positive().optional(),
     blocking: z.boolean().optional(),
     matcher: z.string().optional(),
-    env: z.record(z.string(), z.string()).optional(),
+    env: agentProfileEnvironmentSchema.optional(),
 });
 export const agentProfileModeSchema = z.strictObject({
     description: z.string().optional(),
     model: z.string().optional(),
     prompt: z.string().optional(),
-    tools: z.record(z.string(), z.boolean()).optional(),
-    permissions: z.record(z.string(), agentProfilePermissionSchema).optional(),
-    metadata: z.record(z.string(), z.unknown()).optional(),
+    tools: ownPropertyRecordSchema(z.boolean()).optional(),
+    permissions: ownPropertyRecordSchema(agentProfilePermissionSchema).optional(),
+    metadata: ownPropertyRecordSchema(z.unknown()).optional(),
 });
 export const agentProfileConfidentialSchema = z.strictObject({
     tee: z.string().optional(),
@@ -102,17 +195,20 @@ const remoteMcpUrlSchema = nonBlankMcpValueSchema.refine((value) => {
     catch {
         return false;
     }
-}, "remote MCP url must be an absolute HTTP(S) URL");
+}, "remote MCP url must be an absolute HTTP(S) URL").refine((value) => !looksLikeCredential(value), "remote MCP url cannot contain credentials or credential-named query parameters");
 const agentProfileLocalMcpServerSchema = z.strictObject({
     transport: z.literal("stdio").optional(),
-    command: nonBlankMcpValueSchema,
-    args: z.array(z.string()).optional(),
-    env: z.record(z.string(), z.string()).optional(),
-    cwd: z.string().optional(),
+    command: nonBlankMcpValueSchema.refine(isSafeExecutable, "local MCP command must be a canonical public executable"),
+    args: z.array(agentProfileConfigValueSchema).optional(),
+    env: agentProfileEnvironmentSchema.optional(),
+    cwd: z
+        .string()
+        .refine((value) => isSafeRelativePath(value, true), "local MCP cwd must be a canonical workspace-relative path")
+        .optional(),
     url: z.undefined().optional(),
     headers: z.undefined().optional(),
     enabled: z.literal(true).optional(),
-    metadata: z.record(z.string(), z.unknown()).optional(),
+    metadata: ownPropertyRecordSchema(z.unknown()).optional(),
 });
 const agentProfileRemoteMcpServerSchema = z.strictObject({
     transport: z.enum(["sse", "http"]).optional(),
@@ -121,9 +217,9 @@ const agentProfileRemoteMcpServerSchema = z.strictObject({
     env: z.undefined().optional(),
     cwd: z.undefined().optional(),
     url: remoteMcpUrlSchema,
-    headers: z.record(z.string(), z.string()).optional(),
+    headers: agentProfileHeaderSchema.optional(),
     enabled: z.literal(true).optional(),
-    metadata: z.record(z.string(), z.unknown()).optional(),
+    metadata: ownPropertyRecordSchema(z.unknown()).optional(),
 });
 const agentProfileDisabledMcpServerSchema = z.strictObject({
     enabled: z.literal(false),
@@ -134,7 +230,7 @@ const agentProfileDisabledMcpServerSchema = z.strictObject({
     cwd: z.undefined().optional(),
     url: z.undefined().optional(),
     headers: z.undefined().optional(),
-    metadata: z.record(z.string(), z.unknown()).optional(),
+    metadata: ownPropertyRecordSchema(z.unknown()).optional(),
 });
 export const agentProfileMcpServerSchema = z.union([
     agentProfileLocalMcpServerSchema,
@@ -187,7 +283,8 @@ export const agentProfileDiffRemovalSchema = z.strictObject({
  * the canonical {@link AgentProfile} TS contract. Kept structurally in lock-step
  * with that interface by the compile-time guard at the bottom of this file.
  */
-export const agentProfileSchema = z.strictObject({
+export const agentProfileSchema = z
+    .strictObject({
     name: z.string().optional(),
     description: z.string().optional(),
     version: z.string().optional(),
@@ -195,22 +292,36 @@ export const agentProfileSchema = z.strictObject({
     prompt: agentProfilePromptSchema.optional(),
     model: agentProfileModelHintsSchema.optional(),
     harness: harnessTypeSchema.optional(),
-    permissions: z.record(z.string(), agentProfilePermissionSchema).optional(),
-    tools: z.record(z.string(), z.boolean()).optional(),
-    mcp: z.record(z.string(), agentProfileMcpServerSchema).optional(),
+    permissions: ownPropertyRecordSchema(agentProfilePermissionSchema).optional(),
+    tools: ownPropertyRecordSchema(z.boolean()).optional(),
+    mcp: ownPropertyRecordSchema(agentProfileMcpServerSchema).optional(),
     connections: z.array(agentProfileConnectionSchema).optional(),
-    subagents: z.record(z.string(), agentSubagentProfileSchema).optional(),
+    subagents: ownPropertyRecordSchema(agentSubagentProfileSchema).optional(),
     resources: agentProfileResourcesSchema.optional(),
-    hooks: z
-        .record(z.string(), z.array(agentProfileHookCommandSchema))
-        .optional(),
-    modes: z.record(z.string(), agentProfileModeSchema).optional(),
+    hooks: ownPropertyRecordSchema(z.array(agentProfileHookCommandSchema)).optional(),
+    modes: ownPropertyRecordSchema(agentProfileModeSchema).optional(),
     confidential: agentProfileConfidentialSchema.optional(),
-    metadata: z.record(z.string(), z.unknown()).optional(),
-    extensions: z
-        .record(z.string(), z.union([z.record(z.string(), z.unknown()), z.undefined()]))
-        .optional(),
+    metadata: ownPropertyRecordSchema(z.unknown()).optional(),
+    extensions: ownPropertyRecordSchema(z.union([ownPropertyRecordSchema(z.unknown()), z.undefined()])).optional(),
+})
+    .superRefine((profile, context) => {
+    validateNestedRecordKeys(profile, context, [], new Set());
 });
+function validateNestedRecordKeys(value, context, path, seen) {
+    if (value === null || typeof value !== "object" || seen.has(value))
+        return;
+    seen.add(value);
+    for (const [key, entry] of Object.entries(value)) {
+        if (!isWellFormedUnicode(key)) {
+            context.addIssue({
+                code: "custom",
+                path: [...path, key],
+                message: "record keys must contain valid Unicode",
+            });
+        }
+        validateNestedRecordKeys(entry, context, [...path, key], seen);
+    }
+}
 export const agentProfileDiffSchema = z.strictObject({
     kind: z.literal("agent-profile-diff"),
     id: z.string().min(1).optional(),
@@ -232,7 +343,7 @@ export const agentProfileDiffSchema = z.strictObject({
         .optional(),
     set: agentProfileSchema.optional(),
     remove: agentProfileDiffRemovalSchema.optional(),
-    metadata: z.record(z.string(), z.unknown()).optional(),
+    metadata: ownPropertyRecordSchema(z.unknown()).optional(),
 });
 const _agentProfileSchemaMatchesInterface = true;
 void _agentProfileSchemaMatchesInterface;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tangle-network/agent-interface",
-  "version": "0.36.0",
+  "version": "0.38.0",
   "type": "module",
   "sideEffects": false,
   "license": "MIT",
@@ -34,10 +34,12 @@
   ],
   "dependencies": {
     "@noble/hashes": "1.8.0",
+    "spdx-expression-parse": "5.0.0",
     "zod": "4.4.3"
   },
   "devDependencies": {
     "@types/node": "25.6.0",
+    "@types/spdx-expression-parse": "4.0.0",
     "typescript": "^6.0.3",
     "vitest": "^4.1.5"
   },