@vellumai/assistant 0.10.12 → 0.11.0-staging.1

package/src/tools/shared/filesystem/path-policy.ts

@@ -1,4 +1,5 @@
 import { realpathSync } from "node:fs";
+import { homedir, userInfo } from "node:os";
 import {
   basename,
   dirname,
@@ -8,6 +9,10 @@ import {
   resolve,
 } from "node:path";
 
+import { getIsContainerized } from "../../../config/env-registry.js";
+import { resolveTrailingLinkTarget } from "../../../util/fs-symlinks.js";
+import { getDotEnvPath } from "../../../util/platform.js";
+
 /**
  * Result type shared by both sandbox and host path policies.
  */
@@ -48,12 +53,15 @@ const CONTAINER_WORKSPACE_EXACT = "/workspace";
 /**
  * Resolve symlinks in an absolute path.
  *
- * For an existing path, returns its `realpathSync`. For a path that does not
- * exist yet (e.g. a `file_write` target), walks up to the nearest existing
- * ancestor, resolves that ancestor via `realpathSync`, then re-appends the
- * trailing (non-existent) components — so a symlink anywhere in the existing
- * prefix is still followed. Falls back to the lexical input when nothing on
- * the path resolves (e.g. the path lives on a filesystem this process cannot
+ * A trailing (possibly dangling) symlink chain is followed first — see
+ * {@link resolveTrailingLinkTarget} — so a link whose destination does not
+ * exist yet still reports that destination. For an existing path, returns
+ * its `realpathSync`. For a path that does not exist yet (e.g. a
+ * `file_write` target), walks up to the nearest existing ancestor, resolves
+ * that ancestor via `realpathSync`, then re-appends the trailing
+ * (non-existent) components — so a symlink anywhere in the existing prefix
+ * is still followed. Falls back to the lexical input when nothing on the
+ * path resolves (e.g. the path lives on a filesystem this process cannot
  * see, as with host_file paths proxied to a remote client).
  *
  * Used both for sandbox-boundary enforcement and to canonicalize paths before
@@ -61,7 +69,7 @@ const CONTAINER_WORKSPACE_EXACT = "/workspace";
  * file operation.
  */
 export function resolveRealPath(absolutePath: string): string {
-  let current = absolutePath;
+  let current = resolveTrailingLinkTarget(absolutePath);
   const trailing: string[] = [];
   while (current !== dirname(current)) {
     try {
@@ -79,26 +87,25 @@ export function resolveRealPath(absolutePath: string): string {
 // Sandbox policy
 // ---------------------------------------------------------------------------
 
+interface SandboxTarget {
+  /** Lexically resolved absolute path (boundary-relative input resolved). */
+  resolved: string;
+  /** Symlink-canonicalized form of `resolved`. */
+  realResolved: string;
+  /** Symlink-canonicalized boundary directory. */
+  realBoundary: string;
+}
+
 /**
- * Resolve a user-supplied path against a boundary directory and verify
- * that the result stays within it.
- *
- * For existing paths, symlinks are resolved via realpathSync so a symlink
- * pointing outside the boundary is caught. For new paths (e.g. file_write),
- * pass `mustExist: false` - the nearest existing ancestor directory is
- * resolved via realpathSync to catch symlinks in parent dirs.
- *
- * Paths starting with `/workspace/` are treated as container-scoped and
- * remapped relative to the boundary directory (the Docker sandbox mounts
- * the host workspace at /workspace).
+ * Resolve a user-supplied path against the boundary directory: apply the
+ * container /workspace remap, resolve to an absolute path, and canonicalize
+ * symlinks on both the target and the boundary.
  */
-export function sandboxPolicy(
+function resolveSandboxTarget(
   rawPath: string,
   boundaryDir: string,
-  options?: { mustExist?: boolean },
-): PathResult {
-  const mustExist = options?.mustExist ?? true;
-
+  mustExist: boolean,
+): SandboxTarget {
   // Remap container-scoped /workspace paths to the host boundary dir.
   // Skip remapping if the path already starts with boundaryDir to avoid
   // double-nesting (e.g. /workspace/project/file.ts → /workspace/project/project/file.ts
@@ -114,19 +121,24 @@ export function sandboxPolicy(
 
   const resolved = resolve(boundaryDir, effectivePath);
 
+  // Follow a trailing (possibly dangling) symlink chain first — a write
+  // through a dangling link creates the link's destination, so the
+  // containment and denial checks below must run against it.
+  const linkTarget = resolveTrailingLinkTarget(resolved);
+
   // Resolve symlinks to catch symlink-based escapes.
   // For mustExist=false, walk up to the nearest existing ancestor and
   // resolve it, then re-append the trailing components.
-  let realResolved = resolved;
+  let realResolved = linkTarget;
   if (mustExist) {
     try {
-      realResolved = realpathSync(resolved);
+      realResolved = realpathSync(linkTarget);
     } catch {
       // File doesn't exist - will be caught by the tool's own existence check
-      realResolved = resolved;
+      realResolved = linkTarget;
     }
   } else {
-    realResolved = resolveRealPath(resolved);
+    realResolved = resolveRealPath(linkTarget);
   }
 
   // Resolve the boundary directory's real path too (in case it's a symlink)
@@ -137,26 +149,220 @@ export function sandboxPolicy(
     realBoundary = boundaryDir;
   }
 
-  const rel = relative(realBoundary, realResolved);
-  if (rel.startsWith("..") || resolve(realBoundary, rel) !== realResolved) {
-    return {
-      ok: false,
-      reason: "out_of_bounds",
-      error: `Path "${rawPath}" resolves to "${realResolved}" which is outside the working directory "${realBoundary}"`,
-    };
-  }
+  return { resolved, realResolved, realBoundary };
+}
 
-  // Check both the logical path and the symlink-resolved path so a symlink
-  // with a non-denied name pointing at a denied file is still caught.
-  if (isDeniedBasename(resolved) || isDeniedBasename(realResolved)) {
+/** Whether the canonicalized target escapes the canonicalized boundary. */
+function isOutOfBounds(target: SandboxTarget): boolean {
+  const rel = relative(target.realBoundary, target.realResolved);
+  return (
+    rel.startsWith("..") ||
+    resolve(target.realBoundary, rel) !== target.realResolved
+  );
+}
+
+function outOfBoundsFailure(
+  rawPath: string,
+  target: SandboxTarget,
+): PathResult {
+  return {
+    ok: false,
+    reason: "out_of_bounds",
+    error: `Path "${rawPath}" resolves to "${target.realResolved}" which is outside the working directory "${target.realBoundary}"`,
+  };
+}
+
+// The denied check covers both the logical path and the symlink-resolved
+// path so a symlink with a non-denied name pointing at a denied file is
+// still caught.
+function deniedFailure(target: SandboxTarget): PathResult | null {
+  if (
+    isDeniedBasename(target.resolved) ||
+    isDeniedBasename(target.realResolved)
+  ) {
     return {
       ok: false,
       reason: "denied",
-      error: `Access to "${basename(resolved)}" is denied`,
+      error: `Access to "${basename(target.resolved)}" is denied`,
     };
   }
+  return null;
+}
+
+function safeUserInfoHomedir(): string {
+  try {
+    return userInfo().homedir;
+  } catch {
+    return "";
+  }
+}
+
+const SECURITY_DIR_ENV_VARS = [
+  "GATEWAY_SECURITY_DIR",
+  "CREDENTIAL_SECURITY_DIR",
+] as const;
+
+/**
+ * Secret-bearing paths the file tools must never touch, in any policy:
+ *
+ * - Gateway trust material and token signing keys (GATEWAY_SECURITY_DIR)
+ *   and CES credential keys (CREDENTIAL_SECURITY_DIR — `keys.enc`,
+ *   `store.key`). The daemon must never read from or write to them — that
+ *   data flows through the gateway and CES APIs (root AGENTS.md). The
+ *   env-based resolution mirrors the owning services', since the
+ *   cross-package import boundary bars importing it; the shared bare-metal
+ *   default `<home>/.vellum/protected` is always denied. Only absolute
+ *   overrides join the set — a relative override is unmirrorable and
+ *   disables the host fallback outright (see
+ *   {@link securityDirConfigMirrorable}).
+ * - The daemon dotenv (`<vellumRoot>/.env`), which carries provider
+ *   secrets.
+ */
+function getProtectedServicePaths(): string[] {
+  const paths = new Set<string>();
+  paths.add(
+    join(
+      process.env.HOME || safeUserInfoHomedir() || homedir(),
+      ".vellum",
+      "protected",
+    ),
+  );
+  for (const name of SECURITY_DIR_ENV_VARS) {
+    const override = process.env[name]?.trim();
+    if (override && isAbsolute(override)) {
+      paths.add(resolve(override));
+    }
+  }
+  paths.add(getDotEnvPath());
+  return [...paths];
+}
+
+/**
+ * Whether the security-dir deny set can be mirrored faithfully. A relative
+ * override resolves against the owning service's cwd, which this process
+ * cannot know — the true directory would be absent from the deny set, so
+ * the host fallback fails closed to the hard boundary instead.
+ */
+function securityDirConfigMirrorable(): boolean {
+  return SECURITY_DIR_ENV_VARS.every((name) => {
+    const override = process.env[name]?.trim();
+    return !override || isAbsolute(override);
+  });
+}
 
-  return { ok: true, resolved };
+function isWithinDir(path: string, dir: string): boolean {
+  const normalized = dir !== "/" && dir.endsWith("/") ? dir.slice(0, -1) : dir;
+  if (normalized === "/") {
+    return isAbsolute(path);
+  }
+  return path === normalized || path.startsWith(normalized + "/");
+}
+
+/**
+ * Deny a target that lands in (or on) a protected service path. Both the
+ * lexical and symlink-resolved target are checked against both the lexical
+ * and symlink-resolved protected path, so neither a symlinked target nor a
+ * symlinked directory prefix can mask the hit.
+ */
+function securityDirDenial(target: SandboxTarget): PathResult | null {
+  for (const protectedPath of getProtectedServicePaths()) {
+    const realProtectedPath = resolveRealPath(protectedPath);
+    const hit = [target.resolved, target.realResolved].some(
+      (path) =>
+        isWithinDir(path, protectedPath) ||
+        isWithinDir(path, realProtectedPath),
+    );
+    if (hit) {
+      return {
+        ok: false,
+        reason: "denied",
+        error: "Access to the service security directory is denied",
+      };
+    }
+  }
+  return null;
+}
+
+function evaluateSandboxPolicy(
+  rawPath: string,
+  boundaryDir: string,
+  options: { mustExist?: boolean } | undefined,
+  allowOutOfBounds: boolean,
+): PathResult {
+  const target = resolveSandboxTarget(
+    rawPath,
+    boundaryDir,
+    options?.mustExist ?? true,
+  );
+
+  if (!allowOutOfBounds && isOutOfBounds(target)) {
+    return outOfBoundsFailure(rawPath, target);
+  }
+
+  // Applied unconditionally — even a boundary configured to contain a
+  // service security dir must not expose it through the file tools.
+  const securityDenied = securityDirDenial(target);
+  if (securityDenied) {
+    return securityDenied;
+  }
+
+  const denied = deniedFailure(target);
+  if (denied) {
+    return denied;
+  }
+
+  return { ok: true, resolved: target.resolved };
+}
+
+/**
+ * Resolve a user-supplied path against a boundary directory and verify
+ * that the result stays within it.
+ *
+ * For existing paths, symlinks are resolved via realpathSync so a symlink
+ * pointing outside the boundary is caught. For new paths (e.g. file_write),
+ * pass `mustExist: false` - the nearest existing ancestor directory is
+ * resolved via realpathSync to catch symlinks in parent dirs.
+ *
+ * Paths starting with `/workspace/` are treated as container-scoped and
+ * remapped relative to the boundary directory (the Docker sandbox mounts
+ * the host workspace at /workspace).
+ */
+export function sandboxPolicy(
+  rawPath: string,
+  boundaryDir: string,
+  options?: { mustExist?: boolean },
+): PathResult {
+  return evaluateSandboxPolicy(rawPath, boundaryDir, options, false);
+}
+
+/**
+ * Sandbox policy that permits out-of-workspace targets on non-containerized
+ * installs.
+ *
+ * Identical to {@link sandboxPolicy} for in-bounds targets. A target that
+ * escapes the boundary is allowed with host-style validation: the basename
+ * denylist still applies to both the logical and symlink-resolved paths, and
+ * the service security directories stay denied outright.
+ * The permission lane runs before tool execution and classifies
+ * out-of-workspace file operations as elevated risk (see the gateway
+ * FileRiskClassifier), so an escape reaching this policy has already been
+ * threshold-approved or user-approved.
+ *
+ * In containerized mode the boundary stays hard: the container filesystem is
+ * not the host, and the host_file_* proxy tools are the escape hatch for the
+ * guardian's device.
+ */
+export function sandboxPolicyWithHostFallback(
+  rawPath: string,
+  boundaryDir: string,
+  options?: { mustExist?: boolean },
+): PathResult {
+  return evaluateSandboxPolicy(
+    rawPath,
+    boundaryDir,
+    options,
+    !getIsContainerized() && securityDirConfigMirrorable(),
+  );
 }
 
 // ---------------------------------------------------------------------------

package/src/tools/shared/zod-tool-schema.ts

@@ -0,0 +1,117 @@
+import { z } from "zod";
+
+import type { ToolExecutionResult } from "../types.js";
+
+/**
+ * Derive a tool's LLM-facing `input_schema` from its Zod input schema, so the
+ * schema the model sees and the validation the executor runs share one source
+ * and cannot drift (`TOOL_INPUT_SCHEMAS` in `../tool-input-schemas.ts` holds
+ * the executor-side half).
+ *
+ * Conversion uses Zod 4's native `z.toJSONSchema` (mirroring
+ * `workflows/leaf-runner.ts`), then adjusts the output for the tool-definition
+ * context:
+ *
+ * - The `$schema` marker is dropped — tool definitions don't carry one.
+ * - `additionalProperties` values of `false` / `{}` are dropped. They are
+ *   authoring artifacts of `z.object` / `z.looseObject`, not intentional
+ *   contract: runtime validation never rejects unknown keys (registry schemas
+ *   must tolerate injected fields like `activity`, see
+ *   `schema-transforms.ts`), so advertising `additionalProperties: false`
+ *   would claim a strictness the runtime doesn't enforce.
+ *
+ * `advertiseRequired` names fields to mark required in the advertised schema
+ * even though the Zod schema treats them as optional. This is the one
+ * sanctioned divergence, and only in the tolerant direction: the model is told
+ * to always send the field (e.g. `activity`, which drives status UX), but a
+ * call that omits it still executes rather than failing on a field the tool
+ * doesn't need.
+ */
+export function toToolInputSchema(
+  schema: z.ZodType,
+  opts?: { advertiseRequired?: readonly string[] },
+): Record<string, unknown> {
+  const json = z.toJSONSchema(schema, { unrepresentable: "any" }) as Record<
+    string,
+    unknown
+  >;
+  delete json.$schema;
+  stripPermissiveAdditionalProperties(json);
+
+  for (const field of opts?.advertiseRequired ?? []) {
+    const required = Array.isArray(json.required) ? json.required : [];
+    if (!required.includes(field)) {
+      json.required = [...required, field];
+    }
+  }
+  return json;
+}
+
+/**
+ * Recursively remove `additionalProperties` keys whose value is `false` or the
+ * empty schema `{}`. A real subschema (e.g. `additionalProperties:
+ * { type: "string" }` from `z.record`) is left intact.
+ */
+function stripPermissiveAdditionalProperties(node: unknown): void {
+  if (Array.isArray(node)) {
+    for (const entry of node) {
+      stripPermissiveAdditionalProperties(entry);
+    }
+    return;
+  }
+  if (node === null || typeof node !== "object") {
+    return;
+  }
+  const record = node as Record<string, unknown>;
+  const ap = record.additionalProperties;
+  if (
+    ap === false ||
+    (typeof ap === "object" &&
+      ap !== null &&
+      !Array.isArray(ap) &&
+      Object.keys(ap).length === 0)
+  ) {
+    delete record.additionalProperties;
+  }
+  for (const value of Object.values(record)) {
+    stripPermissiveAdditionalProperties(value);
+  }
+}
+
+/**
+ * Wrap an optional field's schema so an explicit `null` parses as "omitted"
+ * (`undefined`). Models routinely send `null` for optional fields they mean
+ * to skip, and executors read such fields via `input.x ?? fallback`, where
+ * null and absent are equivalent — validation must not reject null there.
+ * The derived JSON Schema is the inner schema's (the null-tolerance is
+ * runtime slack, not advertised contract).
+ */
+export function nullAsOmitted<T extends z.ZodType>(schema: T) {
+  return z.preprocess((value) => value ?? undefined, schema.optional());
+}
+
+/**
+ * Render a failed tool-input parse as a compact `field: message` summary the
+ * model can correct from. Mirrors `runtime/routes/parse-body.ts`.
+ */
+export function formatToolInputError(
+  toolName: string,
+  error: z.ZodError,
+): string {
+  const detail = error.issues
+    .map((issue) => `${issue.path.join(".") || "(input)"}: ${issue.message}`)
+    .join("; ");
+  return `Invalid input for tool "${toolName}": ${detail}. Fix the listed field(s) and retry the call.`;
+}
+
+/**
+ * Failed-parse tool result for executors that validate their own input (the
+ * pre-execution gate in `ToolApprovalHandler` produces the same message, so
+ * the error reads identically whichever layer catches it first).
+ */
+export function invalidToolInputResult(
+  toolName: string,
+  error: z.ZodError,
+): ToolExecutionResult {
+  return { content: formatToolInputError(toolName, error), isError: true };
+}

package/src/tools/subagent/abort.ts

@@ -1,15 +1,23 @@
 import { getSubagentManager } from "../../subagent/index.js";
+import { invalidToolInputResult } from "../shared/zod-tool-schema.js";
 import type { ToolContext, ToolExecutionResult } from "../types.js";
-import { resolveSubagentId } from "./resolve.js";
+import { resolveSubagentId, subagentRefInputSchema } from "./resolve.js";
+
+export const subagentAbortInputSchema = subagentRefInputSchema;
 
 export async function executeSubagentAbort(
   input: Record<string, unknown>,
   context: ToolContext,
 ): Promise<ToolExecutionResult> {
-  const subagentId = resolveSubagentId(input, context);
-  if (!subagentId && input.label) {
+  const parsedInput = subagentAbortInputSchema.safeParse(input);
+  if (!parsedInput.success) {
+    return invalidToolInputResult("subagent_abort", parsedInput.error);
+  }
+  const parsed = parsedInput.data;
+  const subagentId = resolveSubagentId(parsed, context);
+  if (!subagentId && parsed.label) {
     return {
-      content: `No subagent found with label "${input.label as string}".`,
+      content: `No subagent found with label "${parsed.label}".`,
       isError: true,
     };
   }

package/src/tools/subagent/consult-deadline.ts

@@ -29,8 +29,12 @@ export function createConsultDeadline(opts: {
 
   const recordProgress = (): void => {
     // Once aborted, don't re-arm — the consult is already being torn down.
-    if (controller.signal.aborted) return;
-    if (idleTimer) clearTimeout(idleTimer);
+    if (controller.signal.aborted) {
+      return;
+    }
+    if (idleTimer) {
+      clearTimeout(idleTimer);
+    }
     idleTimer = setTimeout(() => controller.abort(), opts.idleMs);
   };
 
@@ -41,7 +45,9 @@ export function createConsultDeadline(opts: {
   recordProgress();
 
   const dispose = (): void => {
-    if (idleTimer) clearTimeout(idleTimer);
+    if (idleTimer) {
+      clearTimeout(idleTimer);
+    }
     clearTimeout(maxTimer);
   };
 

package/src/tools/subagent/message.ts

@@ -1,17 +1,33 @@
+import { z } from "zod";
+
 import { getSubagentManager } from "../../subagent/index.js";
+import {
+  invalidToolInputResult,
+  nullAsOmitted,
+} from "../shared/zod-tool-schema.js";
 import type { ToolContext, ToolExecutionResult } from "../types.js";
-import { resolveSubagentId } from "./resolve.js";
+import { resolveSubagentId, subagentRefInputSchema } from "./resolve.js";
+
+export const subagentMessageInputSchema = z.looseObject({
+  ...subagentRefInputSchema.shape,
+  content: nullAsOmitted(z.string()),
+});
 
 export async function executeSubagentMessage(
   input: Record<string, unknown>,
   context: ToolContext,
 ): Promise<ToolExecutionResult> {
-  const subagentId = resolveSubagentId(input, context);
-  const content = input.content as string;
+  const parsedInput = subagentMessageInputSchema.safeParse(input);
+  if (!parsedInput.success) {
+    return invalidToolInputResult("subagent_message", parsedInput.error);
+  }
+  const parsed = parsedInput.data;
+  const subagentId = resolveSubagentId(parsed, context);
+  const content = parsed.content;
 
-  if (!subagentId && input.label) {
+  if (!subagentId && parsed.label) {
     return {
-      content: `No subagent found with label "${input.label as string}".`,
+      content: `No subagent found with label "${parsed.label}".`,
       isError: true,
     };
   }

package/src/tools/subagent/notify-parent.ts

@@ -1,17 +1,56 @@
+import { z } from "zod";
+
 import { RiskLevel } from "../../permissions/types.js";
 import { notifyParentFromChild } from "../../subagent/notify.js";
+import {
+  invalidToolInputResult,
+  nullAsOmitted,
+  toToolInputSchema,
+} from "../shared/zod-tool-schema.js";
 import type {
   ToolContext,
   ToolDefinition,
   ToolExecutionResult,
 } from "../types.js";
 
+/**
+ * Model-input schema, the single source for both runtime validation (via
+ * `TOOL_INPUT_SCHEMAS`) and the advertised `input_schema` below. `message`
+ * stays runtime-optional (`advertiseRequired`) so the bespoke
+ * '"message" is required.' check keeps its test-asserted error; `urgency`
+ * catches to `undefined` so a malformed value degrades to "info" instead of
+ * forwarding garbage to the parent's notification.
+ */
+export const notifyParentInputSchema = z.looseObject({
+  message: nullAsOmitted(
+    z.string().describe("The notification content for the parent."),
+  ),
+  urgency: z
+    .enum(["info", "important", "blocked"])
+    .describe(
+      "'info' for progress updates, 'important' for key findings, 'blocked' when you need guidance.",
+    )
+    .optional()
+    .catch(undefined),
+  activity: z
+    .string()
+    .describe(
+      "Brief non-technical explanation of what you are doing and why, shown as a status update.",
+    )
+    .optional()
+    .catch(undefined),
+});
+
 export async function executeSubagentNotifyParent(
   input: Record<string, unknown>,
   context: ToolContext,
 ): Promise<ToolExecutionResult> {
-  const message = input.message as string;
-  const urgency = (input.urgency as string) || "info";
+  const parsed = notifyParentInputSchema.safeParse(input);
+  if (!parsed.success) {
+    return invalidToolInputResult("notify_parent", parsed.error);
+  }
+  const message = parsed.data.message;
+  const urgency = parsed.data.urgency ?? "info";
 
   if (!message) {
     return { content: '"message" is required.', isError: true };
@@ -41,27 +80,9 @@ export const notifyParentTool = {
   executionTarget: "sandbox",
   defaultRiskLevel: RiskLevel.Low,
 
-  input_schema: {
-    type: "object",
-    properties: {
-      message: {
-        type: "string",
-        description: "The notification content for the parent.",
-      },
-      urgency: {
-        type: "string",
-        enum: ["info", "important", "blocked"],
-        description:
-          "'info' for progress updates, 'important' for key findings, 'blocked' when you need guidance.",
-      },
-      activity: {
-        type: "string",
-        description:
-          "Brief non-technical explanation of what you are doing and why, shown as a status update.",
-      },
-    },
-    required: ["message", "activity"],
-  },
+  input_schema: toToolInputSchema(notifyParentInputSchema, {
+    advertiseRequired: ["message", "activity"],
+  }),
 
   async execute(
     input: Record<string, unknown>,

package/src/tools/subagent/read.ts

@@ -1,17 +1,28 @@
 import { getMessages } from "../../persistence/conversation-crud.js";
 import { extractTextFromStoredMessageContent } from "../../persistence/message-content.js";
 import { getSubagentManager, TERMINAL_STATUSES } from "../../subagent/index.js";
+import { invalidToolInputResult } from "../shared/zod-tool-schema.js";
 import type { ToolContext, ToolExecutionResult } from "../types.js";
-import { resolveSubagentId } from "./resolve.js";
+import { resolveSubagentId, subagentRefInputSchema } from "./resolve.js";
+
+// `last_n` is deliberately UNDECLARED (loose passthrough): the executor's
+// typeof-guarded read below ignores it when malformed — including non-integer
+// numbers the advertised `integer` type wouldn't admit.
+export const subagentReadInputSchema = subagentRefInputSchema;
 
 export async function executeSubagentRead(
   input: Record<string, unknown>,
   context: ToolContext,
 ): Promise<ToolExecutionResult> {
-  const subagentId = resolveSubagentId(input, context);
-  if (!subagentId && input.label) {
+  const parsedInput = subagentReadInputSchema.safeParse(input);
+  if (!parsedInput.success) {
+    return invalidToolInputResult("subagent_read", parsedInput.error);
+  }
+  const parsed = parsedInput.data;
+  const subagentId = resolveSubagentId(parsed, context);
+  if (!subagentId && parsed.label) {
     return {
-      content: `No subagent found with label "${input.label as string}".`,
+      content: `No subagent found with label "${parsed.label}".`,
       isError: true,
     };
   }