chainlesschain 0.162.175 → 0.162.177

package/src/lib/ide-context.js

@@ -438,6 +438,109 @@ export function hasIdeOpenDiff(mcp) {
   );
 }
 
+const DIFF_REVIEW_AUDIT_SCHEMA = "cc-diff-review/v1";
+const DIFF_REVIEW_OPERATIONS = new Set([
+  "modify",
+  "create",
+  "delete",
+  "rename",
+]);
+
+function auditString(value, max) {
+  if (value == null) return null;
+  const text = String(value).slice(0, max);
+  return text || null;
+}
+
+function auditIndex(value) {
+  return Number.isInteger(value) && value >= 0 ? value : null;
+}
+
+function auditFingerprint(value) {
+  if (!value || typeof value !== "object") return null;
+  const sha256 = auditString(value.sha256, 64);
+  if (!/^[a-f0-9]{64}$/i.test(sha256 || "")) return null;
+  return {
+    sha256: sha256.toLowerCase(),
+    chars: auditIndex(value.chars),
+    lines: auditIndex(value.lines),
+  };
+}
+
+/**
+ * Reduce a host-provided Diff Review audit to the bounded v1 wire contract.
+ * Correlation ids and path are overwritten from the CLI request so a malformed
+ * or stale local bridge cannot spoof which session/tool the decision belongs to.
+ */
+export function normalizeDiffReviewAudit(value, binding = {}) {
+  if (
+    !value ||
+    typeof value !== "object" ||
+    value.schema !== DIFF_REVIEW_AUDIT_SCHEMA
+  ) {
+    return null;
+  }
+  const requestedOutcome = auditString(binding.outcome ?? value.outcome, 64);
+  const outcome = ["accepted", "rejected", "changes-requested"].includes(
+    requestedOutcome,
+  )
+    ? requestedOutcome
+    : "rejected";
+  const requestedOperation = binding.operation ?? value.operation;
+  const operation = DIFF_REVIEW_OPERATIONS.has(requestedOperation)
+    ? requestedOperation
+    : "modify";
+  const comments = (Array.isArray(value.comments) ? value.comments : [])
+    .filter((comment) => comment && typeof comment === "object")
+    .map((comment) => ({
+      line: auditIndex(comment.line),
+      endLine: auditIndex(comment.endLine),
+      lineFingerprint: auditFingerprint(comment.lineFingerprint),
+      note: auditString(comment.note, 1000),
+    }))
+    .filter((comment) => comment.note)
+    .slice(0, 32);
+  const selectedHunks = [
+    ...new Set(
+      (Array.isArray(value.selectedHunks) ? value.selectedHunks : []).filter(
+        (index) => Number.isInteger(index) && index >= 0,
+      ),
+    ),
+  ]
+    .sort((a, b) => a - b)
+    .slice(0, 128);
+  return {
+    schema: DIFF_REVIEW_AUDIT_SCHEMA,
+    reviewId: auditString(value.reviewId, 64),
+    createdAt: auditString(value.createdAt, 64),
+    actor: auditString(value.actor, 128) || "local-user",
+    host: auditString(value.host, 64) || "ide",
+    path: auditString(binding.path ?? value.path, 2048),
+    operation,
+    targetPath:
+      operation === "rename"
+        ? auditString(binding.targetPath ?? value.targetPath, 2048)
+        : null,
+    sessionId: auditString(binding.sessionId, 256),
+    turnId: auditString(binding.turnId, 256),
+    toolUseId: auditString(binding.toolUseId, 256),
+    outcome,
+    source: auditString(value.source, 64) || "agent-proposed",
+    written: value.written === true,
+    followUpRequested:
+      value.followUpRequested === true || outcome === "changes-requested",
+    baseline: auditFingerprint(value.baseline),
+    proposed: auditFingerprint(value.proposed),
+    reviewed: auditFingerprint(value.reviewed),
+    final: auditFingerprint(value.final),
+    selectedHunks,
+    appliedHunks: auditIndex(value.appliedHunks),
+    totalHunks: auditIndex(value.totalHunks),
+    comments,
+    reason: auditString(value.reason, 512),
+  };
+}
+
 /**
  * Run one blocking openDiff review in the connected IDE. Returns
  *   { outcome:"accepted", finalText|null }  — the IDE wrote the file itself
@@ -459,7 +562,17 @@ export function hasIdeOpenDiff(mcp) {
 export async function requestIdeDiffApproval(mcp, req = {}) {
   if (!hasIdeOpenDiff(mcp)) return null;
   if (!req.path || typeof req.modifiedText !== "string") return null;
+  const operation = req.operation || "modify";
+  if (!DIFF_REVIEW_OPERATIONS.has(operation)) return null;
+  if (operation === "rename" && !req.targetPath) return null;
   const exec = mcp.externalToolExecutors.mcp__ide__openDiff;
+  const reviewContext = Object.fromEntries(
+    Object.entries({
+      sessionId: auditString(req.sessionId, 256),
+      turnId: auditString(req.turnId, 256),
+      toolUseId: auditString(req.toolUseId, 256),
+    }).filter(([, value]) => value),
+  );
   let result;
   try {
     result = await mcp.mcpClient.callTool(exec.serverName, exec.toolName, {
@@ -469,15 +582,26 @@ export async function requestIdeDiffApproval(mcp, req = {}) {
         ? { originalText: req.originalText }
         : {}),
       ...(req.title ? { title: req.title } : {}),
+      ...(req.operation ? { operation } : {}),
+      ...(operation === "rename" ? { targetPath: req.targetPath } : {}),
+      ...(Object.values(reviewContext).some(Boolean) ? { reviewContext } : {}),
     });
   } catch {
     return null;
   }
   const data = parseToolResultJson(result);
+  const audit = normalizeDiffReviewAudit(data?.audit, {
+    ...reviewContext,
+    path: req.path,
+    operation,
+    targetPath: operation === "rename" ? req.targetPath : null,
+    outcome: data?.outcome,
+  });
   if (data?.outcome === "accepted") {
     return {
       outcome: "accepted",
       finalText: typeof data.finalText === "string" ? data.finalText : null,
+      ...(audit ? { audit } : {}),
     };
   }
   if (data?.outcome === "changes-requested") {
@@ -486,9 +610,12 @@ export async function requestIdeDiffApproval(mcp, req = {}) {
       comments: Array.isArray(data.comments) ? data.comments : [],
       reviewedText:
         typeof data.reviewedText === "string" ? data.reviewedText : null,
+      ...(audit ? { audit } : {}),
     };
   }
-  if (data?.outcome === "rejected") return { outcome: "rejected" };
+  if (data?.outcome === "rejected") {
+    return { outcome: "rejected", ...(audit ? { audit } : {}) };
+  }
   return null; // anything else is not a verdict — fail safe to fallback
 }
 

package/src/lib/interaction-adapter.js

@@ -14,6 +14,7 @@ import {
   LEGACY_TO_UNIFIED_TYPE,
 } from "../runtime/runtime-events.js";
 import { createAbortError } from "./abort-utils.js";
+import { emitHooksV2Event } from "./hooks-v2-producers.js";
 import { verifyApprovalBinding } from "./agent-authority.js";
 import { createEnvelope } from "@chainlesschain/session-core";
 
@@ -245,6 +246,44 @@ export class WebSocketInteractionAdapter extends InteractionAdapter {
     this._resolvePending(requestId, answer, "question", binding);
   }
 
+  /**
+   * Ask an MCP server elicitation over the same question/answer channel.
+   * The schema is carried as metadata so capable IDE clients can render a
+   * native form; older clients still receive a bounded, ordinary question.
+   */
+  async askElicitation({
+    server,
+    requestId: mcpRequestId,
+    message = "MCP server requests input",
+    requestedSchema = null,
+    timeoutMs,
+  } = {}) {
+    emitHooksV2Event("MCPElicitation", {
+      server: server || null,
+      request_id: mcpRequestId ?? null,
+      message: String(message),
+      requested_schema: requestedSchema || null,
+    });
+    return this._request(
+      {
+        type: "question",
+        questionType: "elicitation",
+        question: String(message),
+        ...(requestedSchema ? { requestedSchema } : {}),
+        metadata: {
+          kind: "mcp_elicitation",
+          server: server || null,
+          requestId: mcpRequestId ?? null,
+          requestedSchema: requestedSchema || null,
+        },
+      },
+      {
+        kind: "question",
+        ...(Number(timeoutMs) > 0 ? { timeoutMs: Number(timeoutMs) } : {}),
+      },
+    );
+  }
+
   async requestHostTool(toolName, args = {}, extra = {}) {
     return this._request(
       {

package/src/lib/json-schema-validate.js

@@ -173,9 +173,7 @@ export function computeSchemaDigest(schema) {
 }
 
 /** Resolve a local `#/...` JSON Pointer $ref within `root`; null if unresolved. */
-function resolveRef(root, ref) {
-  if (typeof ref !== "string" || !ref.startsWith("#")) return null;
-  const frag = ref.slice(1);
+function resolvePointer(root, frag) {
   if (frag === "" || frag === "/") return root;
   const parts = frag
     .replace(/^\//, "")
@@ -189,15 +187,56 @@ function resolveRef(root, ref) {
   return cur === undefined ? null : cur;
 }
 
+function findAnchor(root, anchor, seen = new Set()) {
+  if (!root || typeof root !== "object" || seen.has(root)) return null;
+  seen.add(root);
+  if (root.$anchor === anchor || root.$dynamicAnchor === anchor) return root;
+  for (const value of Object.values(root)) {
+    const found = findAnchor(value, anchor, seen);
+    if (found) return found;
+  }
+  return null;
+}
+
+/** Resolve local refs or a caller-provided external document registry. */
+function resolveRef(root, ref, externalSchemas = {}) {
+  if (typeof ref !== "string") return null;
+  if (ref.startsWith("#")) {
+    const fragment = ref.slice(1);
+    if (fragment === "" || fragment.startsWith("/")) {
+      return resolvePointer(root, fragment);
+    }
+    try {
+      return findAnchor(root, decodeURIComponent(fragment), new Set());
+    } catch {
+      return findAnchor(root, fragment, new Set());
+    }
+  }
+  const hash = ref.indexOf("#");
+  const uri = hash >= 0 ? ref.slice(0, hash) : ref;
+  const document = externalSchemas?.[ref] ?? externalSchemas?.[uri];
+  if (document === undefined) return null;
+  if (hash < 0) return document;
+  const fragment = ref.slice(hash + 1);
+  if (fragment === "" || fragment.startsWith("/")) {
+    return resolvePointer(document, fragment);
+  }
+  try {
+    return findAnchor(document, decodeURIComponent(fragment), new Set());
+  } catch {
+    return findAnchor(document, fragment, new Set());
+  }
+}
+
 // ─── instance validation ─────────────────────────────────────────────────────
 
 /**
  * Validate `value` against `schema`.
  * @returns {{valid:boolean, errors:Array<{code,keyword,instancePath,schemaPath,message}>}}
  */
-export function validate(value, schema) {
+export function validate(value, schema, { externalSchemas = {} } = {}) {
   const errors = [];
-  _validate(value, schema, [], [], schema, errors, 0);
+  _validate(value, schema, [], [], schema, errors, 0, externalSchemas);
   return { valid: errors.length === 0, errors };
 }
 
@@ -211,7 +250,7 @@ function _err(errors, keyword, instSegs, schemaSegs, message) {
   });
 }
 
-function _validate(value, schema, inst, sch, root, errors, depth) {
+function _validate(value, schema, inst, sch, root, errors, depth, externalSchemas) {
   if (schema === true || schema === undefined) return;
   if (schema === false) {
     _err(errors, "false", inst, sch, "schema is `false` — no value is valid");
@@ -220,19 +259,25 @@ function _validate(value, schema, inst, sch, root, errors, depth) {
   if (!schema || typeof schema !== "object") return;
   if (depth > MAX_REF_DEPTH) return; // cyclic $ref guard
 
-  // $ref — validate against the referenced schema (local only).
-  if (typeof schema.$ref === "string") {
-    const target = resolveRef(root, schema.$ref);
+  // $ref/$dynamicRef — local pointer/anchor or explicit external registry.
+  const refKeyword =
+    typeof schema.$ref === "string"
+      ? "$ref"
+      : typeof schema.$dynamicRef === "string"
+        ? "$dynamicRef"
+        : null;
+  if (refKeyword) {
+    const target = resolveRef(root, schema[refKeyword], externalSchemas);
     if (target == null) {
       _err(
         errors,
-        "$ref",
+        refKeyword,
         inst,
-        [...sch, "$ref"],
-        `cannot resolve $ref "${schema.$ref}"`,
+        [...sch, refKeyword],
+        `cannot resolve ${refKeyword} "${schema[refKeyword]}"`,
       );
     } else {
-      _validate(value, target, inst, [...sch, "$ref"], root, errors, depth + 1);
+      _validate(value, target, inst, [...sch, refKeyword], root, errors, depth + 1, externalSchemas);
     }
     // sibling keywords still apply in 2020-12; fall through.
   }
@@ -282,12 +327,12 @@ function _validate(value, schema, inst, sch, root, errors, depth) {
   if (t === "number" || t === "integer")
     _validateNumber(value, schema, inst, sch, errors);
   if (t === "array")
-    _validateArray(value, schema, inst, sch, root, errors, depth);
+    _validateArray(value, schema, inst, sch, root, errors, depth, externalSchemas);
   if (t === "object")
-    _validateObject(value, schema, inst, sch, root, errors, depth);
+    _validateObject(value, schema, inst, sch, root, errors, depth, externalSchemas);
 
-  _validateCombinators(value, schema, inst, sch, root, errors, depth);
-  _validateConditional(value, schema, inst, sch, root, errors, depth);
+  _validateCombinators(value, schema, inst, sch, root, errors, depth, externalSchemas);
+  _validateConditional(value, schema, inst, sch, root, errors, depth, externalSchemas);
 }
 
 /**
@@ -295,9 +340,9 @@ function _validate(value, schema, inst, sch, root, errors, depth) {
  * own errors are never reported; if the value matches `if`, `then` applies,
  * otherwise `else` applies. No `if` keyword ⇒ then/else are inert.
  */
-function _validateConditional(value, schema, inst, sch, root, errors, depth) {
+function _validateConditional(value, schema, inst, sch, root, errors, depth, externalSchemas) {
   if (schema.if === undefined) return;
-  const matched = _branchValid(value, schema.if, root, depth);
+  const matched = _branchValid(value, schema.if, root, depth, externalSchemas);
   if (matched) {
     if (schema.then !== undefined) {
       _validate(
@@ -308,10 +353,11 @@ function _validateConditional(value, schema, inst, sch, root, errors, depth) {
         root,
         errors,
         depth,
+        externalSchemas,
       );
     }
   } else if (schema.else !== undefined) {
-    _validate(value, schema.else, inst, [...sch, "else"], root, errors, depth);
+    _validate(value, schema.else, inst, [...sch, "else"], root, errors, depth, externalSchemas);
   }
 }
 
@@ -423,7 +469,7 @@ function _validateNumber(value, schema, inst, sch, errors) {
   }
 }
 
-function _validateArray(value, schema, inst, sch, root, errors, depth) {
+function _validateArray(value, schema, inst, sch, root, errors, depth, externalSchemas) {
   if (Number.isFinite(schema.minItems) && value.length < schema.minItems) {
     _err(
       errors,
@@ -460,6 +506,24 @@ function _validateArray(value, schema, inst, sch, root, errors, depth) {
     }
   }
   const prefix = Array.isArray(schema.prefixItems) ? schema.prefixItems : [];
+  if (schema.contains !== undefined) {
+    const matches = value.reduce(
+      (count, item, i) =>
+        count + (_branchValid(item, schema.contains, root, depth, externalSchemas) ? 1 : 0),
+      0,
+    );
+    const min = Number.isFinite(schema.minContains) ? schema.minContains : 1;
+    const max = Number.isFinite(schema.maxContains) ? schema.maxContains : Infinity;
+    if (matches < min || matches > max) {
+      _err(
+        errors,
+        "contains",
+        inst,
+        [...sch, "contains"],
+        `array contains ${matches} matching item(s), expected ${min}${max === Infinity ? "+" : `..${max}`}`,
+      );
+    }
+  }
   value.forEach((item, i) => {
     if (i < prefix.length) {
       _validate(
@@ -470,6 +534,7 @@ function _validateArray(value, schema, inst, sch, root, errors, depth) {
         root,
         errors,
         depth,
+        externalSchemas,
       );
     } else if (schema.items !== undefined) {
       _validate(
@@ -480,12 +545,13 @@ function _validateArray(value, schema, inst, sch, root, errors, depth) {
         root,
         errors,
         depth,
+        externalSchemas,
       );
     }
   });
 }
 
-function _validateObject(value, schema, inst, sch, root, errors, depth) {
+function _validateObject(value, schema, inst, sch, root, errors, depth, externalSchemas) {
   const keys = Object.keys(value);
   if (
     Number.isFinite(schema.minProperties) &&
@@ -523,6 +589,10 @@ function _validateObject(value, schema, inst, sch, root, errors, depth) {
     }
   }
   const props = schema.properties || {};
+  const patterns = schema.patternProperties || {};
+  const patternEntries = Object.entries(patterns).map(([pattern, sub]) => {
+    try { return [new RegExp(pattern), pattern, sub]; } catch { return [null, pattern, sub]; }
+  });
   for (const [k, v] of Object.entries(value)) {
     if (Object.prototype.hasOwnProperty.call(props, k)) {
       _validate(
@@ -533,19 +603,25 @@ function _validateObject(value, schema, inst, sch, root, errors, depth) {
         root,
         errors,
         depth,
+        externalSchemas,
       );
-    } else if (schema.additionalProperties === false) {
+    } else {
+      const matches = patternEntries.filter(([re]) => re && re.test(k));
+      if (matches.length > 0) {
+        for (const [, pattern, sub] of matches) {
+          _validate(v, sub, [...inst, k], [...sch, "patternProperties", pattern], root, errors, depth, externalSchemas);
+        }
+        continue;
+      }
+      if (schema.additionalProperties === false || schema.unevaluatedProperties === false) {
       _err(
         errors,
-        "additionalProperties",
+        schema.additionalProperties === false ? "additionalProperties" : "unevaluatedProperties",
         [...inst, k],
-        [...sch, "additionalProperties"],
+        [...sch, schema.additionalProperties === false ? "additionalProperties" : "unevaluatedProperties"],
         `unexpected property "${k}"`,
       );
-    } else if (
-      schema.additionalProperties &&
-      typeof schema.additionalProperties === "object"
-    ) {
+      } else if (schema.additionalProperties && typeof schema.additionalProperties === "object") {
       _validate(
         v,
         schema.additionalProperties,
@@ -554,25 +630,49 @@ function _validateObject(value, schema, inst, sch, root, errors, depth) {
         root,
         errors,
         depth,
+        externalSchemas,
       );
+      }
+    }
+  }
+  if (schema.propertyNames !== undefined) {
+    for (const key of keys) {
+      _validate(key, schema.propertyNames, [...inst, key], [...sch, "propertyNames"], root, errors, depth, externalSchemas);
+    }
+  }
+  if (schema.dependentRequired && typeof schema.dependentRequired === "object") {
+    for (const [key, required] of Object.entries(schema.dependentRequired)) {
+      if (!Object.prototype.hasOwnProperty.call(value, key)) continue;
+      for (const dep of Array.isArray(required) ? required : []) {
+        if (!Object.prototype.hasOwnProperty.call(value, dep)) {
+          _err(errors, "dependentRequired", inst, [...sch, "dependentRequired", key], `property "${key}" requires property "${dep}"`);
+        }
+      }
+    }
+  }
+  if (schema.dependentSchemas && typeof schema.dependentSchemas === "object") {
+    for (const [key, sub] of Object.entries(schema.dependentSchemas)) {
+      if (Object.prototype.hasOwnProperty.call(value, key)) {
+        _validate(value, sub, inst, [...sch, "dependentSchemas", key], root, errors, depth, externalSchemas);
+      }
     }
   }
 }
 
-function _branchValid(value, subschema, root, depth) {
+function _branchValid(value, subschema, root, depth, externalSchemas) {
   const errs = [];
-  _validate(value, subschema, [], [], root, errs, depth + 1);
+  _validate(value, subschema, [], [], root, errs, depth + 1, externalSchemas);
   return errs.length === 0;
 }
 
-function _validateCombinators(value, schema, inst, sch, root, errors, depth) {
+function _validateCombinators(value, schema, inst, sch, root, errors, depth, externalSchemas) {
   if (Array.isArray(schema.allOf)) {
     schema.allOf.forEach((s, i) => {
-      _validate(value, s, inst, [...sch, "allOf", i], root, errors, depth);
+      _validate(value, s, inst, [...sch, "allOf", i], root, errors, depth, externalSchemas);
     });
   }
   if (Array.isArray(schema.anyOf)) {
-    const ok = schema.anyOf.some((s) => _branchValid(value, s, root, depth));
+    const ok = schema.anyOf.some((s) => _branchValid(value, s, root, depth, externalSchemas));
     if (!ok)
       _err(
         errors,
@@ -584,7 +684,7 @@ function _validateCombinators(value, schema, inst, sch, root, errors, depth) {
   }
   if (Array.isArray(schema.oneOf)) {
     const matches = schema.oneOf.filter((s) =>
-      _branchValid(value, s, root, depth),
+      _branchValid(value, s, root, depth, externalSchemas),
     ).length;
     if (matches !== 1) {
       _err(
@@ -598,7 +698,7 @@ function _validateCombinators(value, schema, inst, sch, root, errors, depth) {
   }
   if (
     schema.not !== undefined &&
-    _branchValid(value, schema.not, root, depth)
+    _branchValid(value, schema.not, root, depth, externalSchemas)
   ) {
     _err(
       errors,
@@ -692,6 +792,8 @@ function _metaValidate(schema, segs, errors, depth) {
     "maxItems",
     "minProperties",
     "maxProperties",
+    "minContains",
+    "maxContains",
   ]) {
     if (
       schema[k] !== undefined &&
@@ -724,6 +826,28 @@ function _metaValidate(schema, segs, errors, depth) {
   if (schema.$ref !== undefined && typeof schema.$ref !== "string") {
     _metaErr(errors, "$ref", [...segs, "$ref"], "$ref must be a string");
   }
+  for (const k of ["$id", "$schema", "$anchor", "$dynamicAnchor", "$dynamicRef", "$comment"]) {
+    if (schema[k] !== undefined && typeof schema[k] !== "string") {
+      _metaErr(errors, k, [...segs, k], `${k} must be a string`);
+    }
+  }
+  if (schema.$anchor !== undefined && typeof schema.$anchor === "string" && !/^[A-Za-z][A-Za-z0-9:_-]*$/.test(schema.$anchor)) {
+    _metaErr(errors, "$anchor", [...segs, "$anchor"], "$anchor must match the anchor-name syntax");
+  }
+  if (schema.$dynamicAnchor !== undefined && typeof schema.$dynamicAnchor === "string" && !/^[A-Za-z][A-Za-z0-9:_-]*$/.test(schema.$dynamicAnchor)) {
+    _metaErr(errors, "$dynamicAnchor", [...segs, "$dynamicAnchor"], "$dynamicAnchor must match the anchor-name syntax");
+  }
+  if (schema.$vocabulary !== undefined) {
+    if (!schema.$vocabulary || typeof schema.$vocabulary !== "object" || Array.isArray(schema.$vocabulary)) {
+      _metaErr(errors, "$vocabulary", [...segs, "$vocabulary"], "$vocabulary must be an object");
+    } else {
+      for (const [uri, required] of Object.entries(schema.$vocabulary)) {
+        if (typeof required !== "boolean") {
+          _metaErr(errors, "$vocabulary", [...segs, "$vocabulary", uri], "vocabulary values must be boolean");
+        }
+      }
+    }
+  }
   if (schema.properties !== undefined) {
     if (
       typeof schema.properties !== "object" ||
@@ -741,6 +865,36 @@ function _metaValidate(schema, segs, errors, depth) {
       }
     }
   }
+  for (const k of ["patternProperties", "dependentSchemas"]) {
+    if (schema[k] === undefined) continue;
+    if (typeof schema[k] !== "object" || Array.isArray(schema[k])) {
+      _metaErr(errors, k, [...segs, k], `${k} must be an object`);
+    } else {
+      for (const [name, sub] of Object.entries(schema[k])) {
+        if (k === "patternProperties") {
+          try { new RegExp(name); } catch (e) { _metaErr(errors, k, [...segs, k, name], `invalid regex: ${e.message}`); }
+        }
+        _metaValidate(sub, [...segs, k, name], errors, depth + 1);
+      }
+    }
+  }
+  if (schema.propertyNames !== undefined) {
+    _metaValidate(schema.propertyNames, [...segs, "propertyNames"], errors, depth + 1);
+  }
+  if (schema.dependentRequired !== undefined) {
+    if (typeof schema.dependentRequired !== "object" || Array.isArray(schema.dependentRequired)) {
+      _metaErr(errors, "dependentRequired", [...segs, "dependentRequired"], "dependentRequired must be an object");
+    } else {
+      for (const [key, required] of Object.entries(schema.dependentRequired)) {
+        if (!Array.isArray(required) || required.some((v) => typeof v !== "string")) {
+          _metaErr(errors, "dependentRequired", [...segs, "dependentRequired", key], "dependentRequired values must be arrays of strings");
+        }
+      }
+    }
+  }
+  if (schema.contains !== undefined) {
+    _metaValidate(schema.contains, [...segs, "contains"], errors, depth + 1);
+  }
   if (
     schema.additionalProperties !== undefined &&
     typeof schema.additionalProperties === "object"

package/src/lib/lan-pairing-preflight.js

@@ -21,8 +21,12 @@
 
 import os from "node:os";
 import fs from "node:fs";
-import { execSync } from "node:child_process";
 import dgram from "node:dgram";
+import executionBroker from "./process-execution-broker/index.js";
+
+export const _deps = {
+  execFileSync: (...args) => executionBroker.execFileSync(...args),
+};
 
 const MDNS_PORT = 5353;
 const MDNS_GROUP = "224.0.0.251";
@@ -313,7 +317,14 @@ function which(cmd) {
   try {
     const platform = os.platform();
     const probe = platform === "win32" ? "where" : "which";
-    execSync(`${probe} ${cmd}`, { stdio: "pipe", windowsHide: true });
+    _deps.execFileSync(probe, [cmd], {
+      origin: "lan-pairing:firewall-probe",
+      scope: "network-diagnostics",
+      policy: "allow",
+      shell: false,
+      stdio: "pipe",
+      windowsHide: true,
+    });
     return true;
   } catch (_err) {
     return false;