claude-flow 3.5.70 → 3.5.71

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-flow",
-  "version": "3.5.70",
+  "version": "3.5.71",
   "description": "Ruflo - Enterprise AI agent orchestration for Claude Code. Deploy 60+ specialized agents in coordinated swarms with self-learning, fault-tolerant consensus, vector memory, and MCP integration",
   "main": "dist/index.js",
   "type": "module",

package/v3/@claude-flow/cli/dist/src/mcp-tools/agent-tools.js

@@ -7,7 +7,7 @@
 import { existsSync, readFileSync, writeFileSync, mkdirSync } from 'node:fs';
 import { join } from 'node:path';
 import { getProjectCwd } from './types.js';
-import { validateAgentSpawn } from './validate-input.js';
+import { validateIdentifier, validateAgentSpawn } from './validate-input.js';
 // Storage paths
 const STORAGE_DIR = '.claude-flow';
 const AGENT_DIR = 'agents';
@@ -221,6 +221,9 @@ export const agentTools = [
             required: ['agentId'],
         },
         handler: async (input) => {
+            const v = validateIdentifier(input.agentId, 'agentId');
+            if (!v.valid)
+                return { success: false, error: `Input validation failed: ${v.error}` };
             const store = loadAgentStore();
             const agentId = input.agentId;
             if (store.agents[agentId]) {
@@ -252,6 +255,9 @@ export const agentTools = [
             required: ['agentId'],
         },
         handler: async (input) => {
+            const v = validateIdentifier(input.agentId, 'agentId');
+            if (!v.valid)
+                return { agentId: input.agentId, status: 'not_found', error: `Input validation failed: ${v.error}` };
             const store = loadAgentStore();
             const agentId = input.agentId;
             const agent = store.agents[agentId];
@@ -287,6 +293,16 @@ export const agentTools = [
             },
         },
         handler: async (input) => {
+            if (input.status) {
+                const v = validateIdentifier(input.status, 'status');
+                if (!v.valid)
+                    return { agents: [], total: 0, error: `Input validation failed: ${v.error}` };
+            }
+            if (input.domain) {
+                const v = validateIdentifier(input.domain, 'domain');
+                if (!v.valid)
+                    return { agents: [], total: 0, error: `Input validation failed: ${v.error}` };
+            }
             const store = loadAgentStore();
             let agents = Object.values(store.agents);
             // Filter by status
@@ -333,6 +349,11 @@ export const agentTools = [
             required: ['action'],
         },
         handler: async (input) => {
+            if (input.agentType) {
+                const v = validateIdentifier(input.agentType, 'agentType');
+                if (!v.valid)
+                    return { action: input.action, error: `Input validation failed: ${v.error}` };
+            }
             const store = loadAgentStore();
             const agents = Object.values(store.agents).filter(a => a.status !== 'terminated');
             const action = input.action || 'status'; // Default to status
@@ -443,6 +464,11 @@ export const agentTools = [
             },
         },
         handler: async (input) => {
+            if (input.agentId) {
+                const v = validateIdentifier(input.agentId, 'agentId');
+                if (!v.valid)
+                    return { agentId: input.agentId, error: `Input validation failed: ${v.error}` };
+            }
             const store = loadAgentStore();
             const agents = Object.values(store.agents).filter(a => a.status !== 'terminated');
             const threshold = input.threshold || 0.5;
@@ -517,6 +543,14 @@ export const agentTools = [
             required: ['agentId'],
         },
         handler: async (input) => {
+            const v = validateIdentifier(input.agentId, 'agentId');
+            if (!v.valid)
+                return { success: false, agentId: input.agentId, error: `Input validation failed: ${v.error}` };
+            if (input.status) {
+                const vs = validateIdentifier(input.status, 'status');
+                if (!vs.valid)
+                    return { success: false, agentId: input.agentId, error: `Input validation failed: ${vs.error}` };
+            }
             const store = loadAgentStore();
             const agentId = input.agentId;
             const agent = store.agents[agentId];

package/v3/@claude-flow/cli/dist/src/mcp-tools/agentdb-tools.js

@@ -10,6 +10,7 @@
  *
  * @module v3/cli/mcp-tools/agentdb-tools
  */
+import { validateIdentifier, validateText } from './validate-input.js';
 // ===== Shared validation helpers =====
 const MAX_STRING_LENGTH = 100_000; // 100KB max for any string input
 const MAX_BATCH_SIZE = 500; // Max entries per batch operation
@@ -109,6 +110,14 @@ export const agentdbPatternStore = {
     },
     handler: async (params) => {
         try {
+            const vPattern = validateText(params.pattern, 'pattern', 100_000);
+            if (!vPattern.valid)
+                return { success: false, error: vPattern.error };
+            if (params.type) {
+                const vType = validateIdentifier(params.type, 'type');
+                if (!vType.valid)
+                    return { success: false, error: vType.error };
+            }
             const pattern = validateString(params.pattern, 'pattern');
             if (!pattern)
                 return { success: false, error: 'pattern is required (non-empty string, max 100KB)' };
@@ -140,6 +149,9 @@ export const agentdbPatternSearch = {
     },
     handler: async (params) => {
         try {
+            const vQuery = validateText(params.query, 'query', 10_000);
+            if (!vQuery.valid)
+                return { results: [], error: vQuery.error };
             const query = validateString(params.query, 'query', 10_000);
             if (!query)
                 return { results: [], error: 'query is required (non-empty string, max 10KB)' };
@@ -172,6 +184,14 @@ export const agentdbFeedback = {
     },
     handler: async (params) => {
         try {
+            const vTaskId = validateIdentifier(params.taskId, 'taskId');
+            if (!vTaskId.valid)
+                return { success: false, error: vTaskId.error };
+            if (params.agent) {
+                const vAgent = validateIdentifier(params.agent, 'agent');
+                if (!vAgent.valid)
+                    return { success: false, error: vAgent.error };
+            }
             const taskId = validateString(params.taskId, 'taskId', 500);
             if (!taskId)
                 return { success: false, error: 'taskId is required (non-empty string, max 500 chars)' };
@@ -205,6 +225,15 @@ export const agentdbCausalEdge = {
     },
     handler: async (params) => {
         try {
+            const vSourceId = validateIdentifier(params.sourceId, 'sourceId');
+            if (!vSourceId.valid)
+                return { success: false, error: vSourceId.error };
+            const vTargetId = validateIdentifier(params.targetId, 'targetId');
+            if (!vTargetId.valid)
+                return { success: false, error: vTargetId.error };
+            const vRelation = validateIdentifier(params.relation, 'relation');
+            if (!vRelation.valid)
+                return { success: false, error: vRelation.error };
             const sourceId = validateString(params.sourceId, 'sourceId', 500);
             const targetId = validateString(params.targetId, 'targetId', 500);
             const relation = validateString(params.relation, 'relation', 200);
@@ -242,6 +271,14 @@ export const agentdbRoute = {
     },
     handler: async (params) => {
         try {
+            const vTask = validateText(params.task, 'task', 10_000);
+            if (!vTask.valid)
+                return { route: 'general', confidence: 0.5, agents: ['coder'], controller: 'error', error: vTask.error };
+            if (params.context) {
+                const vCtx = validateText(params.context, 'context', 10_000);
+                if (!vCtx.valid)
+                    return { route: 'general', confidence: 0.5, agents: ['coder'], controller: 'error', error: vCtx.error };
+            }
             const task = validateString(params.task, 'task', 10_000);
             if (!task)
                 return { route: 'general', confidence: 0.5, agents: ['coder'], controller: 'error', error: 'task is required (non-empty string)' };
@@ -271,6 +308,14 @@ export const agentdbSessionStart = {
     },
     handler: async (params) => {
         try {
+            const vSessionId = validateIdentifier(params.sessionId, 'sessionId');
+            if (!vSessionId.valid)
+                return { success: false, error: vSessionId.error };
+            if (params.context) {
+                const vCtx = validateText(params.context, 'context', 10_000);
+                if (!vCtx.valid)
+                    return { success: false, error: vCtx.error };
+            }
             const sessionId = validateString(params.sessionId, 'sessionId', 500);
             if (!sessionId)
                 return { success: false, error: 'sessionId is required (non-empty string)' };
@@ -301,6 +346,14 @@ export const agentdbSessionEnd = {
     },
     handler: async (params) => {
         try {
+            const vSessionId = validateIdentifier(params.sessionId, 'sessionId');
+            if (!vSessionId.valid)
+                return { success: false, error: vSessionId.error };
+            if (params.summary) {
+                const vSummary = validateText(params.summary, 'summary', 50_000);
+                if (!vSummary.valid)
+                    return { success: false, error: vSummary.error };
+            }
             const sessionId = validateString(params.sessionId, 'sessionId', 500);
             if (!sessionId)
                 return { success: false, error: 'sessionId is required (non-empty string)' };
@@ -337,6 +390,17 @@ export const agentdbHierarchicalStore = {
     },
     handler: async (params) => {
         try {
+            const vKey = validateIdentifier(params.key, 'key');
+            if (!vKey.valid)
+                return { success: false, error: vKey.error };
+            const vValue = validateText(params.value, 'value');
+            if (!vValue.valid)
+                return { success: false, error: vValue.error };
+            if (params.tier) {
+                const vTier = validateIdentifier(params.tier, 'tier');
+                if (!vTier.valid)
+                    return { success: false, error: vTier.error };
+            }
             const key = validateString(params.key, 'key', 1000);
             const value = validateString(params.value, 'value');
             if (!key)
@@ -371,6 +435,14 @@ export const agentdbHierarchicalRecall = {
     },
     handler: async (params) => {
         try {
+            const vQuery = validateText(params.query, 'query', 10_000);
+            if (!vQuery.valid)
+                return { results: [], error: vQuery.error };
+            if (params.tier) {
+                const vTier = validateIdentifier(params.tier, 'tier');
+                if (!vTier.valid)
+                    return { results: [], error: vTier.error };
+            }
             const query = validateString(params.query, 'query', 10_000);
             if (!query)
                 return { results: [], error: 'query is required (non-empty string, max 10KB)' };
@@ -445,6 +517,9 @@ export const agentdbBatch = {
     },
     handler: async (params) => {
         try {
+            const vOp = validateIdentifier(params.operation, 'operation');
+            if (!vOp.valid)
+                return { success: false, error: vOp.error };
             const operation = validateString(params.operation, 'operation', 20);
             if (!operation)
                 return { success: false, error: 'operation is required (string)' };
@@ -496,6 +571,9 @@ export const agentdbContextSynthesize = {
     },
     handler: async (params) => {
         try {
+            const vQuery = validateText(params.query, 'query', 10_000);
+            if (!vQuery.valid)
+                return { success: false, error: vQuery.error };
             const query = validateString(params.query, 'query', 10_000);
             if (!query)
                 return { success: false, error: 'query is required (non-empty string, max 10KB)' };
@@ -524,6 +602,9 @@ export const agentdbSemanticRoute = {
     },
     handler: async (params) => {
         try {
+            const vInput = validateText(params.input, 'input', 10_000);
+            if (!vInput.valid)
+                return { route: null, error: vInput.error };
             const input = validateString(params.input, 'input', 10_000);
             if (!input)
                 return { route: null, error: 'input is required (non-empty string, max 10KB)' };

package/v3/@claude-flow/cli/dist/src/mcp-tools/analyze-tools.js

@@ -2,6 +2,7 @@
  * Analyze MCP Tools
  * Provides diff analysis and classification via MCP protocol
  */
+import { validateIdentifier, validatePath } from './validate-input.js';
 import { analyzeDiff, assessFileRisk, assessOverallRisk, classifyDiff, suggestReviewers, getGitDiffNumstat, } from '../ruvector/diff-classifier.js';
 /**
  * Diff Analysis Tool
@@ -38,6 +39,11 @@ export const analyzeDiffTool = {
         },
     },
     handler: async (params) => {
+        if (params.ref) {
+            const vRef = validateIdentifier(params.ref, 'ref');
+            if (!vRef.valid)
+                return { error: true, message: vRef.error, ref: params.ref };
+        }
         const ref = params.ref || 'HEAD';
         const includeFileRisks = params.includeFileRisks !== false;
         const includeReviewers = params.includeReviewers !== false;
@@ -93,6 +99,11 @@ export const diffRiskTool = {
         },
     },
     handler: async (params) => {
+        if (params.ref) {
+            const vRef = validateIdentifier(params.ref, 'ref');
+            if (!vRef.valid)
+                return { error: true, message: vRef.error, ref: params.ref };
+        }
         const ref = params.ref || 'HEAD';
         try {
             const files = getGitDiffNumstat(ref);
@@ -133,6 +144,11 @@ export const diffClassifyTool = {
         },
     },
     handler: async (params) => {
+        if (params.ref) {
+            const vRef = validateIdentifier(params.ref, 'ref');
+            if (!vRef.valid)
+                return { error: true, message: vRef.error, ref: params.ref };
+        }
         const ref = params.ref || 'HEAD';
         try {
             const files = getGitDiffNumstat(ref);
@@ -177,6 +193,11 @@ export const diffReviewersTool = {
         },
     },
     handler: async (params) => {
+        if (params.ref) {
+            const vRef = validateIdentifier(params.ref, 'ref');
+            if (!vRef.valid)
+                return { error: true, message: vRef.error, ref: params.ref };
+        }
         const ref = params.ref || 'HEAD';
         const limit = params.limit || 5;
         try {
@@ -233,6 +254,9 @@ export const fileRiskTool = {
         required: ['path'],
     },
     handler: async (params) => {
+        const vPath = validatePath(params.path, 'path');
+        if (!vPath.valid)
+            return { file: params.path, risk: 'unknown', score: 0, reasons: [vPath.error] };
         const file = {
             path: params.path,
             status: params.status || 'modified',
@@ -270,6 +294,11 @@ export const diffStatsTool = {
         },
     },
     handler: async (params) => {
+        if (params.ref) {
+            const vRef = validateIdentifier(params.ref, 'ref');
+            if (!vRef.valid)
+                return { error: true, message: vRef.error, ref: params.ref };
+        }
         const ref = params.ref || 'HEAD';
         try {
             const files = getGitDiffNumstat(ref);

package/v3/@claude-flow/cli/dist/src/mcp-tools/autopilot-tools.js

@@ -7,6 +7,7 @@
  * ADR-072: Autopilot Integration
  * @module @claude-flow/cli/mcp-tools/autopilot
  */
+import { validateText } from './validate-input.js';
 import { loadState, saveState, appendLog, loadLog, discoverTasks, isTerminal, tryLoadLearning, validateNumber, validateTaskSources, VALID_TASK_SOURCES, } from '../autopilot-state.js';
 function ok(data) {
     return { content: [{ type: 'text', text: JSON.stringify(data, null, 2) }] };
@@ -175,6 +176,9 @@ const autopilotHistory = {
         required: ['query'],
     },
     handler: async (params) => {
+        const vQuery = validateText(params.query, 'query');
+        if (!vQuery.valid)
+            return ok({ query: '', results: [], error: vQuery.error });
         const query = String(params.query || '');
         const limit = validateNumber(params.limit, 1, 100, 10);
         const learning = await tryLoadLearning();

package/v3/@claude-flow/cli/dist/src/mcp-tools/browser-tools.js

@@ -4,6 +4,7 @@
  * CLI integration for @claude-flow/browser package.
  * Provides browser automation tools for web navigation, interaction, and data extraction.
  */
+import { validateIdentifier, validateText } from './validate-input.js';
 // Session registry for multi-session support
 const browserSessions = new Map();
 /**
@@ -75,6 +76,14 @@ export const browserTools = [
             required: ['url'],
         },
         handler: async (input) => {
+            const vUrl = validateText(input.url, 'url');
+            if (!vUrl.valid)
+                return { content: [{ type: 'text', text: JSON.stringify({ success: false, error: vUrl.error }) }], isError: true };
+            if (input.session) {
+                const vS = validateIdentifier(input.session, 'session');
+                if (!vS.valid)
+                    return { content: [{ type: 'text', text: JSON.stringify({ success: false, error: vS.error }) }], isError: true };
+            }
             const { url, session, waitUntil } = input;
             const args = ['open', url];
             if (waitUntil)
@@ -176,6 +185,16 @@ export const browserTools = [
             },
         },
         handler: async (input) => {
+            if (input.selector) {
+                const vSel = validateText(input.selector, 'selector');
+                if (!vSel.valid)
+                    return { content: [{ type: 'text', text: JSON.stringify({ success: false, error: vSel.error }) }], isError: true };
+            }
+            if (input.session) {
+                const vS = validateIdentifier(input.session, 'session');
+                if (!vS.valid)
+                    return { content: [{ type: 'text', text: JSON.stringify({ success: false, error: vS.error }) }], isError: true };
+            }
             const { session, interactive, compact, depth, selector } = input;
             const args = ['snapshot'];
             if (interactive)
@@ -203,6 +222,16 @@ export const browserTools = [
             },
         },
         handler: async (input) => {
+            if (input.path) {
+                const vP = validateText(input.path, 'path');
+                if (!vP.valid)
+                    return { content: [{ type: 'text', text: JSON.stringify({ success: false, error: vP.error }) }], isError: true };
+            }
+            if (input.session) {
+                const vS = validateIdentifier(input.session, 'session');
+                if (!vS.valid)
+                    return { content: [{ type: 'text', text: JSON.stringify({ success: false, error: vS.error }) }], isError: true };
+            }
             const { session, path, fullPage } = input;
             const args = ['screenshot'];
             if (path)
@@ -231,6 +260,14 @@ export const browserTools = [
             required: ['target'],
         },
         handler: async (input) => {
+            const vTarget = validateText(input.target, 'target');
+            if (!vTarget.valid)
+                return { content: [{ type: 'text', text: JSON.stringify({ success: false, error: vTarget.error }) }], isError: true };
+            if (input.session) {
+                const vS = validateIdentifier(input.session, 'session');
+                if (!vS.valid)
+                    return { content: [{ type: 'text', text: JSON.stringify({ success: false, error: vS.error }) }], isError: true };
+            }
             const { target, session, button, count } = input;
             const args = ['click', target];
             if (button)
@@ -255,6 +292,17 @@ export const browserTools = [
             required: ['target', 'value'],
         },
         handler: async (input) => {
+            const vTarget = validateText(input.target, 'target');
+            if (!vTarget.valid)
+                return { content: [{ type: 'text', text: JSON.stringify({ success: false, error: vTarget.error }) }], isError: true };
+            const vValue = validateText(input.value, 'value');
+            if (!vValue.valid)
+                return { content: [{ type: 'text', text: JSON.stringify({ success: false, error: vValue.error }) }], isError: true };
+            if (input.session) {
+                const vS = validateIdentifier(input.session, 'session');
+                if (!vS.valid)
+                    return { content: [{ type: 'text', text: JSON.stringify({ success: false, error: vS.error }) }], isError: true };
+            }
             const { target, value, session } = input;
             return execBrowserCommand(['fill', target, value], session);
         },
@@ -275,6 +323,17 @@ export const browserTools = [
             required: ['target', 'text'],
         },
         handler: async (input) => {
+            const vTarget = validateText(input.target, 'target');
+            if (!vTarget.valid)
+                return { content: [{ type: 'text', text: JSON.stringify({ success: false, error: vTarget.error }) }], isError: true };
+            const vText = validateText(input.text, 'text');
+            if (!vText.valid)
+                return { content: [{ type: 'text', text: JSON.stringify({ success: false, error: vText.error }) }], isError: true };
+            if (input.session) {
+                const vS = validateIdentifier(input.session, 'session');
+                if (!vS.valid)
+                    return { content: [{ type: 'text', text: JSON.stringify({ success: false, error: vS.error }) }], isError: true };
+            }
             const { target, text, session, delay } = input;
             const args = ['type', target, text];
             if (delay)
@@ -296,6 +355,14 @@ export const browserTools = [
             required: ['key'],
         },
         handler: async (input) => {
+            const vKey = validateText(input.key, 'key');
+            if (!vKey.valid)
+                return { content: [{ type: 'text', text: JSON.stringify({ success: false, error: vKey.error }) }], isError: true };
+            if (input.session) {
+                const vS = validateIdentifier(input.session, 'session');
+                if (!vS.valid)
+                    return { content: [{ type: 'text', text: JSON.stringify({ success: false, error: vS.error }) }], isError: true };
+            }
             const { key, session } = input;
             return execBrowserCommand(['press', key], session);
         },
@@ -314,6 +381,14 @@ export const browserTools = [
             required: ['target'],
         },
         handler: async (input) => {
+            const vTarget = validateText(input.target, 'target');
+            if (!vTarget.valid)
+                return { content: [{ type: 'text', text: JSON.stringify({ success: false, error: vTarget.error }) }], isError: true };
+            if (input.session) {
+                const vS = validateIdentifier(input.session, 'session');
+                if (!vS.valid)
+                    return { content: [{ type: 'text', text: JSON.stringify({ success: false, error: vS.error }) }], isError: true };
+            }
             const { target, session } = input;
             return execBrowserCommand(['hover', target], session);
         },
@@ -333,6 +408,17 @@ export const browserTools = [
             required: ['target', 'value'],
         },
         handler: async (input) => {
+            const vTarget = validateText(input.target, 'target');
+            if (!vTarget.valid)
+                return { content: [{ type: 'text', text: JSON.stringify({ success: false, error: vTarget.error }) }], isError: true };
+            const vValue = validateText(input.value, 'value');
+            if (!vValue.valid)
+                return { content: [{ type: 'text', text: JSON.stringify({ success: false, error: vValue.error }) }], isError: true };
+            if (input.session) {
+                const vS = validateIdentifier(input.session, 'session');
+                if (!vS.valid)
+                    return { content: [{ type: 'text', text: JSON.stringify({ success: false, error: vS.error }) }], isError: true };
+            }
             const { target, value, session } = input;
             return execBrowserCommand(['select', target, value], session);
         },
@@ -351,6 +437,14 @@ export const browserTools = [
             required: ['target'],
         },
         handler: async (input) => {
+            const vTarget = validateText(input.target, 'target');
+            if (!vTarget.valid)
+                return { content: [{ type: 'text', text: JSON.stringify({ success: false, error: vTarget.error }) }], isError: true };
+            if (input.session) {
+                const vS = validateIdentifier(input.session, 'session');
+                if (!vS.valid)
+                    return { content: [{ type: 'text', text: JSON.stringify({ success: false, error: vS.error }) }], isError: true };
+            }
             const { target, session } = input;
             return execBrowserCommand(['check', target], session);
         },
@@ -369,6 +463,14 @@ export const browserTools = [
             required: ['target'],
         },
         handler: async (input) => {
+            const vTarget = validateText(input.target, 'target');
+            if (!vTarget.valid)
+                return { content: [{ type: 'text', text: JSON.stringify({ success: false, error: vTarget.error }) }], isError: true };
+            if (input.session) {
+                const vS = validateIdentifier(input.session, 'session');
+                if (!vS.valid)
+                    return { content: [{ type: 'text', text: JSON.stringify({ success: false, error: vS.error }) }], isError: true };
+            }
             const { target, session } = input;
             return execBrowserCommand(['uncheck', target], session);
         },
@@ -412,6 +514,14 @@ export const browserTools = [
             required: ['target'],
         },
         handler: async (input) => {
+            const vTarget = validateText(input.target, 'target');
+            if (!vTarget.valid)
+                return { content: [{ type: 'text', text: JSON.stringify({ success: false, error: vTarget.error }) }], isError: true };
+            if (input.session) {
+                const vS = validateIdentifier(input.session, 'session');
+                if (!vS.valid)
+                    return { content: [{ type: 'text', text: JSON.stringify({ success: false, error: vS.error }) }], isError: true };
+            }
             const { target, session } = input;
             return execBrowserCommand(['get', 'text', target], session);
         },
@@ -430,6 +540,14 @@ export const browserTools = [
             required: ['target'],
         },
         handler: async (input) => {
+            const vTarget = validateText(input.target, 'target');
+            if (!vTarget.valid)
+                return { content: [{ type: 'text', text: JSON.stringify({ success: false, error: vTarget.error }) }], isError: true };
+            if (input.session) {
+                const vS = validateIdentifier(input.session, 'session');
+                if (!vS.valid)
+                    return { content: [{ type: 'text', text: JSON.stringify({ success: false, error: vS.error }) }], isError: true };
+            }
             const { target, session } = input;
             return execBrowserCommand(['get', 'value', target], session);
         },
@@ -485,6 +603,26 @@ export const browserTools = [
             },
         },
         handler: async (input) => {
+            if (input.selector) {
+                const vSel = validateText(input.selector, 'selector');
+                if (!vSel.valid)
+                    return { content: [{ type: 'text', text: JSON.stringify({ success: false, error: vSel.error }) }], isError: true };
+            }
+            if (input.text) {
+                const vT = validateText(input.text, 'text');
+                if (!vT.valid)
+                    return { content: [{ type: 'text', text: JSON.stringify({ success: false, error: vT.error }) }], isError: true };
+            }
+            if (input.url) {
+                const vU = validateText(input.url, 'url');
+                if (!vU.valid)
+                    return { content: [{ type: 'text', text: JSON.stringify({ success: false, error: vU.error }) }], isError: true };
+            }
+            if (input.session) {
+                const vS = validateIdentifier(input.session, 'session');
+                if (!vS.valid)
+                    return { content: [{ type: 'text', text: JSON.stringify({ success: false, error: vS.error }) }], isError: true };
+            }
             const { selector, text, url, timeout, session } = input;
             const args = ['wait'];
             if (selector)
@@ -515,6 +653,14 @@ export const browserTools = [
             required: ['script'],
         },
         handler: async (input) => {
+            const vScript = validateText(input.script, 'script');
+            if (!vScript.valid)
+                return { content: [{ type: 'text', text: JSON.stringify({ success: false, error: vScript.error }) }], isError: true };
+            if (input.session) {
+                const vS = validateIdentifier(input.session, 'session');
+                if (!vS.valid)
+                    return { content: [{ type: 'text', text: JSON.stringify({ success: false, error: vS.error }) }], isError: true };
+            }
             const { script, session } = input;
             return execBrowserCommand(['eval', script], session);
         },