fullstackgtm 0.47.0 → 0.49.0

package/src/marketClassify.ts

@@ -276,9 +276,68 @@ export type MarketWorksheet = {
   vendor: { id: string; name: string };
   claims: MarketClaim[];
   pages: Array<{ kind: CaptureEntry["kind"]; url: string; captureHash: string; text: string }>;
+  /** Deterministic retrieval hints: page lines that contain claim terms. These are not labels. */
+  claimHints: Array<{
+    claimId: string;
+    matches: Array<{ url: string; captureHash: string; term: string; quote: string }>;
+  }>;
   instructions: string;
 };
 
+const HINT_STOPWORDS = new Set([
+  "the", "and", "for", "with", "from", "that", "this", "into", "your", "you", "are", "but", "not", "when", "how", "use", "uses", "using",
+  "claim", "claims", "vendor", "vendors", "page", "pages", "loud", "quiet", "absent", "capability", "specific", "differentiating",
+  "unknown", "buyer", "buyers", "pricing", "structure", "category", "support", "supported", "primary", "secondary", "mentioned", "mentions",
+]);
+
+function normalizeHintText(value: string): string {
+  return value.toLowerCase().replace(/[^a-z0-9]+/g, " ").trim().replace(/\s+/g, " ");
+}
+
+function claimHintTerms(claim: MarketClaim): string[] {
+  const exact = [claim.id.replace(/[-_]+/g, " "), claim.capability, ...(claim.terms ?? [])]
+    .map(normalizeHintText)
+    .filter((term) => term.length >= 3);
+  const tokenSource = normalizeHintText(`${claim.capability} ${claim.definition} ${(claim.terms ?? []).join(" ")}`)
+    .split(" ")
+    .filter((term) => term.length >= 4 && !HINT_STOPWORDS.has(term));
+  return Array.from(new Set([...exact, ...tokenSource])).slice(0, 24);
+}
+
+function lineSnippet(line: string, term: string): string {
+  const clean = line.trim().replace(/\s+/g, " ");
+  if (clean.length <= 300) return clean;
+  const lower = clean.toLowerCase();
+  const idx = lower.indexOf(term.toLowerCase().split(" ")[0] ?? "");
+  const start = Math.max(0, idx < 0 ? 0 : idx - 120);
+  return clean.slice(start, start + 300).trim();
+}
+
+function buildClaimHints(
+  claims: MarketClaim[],
+  pages: Array<{ kind: CaptureEntry["kind"]; url: string; captureHash: string; text: string }>,
+): MarketWorksheet["claimHints"] {
+  return claims.map((claim) => {
+    const terms = claimHintTerms(claim);
+    const matches: Array<{ url: string; captureHash: string; term: string; quote: string }> = [];
+    for (const page of pages) {
+      const lines = page.text.split(/\r?\n/).map((line) => line.trim()).filter(Boolean);
+      for (const term of terms) {
+        const normalizedTerm = normalizeHintText(term);
+        const line = lines.find((candidate) => normalizeHintText(candidate).includes(normalizedTerm));
+        if (!line) continue;
+        const quote = lineSnippet(line, term);
+        if (quote && !matches.some((m) => m.quote === quote && m.url === page.url)) {
+          matches.push({ url: page.url, captureHash: page.captureHash, term, quote });
+        }
+        if (matches.length >= 4) break;
+      }
+      if (matches.length >= 4) break;
+    }
+    return { claimId: claim.id, matches };
+  });
+}
+
 export function buildWorksheet(
   config: MarketConfig,
   vendorId: string,
@@ -304,7 +363,8 @@ export function buildWorksheet(
     vendor: { id: vendor.id, name: vendor.name },
     claims: config.claims,
     pages,
+    claimHints: buildClaimHints(config.claims, pages),
     instructions:
-      "Produce one observation per claim (intensity loud|quiet|absent from these pages only; unobservable only if a page you need failed to capture). Every loud/quiet reading must quote a verbatim span (≤300 chars) from a page's text, with that page's url and captureHash in evidence metadata. Submit as an ObservationSet via `market observe --from <file>` — quotes are mechanically verified against the captures.",
+      "Produce one observation per claim from these pages only. Intensity rubric: loud = hero copy, primary positioning, or a named/dedicated product area; quiet = supported by a verbatim page quote but secondary, qualified, or merely available; absent = the pages do not support the claim; unobservable = no usable captured page exists for this vendor, not a synonym for absent. claimHints are deterministic retrieval hints only: use them to find candidate support, but do not mark a claim loud/quiet unless the quote truly supports the claim. Every loud/quiet reading must quote a verbatim span (≤300 chars) from a page's text, with that page's url and captureHash in evidence metadata. Submit as an ObservationSet via `market observe --from <file>` — quotes are mechanically verified against the captures.",
   };
 }

package/src/marketSourcing.ts

@@ -16,7 +16,7 @@
  *    Sitemaps / redirects / logo bytes are plain resources — they never need a
  *    headless browser, so the default fetch is sufficient even in the hosted layer.
  */
-import { assertPublicUrl } from "./market.ts";
+import { publicHttpGet } from "./publicHttp.ts";
 import { DEFAULT_MODELS, forcedToolCall, type LlmCallOptions } from "./llm.ts";
 
 const USER_AGENT = "fullstackgtm-market/0 (+https://github.com/fullstackgtm/core)";
@@ -161,27 +161,9 @@ export function extractLogoUrl(html: string, baseUrl: string): string | null {
 
 /** Manual-redirect fetch that re-validates every hop against the SSRF guard. */
 async function guardedFetch(url: string): Promise<Response | null> {
-  let current = url;
-  for (let hop = 0; hop <= MAX_REDIRECTS; hop++) {
-    await assertPublicUrl(current);
-    const res = await fetch(current, {
-      redirect: "manual",
-      signal: AbortSignal.timeout(FETCH_TIMEOUT_MS),
-      headers: { "User-Agent": USER_AGENT },
-    });
-    const location = res.headers.get("location");
-    if (res.status >= 300 && res.status < 400 && location) {
-      try {
-        await res.body?.cancel();
-      } catch {
-        /* ignore */
-      }
-      current = new URL(location, current).toString();
-      continue;
-    }
-    return res;
-  }
-  return null;
+  const res = await publicHttpGet(url, { maxRedirects: MAX_REDIRECTS, timeoutMs: FETCH_TIMEOUT_MS,
+    headers: { "User-Agent": USER_AGENT } });
+  return new Response(res.body.length ? Buffer.from(res.body) : null, { status: res.status, headers: res.headers });
 }
 
 const defaultFetchText: FetchText = async (url) => {
@@ -210,27 +192,9 @@ const defaultFetchBytes: FetchBytes = async (url) => {
  * + status WITHOUT downloading the body. Used to detect identity drift.
  */
 export const resolveFinalUrl: ResolveUrl = async (rawUrl) => {
-  let current = rawUrl;
-  for (let hop = 0; hop <= MAX_REDIRECTS; hop++) {
-    await assertPublicUrl(current);
-    const res = await fetch(current, {
-      redirect: "manual",
-      signal: AbortSignal.timeout(FETCH_TIMEOUT_MS),
-      headers: { "User-Agent": USER_AGENT },
-    });
-    try {
-      await res.body?.cancel();
-    } catch {
-      /* ignore */
-    }
-    const location = res.headers.get("location");
-    if (res.status >= 300 && res.status < 400 && location) {
-      current = new URL(location, current).toString();
-      continue;
-    }
-    return { finalUrl: current, status: res.status };
-  }
-  return { finalUrl: current, status: 0 };
+  const res = await publicHttpGet(rawUrl, { maxRedirects: MAX_REDIRECTS, timeoutMs: FETCH_TIMEOUT_MS,
+    maxBytes: 0, headers: { "User-Agent": USER_AGENT } });
+  return { finalUrl: res.finalUrl, status: res.status };
 };
 
 // ── Fetching helpers ─────────────────────────────────────────────────────────

package/src/mcp.ts

@@ -1,3 +1,4 @@
+import type { ZodRawShape } from "zod/v4";
 import { readFileSync } from "node:fs";
 import { createRequire } from "node:module";
 import { join, resolve } from "node:path";
@@ -54,11 +55,12 @@ import { generateDemoSnapshot } from "./demo.ts";
 import type { FieldMappings } from "./mappings.ts";
 import { formatPatchPlanRun, patchPlanToMarkdown } from "./format.ts";
 import { verifyApprovalDigests } from "./integrity.ts";
-import { createFilePlanStore, type StoredPlan } from "./planStore.ts";
+import { createFilePlanStore } from "./planStore.ts";
 import { builtinAuditRules } from "./rules.ts";
 import { sampleSnapshot } from "./sampleData.ts";
 import { normalizeTranscript, parseCall } from "./calls.ts";
 import { extractInsightsLlm, resolveLlmCredential } from "./llm.ts";
+
 import {
   computeFrontStates,
   createFileObservationStore,
@@ -159,13 +161,17 @@ function packageVersion() {
   }
 }
 
+function strictSchema<T extends ZodRawShape>(shape: T) {
+  return z.object(shape).strict();
+}
+
 type ToolDefinition = {
   name: string;
   // Whether the tool can write to a CRM. Everything else reads, or writes
   // only local workspace state (market_observe appends to the local
   // observation store).
   writesCrm: boolean;
-  config: { title: string; description: string; inputSchema?: Record<string, unknown> };
+  config: { title: string; description: string; inputSchema?: unknown };
   // Args are validated by the SDK against config.inputSchema before the
   // handler runs; the loose typing here is what lets one table drive a
   // registration loop instead of per-call generics.
@@ -187,7 +193,7 @@ const toolDefinitions: ToolDefinition[] = [
         "Run a dry-run GTM hygiene audit and return a reviewable patch plan. " +
         "Sources: the realistic zero-credential demo CRM (provider: \"demo\" — richest test data), " +
         "the minimal sample dataset, a snapshot file, or a live provider.",
-      inputSchema: {
+      inputSchema: strictSchema({
         provider: z.enum(["sample", "demo", "hubspot", "salesforce", "stripe"]).optional(),
         inputPath: z.string().optional(),
         configPath: z.string().optional(),
@@ -195,14 +201,23 @@ const toolDefinitions: ToolDefinition[] = [
         output: z.enum(["json", "markdown"]).optional(),
         today: z.string().optional(),
         staleDealDays: z.number().int().positive().optional(),
-      },
+      }),
     },
     handler: async ({ provider, inputPath, configPath, rules, output, today, staleDealDays }) => {
       const loaded = configPath ? loadConfig(configPath) : null;
+      if (loaded?.config.rulePackages?.length) {
+        throw new Error(
+          "MCP refuses executable rulePackages from tool-call configPath. " +
+            "MCP plugin execution is disabled because mutable tool-call paths are not a durable code-trust boundary. " +
+            "Run reviewed plugins through the CLI with --config <path> --allow-plugins instead.",
+        );
+      }
       const policy = mergePolicy(defaultPolicy(today), loaded?.config);
       if (today) policy.today = today;
       if (staleDealDays !== undefined) policy.staleDealDays = staleDealDays;
-      const ruleSet = await resolveConfiguredRules(loaded);
+      const ruleSet = await resolveConfiguredRules(loaded, undefined, {
+        disableRulePackages: true,
+      });
       const selected = rules?.length
         ? ruleSet.filter((rule: { id: string }) => rules.includes(rule.id))
         : ruleSet;
@@ -219,11 +234,11 @@ const toolDefinitions: ToolDefinition[] = [
         "Derive values for a plan's requires_human_* placeholder operations from snapshot " +
         "evidence (account-name matching, contact associations), with confidence levels and " +
         "reasons. Read-only; feed accepted values into fullstackgtm_apply's valueOverrides.",
-      inputSchema: {
+      inputSchema: strictSchema({
         planPath: z.string(),
         provider: z.enum(["sample", "demo", "hubspot", "salesforce", "stripe"]).optional(),
         inputPath: z.string().optional(),
-      },
+      }),
     },
     handler: async ({ planPath, provider, inputPath }) => {
       const plan = JSON.parse(readFileSync(resolve(process.cwd(), planPath), "utf8")) as PatchPlan;
@@ -242,14 +257,14 @@ const toolDefinitions: ToolDefinition[] = [
         "uses LLM extraction when an Anthropic/OpenAI key is configured in the server " +
         "environment or credential store, else the free deterministic keyword baseline; " +
         "'llm' and 'deterministic' force either. Read-only; every insight is provenance-marked.",
-      inputSchema: {
+      inputSchema: strictSchema({
         transcript: z.string().optional(),
         transcriptPath: z.string().optional(),
         title: z.string().optional(),
         source: z.enum(["gong", "chorus", "fathom", "manual", "csv", "unknown"]).optional(),
         extractor: z.enum(["auto", "llm", "deterministic"]).optional(),
         model: z.string().optional(),
-      },
+      }),
     },
     handler: async ({ transcript, transcriptPath, title, source, extractor, model }) => {
       const raw =
@@ -287,7 +302,7 @@ const toolDefinitions: ToolDefinition[] = [
         "(exists | ambiguous | safe_to_create) with matches and a reason, using the same " +
         "identity keys as the audit/merge engines (account domain, contact email, open-deal " +
         "key). Read-only. Never create on 'exists' or 'ambiguous'.",
-      inputSchema: {
+      inputSchema: strictSchema({
         objectType: z.enum(["account", "contact", "deal"]),
         name: z.string().optional(),
         domain: z.string().optional(),
@@ -295,7 +310,7 @@ const toolDefinitions: ToolDefinition[] = [
         accountId: z.string().optional(),
         provider: z.enum(["sample", "demo", "hubspot", "salesforce", "stripe"]).optional(),
         inputPath: z.string().optional(),
-      },
+      }),
     },
     handler: async ({ objectType, name, domain, email, accountId, provider, inputPath }) => {
       const snapshot = await readSnapshot(provider, inputPath);
@@ -308,7 +323,7 @@ const toolDefinitions: ToolDefinition[] = [
     config: {
       title: "List Audit Rules",
       description: "List the built-in deterministic audit rules with ids and descriptions.",
-      inputSchema: {},
+      inputSchema: strictSchema({}),
     },
     handler: async () => {
       return content(
@@ -322,143 +337,104 @@ const toolDefinitions: ToolDefinition[] = [
     config: {
       title: "Apply Approved Patch Operations",
       description:
-        "Apply explicitly approved operations from a patch plan through a provider " +
-        "connector. Operations not listed in approvedOperationIds are never written, " +
-        "and requires_human_* placeholders need a value override. When the plan is in " +
-        "the local plan store (saved via `audit --save`), approvals are verified against " +
-        "the store's HMAC approval digests — ids not approved with `plans approve` are " +
-        "refused — and the run is recorded onto the stored plan so `plans show` and " +
+        "Apply a stored, human-approved patch plan through a provider connector. The plan, " +
+        "approved operation ids, and concrete placeholder values are loaded exclusively from " +
+        "the local plan store and verified against its HMAC approval digests. Callers cannot " +
+        "supply or widen approvals. Every apply run is recorded so `plans show` and " +
         "`audit-log export` include it.",
-      inputSchema: {
+      inputSchema: strictSchema({
         provider: z.enum(["hubspot", "salesforce"]),
-        planPath: z.string(),
-        approvedOperationIds: z.array(z.string()).min(1),
-        valueOverrides: z.record(z.string(), z.string()).optional(),
+        planId: z.string().regex(/^[\w.-]+$/),
         output: z.enum(["json", "markdown"]).optional(),
-      },
+      }),
     },
-    handler: async ({ provider, planPath, approvedOperationIds, valueOverrides, output }) => {
-      // The file may be a raw PatchPlan (audit --out) or a StoredPlan envelope
-      // (a file straight out of the plan-store directory).
-      const parsed = JSON.parse(readFileSync(resolve(process.cwd(), planPath), "utf8")) as unknown;
-      const filePlan = isStoredPlanFile(parsed) ? parsed.plan : (parsed as PatchPlan);
-      if (!filePlan || !Array.isArray(filePlan.operations)) {
-        throw new Error(`${planPath} is not a patch plan (expected { id, operations: [...] }).`);
-      }
-
-      // Governance parity with CLI apply: when this plan id exists in the local
-      // plan store, the STORE is the source of truth — the approved-id set must
-      // come from `plans approve` (which HMAC-signed each approved op), the
-      // signatures are re-verified here, and the run is recorded back onto the
-      // plan so audit-log export sees MCP applies exactly like CLI applies.
+    handler: async ({ provider, planId, output }) => {
+      // The store is the only authority accepted over MCP. In particular, do
+      // not accept a plan body/path, approval ids, or value overrides from the
+      // agent call: combining proposal and approval in one call defeats the
+      // human approval boundary the plan lifecycle is meant to enforce.
       const store = createFilePlanStore();
-      const stored =
-        typeof filePlan.id === "string" && /^[\w.-]+$/.test(filePlan.id)
-          ? await store.get(filePlan.id)
-          : null;
-
-      let plan: PatchPlan;
-      let effectiveOverrides: Record<string, unknown>;
-      if (stored) {
-        if (stored.status !== "approved") {
-          throw new Error(
-            `Plan ${filePlan.id} is ${stored.status}; approve operations first with ` +
-              `\`fullstackgtm plans approve ${filePlan.id} --operations <ids|all>\`.`,
-          );
-        }
-        // Downgrade guard (same as CLI apply): an approved plan with no
-        // signatures either predates 0.26 or had approvalDigests stripped to
-        // skip the integrity check. Refuse rather than trust the file.
-        if (stored.approvedOperationIds.length > 0 && !stored.approvalDigests) {
-          throw new Error(
-            `Refusing to apply plan ${filePlan.id}: it was approved without integrity signatures ` +
-              "(approved before 0.26.0, or its signatures were removed). Re-approve it with " +
-              `\`fullstackgtm plans approve ${filePlan.id} --operations <ids|all>\`.`,
-          );
-        }
-        // Never widen: every id the tool wants applied must already be
-        // store-approved. (A subset is fine — narrowing never writes more.)
-        const storeApproved = new Set(stored.approvedOperationIds);
-        const unapproved = approvedOperationIds.filter((id: string) => !storeApproved.has(id));
-        if (unapproved.length > 0) {
-          throw new Error(
-            `Refusing to apply plan ${filePlan.id}: operation(s) ${unapproved.join(", ")} were never ` +
-              "approved in the plan store. Approve them first with " +
-              `\`fullstackgtm plans approve ${filePlan.id} --operations <ids>\`.`,
-          );
-        }
-        // Integrity gate: verify against the EFFECTIVE overrides (stored ∪ tool
-        // args), so a tool-supplied value that changes what the human approved
-        // is treated as tamper, not a live override — what gets written must
-        // equal what was signed.
-        effectiveOverrides = { ...stored.valueOverrides, ...(valueOverrides ?? {}) };
-        const verification = verifyApprovalDigests(
-          stored.plan.operations,
-          stored.approvedOperationIds,
-          effectiveOverrides,
-          stored.approvalDigests,
+      const stored = await store.get(planId);
+      if (!stored) {
+        throw new Error(
+          `No stored plan with id ${planId}. Save it with \`fullstackgtm audit --save\`, then approve it with \`fullstackgtm plans approve\`.`,
         );
-        if (!verification.ok) {
-          const detail =
-            verification.reason === "no_key"
-              ? "the plan-signing key is missing (was this plan approved on another machine?). Re-approve it here with `fullstackgtm plans approve`."
-              : `these operations differ from what was approved: ${verification.tampered.join(", ")}. ` +
-                "If you want a different value, set it at approval (`plans approve --value <op>=<v>`) and re-approve; " +
-                "otherwise the plan was edited after approval — review and re-approve.";
-          throw new Error(`Refusing to apply plan ${filePlan.id}: ${detail}`);
-        }
-        plan = stored.plan; // apply what was signed, not what the file says now
-      } else {
-        // External plan file, not in the store: no digests exist to verify, but
-        // approvals must still reference real operations in the plan content.
-        plan = filePlan;
-        const known = new Set(plan.operations.map((operation) => operation.id));
-        const unknown = approvedOperationIds.filter((id: string) => !known.has(id));
-        if (unknown.length > 0) {
-          throw new Error(
-            `Plan ${planPath} has no operation(s) ${unknown.join(", ")} — approvedOperationIds ` +
-              "must reference operations in the plan.",
-          );
-        }
-        effectiveOverrides = valueOverrides ?? {};
+      }
+      if (stored.status !== "approved") {
+        throw new Error(
+          `Plan ${planId} is ${stored.status}; approve operations first with ` +
+            `\`fullstackgtm plans approve ${planId} --operations <ids|all>\`.`,
+        );
+      }
+      if (stored.approvedOperationIds.length === 0) {
+        throw new Error(`Plan ${planId} has no approved operations.`);
+      }
+      if (!stored.approvalDigests) {
+        throw new Error(
+          `Refusing to apply plan ${planId}: it was approved without integrity signatures ` +
+            "(approved before 0.26.0, or its signatures were removed). Re-approve it with " +
+            `\`fullstackgtm plans approve ${planId} --operations <ids|all>\`.`,
+        );
+      }
+      const verification = verifyApprovalDigests(
+        stored.plan.operations,
+        stored.approvedOperationIds,
+        stored.valueOverrides,
+        stored.approvalDigests,
+      );
+      if (!verification.ok) {
+        const detail =
+          verification.reason === "no_key"
+            ? "the plan-signing key is missing (was this plan approved on another machine?). Re-approve it here with `fullstackgtm plans approve`."
+            : `these operations differ from what was approved: ${verification.tampered.join(", ")}. ` +
+              "The stored plan or approved values changed after approval — review and re-approve.";
+        throw new Error(`Refusing to apply plan ${planId}: ${detail}`);
       }
 
-      const run = await applyPatchPlan(await connectorFor(provider), plan, {
-        approvedOperationIds,
-        valueOverrides: effectiveOverrides,
-      });
-
-      // Persist the run (same data the CLI records) so runs[] and plan status
-      // update and audit-log export includes MCP applies. External plan files
-      // have no store entry to update — say so instead of silently dropping it.
-      let runRecorded = false;
-      if (stored) {
-        await store.recordRun(plan.id, run);
-        runRecorded = true;
+      const connector = await connectorFor(provider);
+      // Claim only after all preflight checks and credential resolution. The
+      // atomic store transition prevents a second CLI/MCP process from
+      // applying the same approval concurrently.
+      const claimed = await store.claimApply(planId, { provider, source: "mcp" });
+      const claimedVerification = verifyApprovalDigests(
+        claimed.stored.plan.operations,
+        claimed.stored.approvedOperationIds,
+        claimed.stored.valueOverrides,
+        claimed.stored.approvalDigests,
+      );
+      if (!claimedVerification.ok) {
+        await store.abortApplyPreflight(
+          planId,
+          claimed.claimId,
+          "Approval integrity verification failed after the claim and before provider I/O.",
+        );
+        throw new Error(
+          `Refusing to apply plan ${planId}: the claimed plan differs from what was approved: ` +
+            `${claimedVerification.tampered.join(", ") || "signing key unavailable"}.`,
+        );
+      }
+      let run;
+      try {
+        run = await applyPatchPlan(connector, claimed.stored.plan, {
+          approvedOperationIds: claimed.stored.approvedOperationIds,
+          valueOverrides: claimed.stored.valueOverrides,
+        });
+      } catch (error) {
+        await store.markApplyUncertain(planId, claimed.claimId);
+        throw error;
       }
+      await store.recordRun(claimed.stored.plan.id, run, claimed.claimId);
       const governance = {
-        planSource: stored ? ("store" as const) : ("external" as const),
-        approvalDigestsVerified: stored !== null,
-        runRecorded,
-        ...(stored
-          ? {}
-          : {
-              note:
-                "Plan file is not in the local plan store: approvals came from tool arguments " +
-                "(verified against the plan content only — no approval-digest check) and the run " +
-                "was not recorded. Use `fullstackgtm audit --save` + `plans approve` for " +
-                "store-backed governance.",
-            }),
+        planSource: "store" as const,
+        approvalDigestsVerified: true,
+        runRecorded: true,
       };
       if (output === "markdown") {
         return content(
           `${formatPatchPlanRun(run)}\n\nGovernance: plan source ${governance.planSource}; ` +
-            (runRecorded
-              ? "approval digests verified; run recorded on the stored plan (audit-log export includes it)."
-              : governance.note!),
+            "approval digests verified; run recorded on the stored plan (audit-log export includes it).",
         );
       }
-      // Backward compatible: the run's own fields stay top-level; governance is additive.
       return content({ ...run, governance });
     },
   },
@@ -474,11 +450,11 @@ const toolDefinitions: ToolDefinition[] = [
         "and quote verbatim spans (≤300 chars) for every loud/quiet reading. Submit the full " +
         "ObservationSet via fullstackgtm_market_observe — quotes are verified character-for-" +
         "character against the captures, so never paraphrase.",
-      inputSchema: {
+      inputSchema: strictSchema({
         vendorId: z.string(),
         configPath: z.string().optional().describe("Path to market.config.json (default ./market.config.json)"),
         captureRun: z.string().optional(),
-      },
+      }),
     },
     handler: async ({ vendorId, configPath, captureRun }) => {
       const config = loadMarketConfigOrHint(resolve(process.cwd(), configPath ?? "market.config.json"));
@@ -495,10 +471,10 @@ const toolDefinitions: ToolDefinition[] = [
         "Validates coverage, the verbatim-evidence rule, and mechanically verifies every quoted " +
         "span against the stored capture it cites. Returns problems if rejected; nothing is " +
         "stored unless the whole set passes. Observations are append-only — use a new runLabel.",
-      inputSchema: {
+      inputSchema: strictSchema({
         observationsPath: z.string().describe("Path to the ObservationSet JSON file"),
         configPath: z.string().optional().describe("Path to market.config.json (default ./market.config.json)"),
-      },
+      }),
     },
     handler: async ({ observationsPath, configPath }) => {
       const config = loadMarketConfigOrHint(resolve(process.cwd(), configPath ?? "market.config.json"));
@@ -531,6 +507,7 @@ toolDefinitions.unshift({
       "Machine-readable contract for this MCP server: the tool inventory (derived from the " +
       "server's own registration table, with per-tool CRM-write flags), safety defaults, and " +
       "the CLI entrypoints for everything the tools don't cover.",
+    inputSchema: strictSchema({}),
   },
   handler: async () =>
     content({
@@ -545,7 +522,7 @@ toolDefinitions.unshift({
       })),
       safety:
         "Only tools flagged writesCrm can reach a CRM; fullstackgtm_apply writes only operations " +
-        "listed in approvedOperationIds and never writes requires_human_* placeholders without a value override.",
+        "from a stored plan whose ids and values were human-approved and HMAC-verified.",
       server: { command: "npx -y fullstackgtm-mcp" },
       cli: {
         command: "npx fullstackgtm <command> [--json]",
@@ -576,20 +553,6 @@ export async function startMcpServer() {
   await server.connect(transport);
 }
 
-/**
- * A plan-store file is a StoredPlan envelope ({ plan, status, runs, ... });
- * `audit --out` writes a bare PatchPlan. fullstackgtm_apply accepts either.
- */
-function isStoredPlanFile(value: unknown): value is StoredPlan {
-  if (typeof value !== "object" || value === null || !("plan" in value)) return false;
-  const plan = (value as { plan?: unknown }).plan;
-  return (
-    typeof plan === "object" &&
-    plan !== null &&
-    Array.isArray((plan as { operations?: unknown }).operations)
-  );
-}
-
 function loadMarketConfigOrHint(path: string): ReturnType<typeof loadMarketConfig> {
   try {
     return loadMarketConfig(path);