toolcraft 0.0.23 → 0.0.24

package/dist/mcp-proxy.js

@@ -1,6 +1,7 @@
 import { existsSync } from "node:fs";
-import { mkdir, readFile, rename, unlink, writeFile } from "node:fs/promises";
+import { lstat, mkdir, readFile, rename, writeFile } from "node:fs/promises";
 import path from "node:path";
+import { createHash, randomUUID } from "node:crypto";
 import { createLogger } from "@poe-code/design-system";
 import { HttpTransport, McpClient, StdioTransport } from "tiny-mcp-client";
 import { convertJsonSchema } from "./json-schema-converter.js";
@@ -153,6 +154,7 @@ async function ensureConnected(connection) {
 }
 async function readCache(cachePath) {
     try {
+        await assertCachePathHasNoSymlinks(cachePath);
         const raw = await readFile(cachePath, "utf8");
         const parsed = JSON.parse(raw);
         if (parsed === null ||
@@ -168,6 +170,7 @@ async function readCache(cachePath) {
             fetchedAt: typeof parsed.fetchedAt === "string" ? parsed.fetchedAt : new Date(0).toISOString(),
             tools: parsed.tools,
             upstream: parsed.upstream,
+            configFingerprint: typeof parsed.configFingerprint === "string" ? parsed.configFingerprint : undefined,
             version: parsed.version === 1 ? 1 : 1,
         };
     }
@@ -181,12 +184,17 @@ async function readCache(cachePath) {
 }
 async function writeCache(cachePath, cache) {
     const directory = path.dirname(cachePath);
-    const tempPath = `${cachePath}.tmp`;
+    const tempPath = `${cachePath}.tmp-${randomUUID()}`;
+    await assertCachePathHasNoSymlinks(cachePath);
+    await assertCachePathHasNoSymlinks(tempPath);
     await mkdir(directory, { recursive: true });
+    await assertCachePathHasNoSymlinks(directory);
     await writeFile(tempPath, `${JSON.stringify(cache, null, 2)}\n`);
+    await assertCachePathHasNoSymlinks(tempPath);
+    await assertCachePathHasNoSymlinks(cachePath);
     await rename(tempPath, cachePath);
 }
-async function fetchCache(name, config, cachePath) {
+async function fetchCache(name, config) {
     const logger = createLogger((message) => {
         process.stderr.write(`${message}\n`);
     });
@@ -210,27 +218,16 @@ async function fetchCache(name, config, cachePath) {
             $schema: MCP_PROXY_SCHEMA_URL,
             version: 1,
             upstream,
+            configFingerprint: fingerprintMcpServerConfig(config),
             fetchedAt: new Date().toISOString(),
             tools,
         };
-        await writeCache(cachePath, cache);
-        logger.info(`MCP ${name}: wrote ${cachePath}`);
         return cache;
     }
     finally {
         await client.close();
     }
 }
-async function deleteCacheIfPresent(cachePath) {
-    try {
-        await unlink(cachePath);
-    }
-    catch (error) {
-        if (error.code !== "ENOENT") {
-            throw error;
-        }
-    }
-}
 function populateGroupFromTools(group, tools, rename, connection) {
     removeProxyChildren(group);
     for (const tool of tools) {
@@ -262,6 +259,31 @@ function populateGroupFromTools(group, tools, rename, connection) {
         parent.children.push(createProxyCommand(parent, tool, commandName, connection));
     }
 }
+function replaceProxyChildrenSafely(group, tools, rename, connection) {
+    const previousChildren = snapshotGroupChildren(group);
+    try {
+        populateGroupFromTools(group, tools, rename, connection);
+    }
+    catch (error) {
+        for (const [capturedGroup, children] of previousChildren) {
+            capturedGroup.children = children;
+        }
+        throw error;
+    }
+}
+function snapshotGroupChildren(group) {
+    const snapshot = new Map();
+    const visit = (current) => {
+        snapshot.set(current, [...current.children]);
+        for (const child of current.children) {
+            if (child.kind === "group") {
+                visit(child);
+            }
+        }
+    };
+    visit(group);
+    return snapshot;
+}
 function isRefreshRequested(name, refresh) {
     if (refresh === "all") {
         return true;
@@ -279,19 +301,31 @@ async function resolveSingleProxy(group, options) {
         const cachePath = resolveCachePath(name, options.projectRoot);
         const refresh = parseRefreshEnv(process.env.TOOLCRAFT_MCP_REFRESH);
         let cache;
+        let shouldWriteCache = false;
         if (isRefreshRequested(name, refresh)) {
-            await deleteCacheIfPresent(cachePath);
-            cache = await fetchCache(name, config, cachePath);
+            cache = await fetchCache(name, config);
+            shouldWriteCache = true;
         }
         else {
-            cache = (await readCache(cachePath)) ?? (await fetchCache(name, config, cachePath));
+            const storedCache = await readCache(cachePath);
+            if (storedCache && cacheMatchesConfig(storedCache, config)) {
+                cache = storedCache;
+            }
+            else {
+                cache = await fetchCache(name, config);
+                shouldWriteCache = true;
+            }
         }
         const tools = filterAllowlistedTools(cache.tools, internal.tools);
         validateRenameMap(name, tools, internal.rename);
         const previousConnection = getProxyConnection(group);
         const nextConnection = createConnection(name, config);
         try {
-            populateGroupFromTools(group, tools, internal.rename, nextConnection);
+            replaceProxyChildrenSafely(group, tools, internal.rename, nextConnection);
+            if (shouldWriteCache) {
+                await writeCache(cachePath, cache);
+                createLogger((message) => process.stderr.write(`${message}\n`)).info(`MCP ${name}: wrote ${cachePath}`);
+            }
             setProxyConnection(group, nextConnection);
         }
         catch (error) {
@@ -309,6 +343,12 @@ async function resolveSingleProxy(group, options) {
         throw new Error(`couldn't discover MCP ${name}: ${error instanceof Error ? error.message : String(error)}`);
     }
 }
+function cacheMatchesConfig(cache, config) {
+    return cache.configFingerprint === fingerprintMcpServerConfig(config);
+}
+function fingerprintMcpServerConfig(config) {
+    return createHash("sha256").update(JSON.stringify(config)).digest("hex");
+}
 function collectProxyGroups(root) {
     const groups = [];
     function visit(group) {
@@ -348,8 +388,34 @@ export function resolveCachePath(name, projectRoot) {
     if (resolvedProjectRoot === undefined) {
         throw new Error(`Could not find package.json above "${process.cwd()}" while resolving MCP cache path.`);
     }
+    if (name.length === 0 || name === "." || name === ".." || name.includes("/") || name.includes("\\")) {
+        throw new Error(`MCP proxy group name must be a file-safe name: "${name}".`);
+    }
     return path.join(resolvedProjectRoot, ".toolcraft", "mcp", `${name}.json`);
 }
+async function assertCachePathHasNoSymlinks(filePath) {
+    let currentPath = filePath;
+    while (true) {
+        try {
+            if ((await lstat(currentPath)).isSymbolicLink()) {
+                throw new Error(`MCP cache path must not contain symbolic links: ${currentPath}.`);
+            }
+        }
+        catch (error) {
+            if (error.code !== "ENOENT") {
+                throw error;
+            }
+        }
+        if (path.basename(currentPath) === ".toolcraft") {
+            return;
+        }
+        const parentPath = path.dirname(currentPath);
+        if (parentPath === currentPath) {
+            return;
+        }
+        currentPath = parentPath;
+    }
+}
 export function parseRefreshEnv(value) {
     const trimmed = value?.trim();
     if (trimmed === undefined || trimmed.length === 0) {

package/dist/mcp.compile-check.js

@@ -15,6 +15,7 @@ const ignoredRoot = defineGroup({
     ],
 });
 const ignoredOptions = {
+    approvals: false,
     name: "toolcraft-test",
     version: "1.0.0",
     tools: ["usage"],

package/dist/mcp.d.ts

@@ -7,6 +7,7 @@ type CmdkitServer = Omit<TinyServer, "connect"> & {
     connect(transport: SDKTransport): Promise<void>;
 };
 export interface RunMCPOptions<TServices extends object = Record<string, unknown>> {
+    approvals?: boolean;
     name: string;
     version?: string;
     humanInLoop?: HumanInLoopRuntimeOptions;

package/dist/mcp.js

@@ -1,4 +1,4 @@
-import { access, readFile, writeFile } from "node:fs/promises";
+import { access, lstat, readFile, rename, unlink, writeFile } from "node:fs/promises";
 import { createServer, JSON_RPC_ERROR_CODES, ToolError } from "tiny-stdio-mcp-server";
 import { toJsonSchema } from "toolcraft-schema";
 import { ToolcraftBugError, UserError, assertCommandRequirements, resolveCommandSecrets } from "./index.js";
@@ -104,7 +104,10 @@ function createFs() {
             catch {
                 return false;
             }
-        }
+        },
+        lstat: async (path) => lstat(path),
+        rename: async (fromPath, toPath) => rename(fromPath, toPath),
+        unlink: async (path) => unlink(path)
     };
 }
 function createEnv(values = process.env) {
@@ -181,8 +184,24 @@ function matchesAllowlist(toolName, allowlist) {
 function formatToolName(path) {
     return path.map((segment) => formatSegment(segment, "snake")).join("__");
 }
+function validateUniqueMCPParameterFields(schema, casing) {
+    const sourceKeysByField = new Map();
+    for (const [key, rawChildSchema] of Object.entries(schema.shape)) {
+        const field = formatSegment(key, casing);
+        const existingKey = sourceKeysByField.get(field);
+        if (existingKey !== undefined) {
+            throw new UserError(`Parameters "${existingKey}" and "${key}" use conflicting MCP field "${field}".`);
+        }
+        sourceKeysByField.set(field, key);
+        const childSchema = unwrapOptional(rawChildSchema);
+        if (childSchema.kind === "object") {
+            validateUniqueMCPParameterFields(childSchema, casing);
+        }
+    }
+}
 function enumerateTools(root, casing, allowlist, omitRootToolNamePrefix) {
     const tools = [];
+    const commandPathsByToolName = new Map();
     function visit(node, toolPath, commandPath) {
         if (node.kind === "command") {
             if (!node.scope.includes("mcp")) {
@@ -196,9 +215,16 @@ function enumerateTools(root, casing, allowlist, omitRootToolNamePrefix) {
             if (params === undefined || params.kind !== "object") {
                 throw new ToolcraftBugError(`command "${name}" must define an object params schema for MCP.`);
             }
+            validateUniqueMCPParameterFields(params, casing);
+            const resolvedCommandPath = [...commandPath, node.name].join(".");
+            const existingPath = commandPathsByToolName.get(name);
+            if (existingPath !== undefined) {
+                throw new UserError(`MCP commands "${existingPath}" and "${resolvedCommandPath}" use conflicting tool name "${name}".`);
+            }
+            commandPathsByToolName.set(name, resolvedCommandPath);
             tools.push({
                 command: node,
-                commandPath: [...commandPath, node.name].join("."),
+                commandPath: resolvedCommandPath,
                 name,
                 description: buildToolDescription(node.description, params, casing),
                 inputSchema: applySchemaCasing(toJsonSchema(params), casing)
@@ -360,7 +386,12 @@ function validateObjectSchema(schema, value, casing, label, errors) {
         const fieldLabel = label.length === 0 ? inputKey : `${label}.${inputKey}`;
         if (!hasValue) {
             if (childSchema.default !== undefined) {
-                result[outputKey] = childSchema.default;
+                Object.defineProperty(result, outputKey, {
+                    value: childSchema.default,
+                    enumerable: true,
+                    configurable: true,
+                    writable: true
+                });
                 continue;
             }
             if (isOptional(rawChildSchema)) {
@@ -369,7 +400,12 @@ function validateObjectSchema(schema, value, casing, label, errors) {
             errors.push({ path: fieldLabel, message: `Missing required parameter "${fieldLabel}".` });
             continue;
         }
-        result[outputKey] = validateSchemaValue(rawChildSchema, value[inputKey], casing, fieldLabel, errors);
+        Object.defineProperty(result, outputKey, {
+            value: validateSchemaValue(rawChildSchema, value[inputKey], casing, fieldLabel, errors),
+            enumerable: true,
+            configurable: true,
+            writable: true
+        });
     }
     return result;
 }
@@ -430,7 +466,11 @@ function createResolvedMCPServer(root, options) {
     validateServices(services);
     const tools = enumerateTools(root, casing, options.tools, options.omitRootToolNamePrefix ?? false);
     const version = resolveMCPVersion(options.version);
-    const server = createServer({ name: options.name, version });
+    const server = createServer({
+        name: options.name,
+        version,
+        validateToolArguments: false
+    });
     for (const tool of tools) {
         server.tool(tool.name, tool.description, tool.inputSchema, async (argumentsValue) => {
             let params;
@@ -516,7 +556,8 @@ function createDeferredMCPServer(root, options) {
     });
 }
 export function createMCPServer(roots, options) {
-    const root = mergeApprovalsGroup(normalizeRoots(roots));
+    const normalizedRoot = normalizeRoots(roots);
+    const root = options.approvals === false ? normalizedRoot : mergeApprovalsGroup(normalizedRoot);
     if (!hasMcpProxyGroups(root)) {
         return createResolvedMCPServer(root, options);
     }
@@ -524,7 +565,8 @@ export function createMCPServer(roots, options) {
 }
 export async function runMCP(roots, options) {
     enableSourceMaps();
-    const root = mergeApprovalsGroup(normalizeRoots(roots));
+    const normalizedRoot = normalizeRoots(roots);
+    const root = options.approvals === false ? normalizedRoot : mergeApprovalsGroup(normalizedRoot);
     await resolveMcpProxies(root, { projectRoot: options.projectRoot });
     const server = createResolvedMCPServer(root, options);
     await server.listen();

package/dist/renderer.js

@@ -1,4 +1,5 @@
 import YAML from "yaml";
+import { renderDetailCard } from "@poe-code/design-system";
 function isObject(value) {
     return value !== null && typeof value === "object" && !Array.isArray(value);
 }
@@ -62,19 +63,117 @@ function stringifyJson(value, spaces) {
         return String(value);
     }
 }
+function humanizeKey(key) {
+    let output = "";
+    let capitalizeNext = true;
+    for (const char of key) {
+        if (char === "_" || char === "-") {
+            output += " ";
+            capitalizeNext = false;
+            continue;
+        }
+        if (char >= "A" && char <= "Z" && output.length > 0 && !output.endsWith(" ")) {
+            output += " ";
+        }
+        if (capitalizeNext) {
+            output += char.toUpperCase();
+            capitalizeNext = false;
+            continue;
+        }
+        output += char;
+    }
+    return output;
+}
+function detailRows(result, depth = 0) {
+    const rows = [];
+    for (const [key, value] of Object.entries(result)) {
+        const label = `${"  ".repeat(depth)}${humanizeKey(key)}`;
+        if (isObject(value)) {
+            if (Object.keys(value).length === 0) {
+                rows.push({ label, value: "{}" });
+                continue;
+            }
+            rows.push({ label, value: "" });
+            rows.push(...detailRows(value, depth + 1));
+            continue;
+        }
+        rows.push({ label, value: displayScalar(value) });
+    }
+    return rows;
+}
+function displayScalar(value) {
+    if (typeof value === "boolean") {
+        return value ? "Yes" : "No";
+    }
+    if (Array.isArray(value) && value.every((entry) => !isObject(entry) && !Array.isArray(entry))) {
+        return value.map((entry) => displayScalar(entry)).join(", ") || "—";
+    }
+    return stringifyValue(value) || "—";
+}
+function isUrl(value) {
+    return typeof value === "string" && (value.startsWith("https://") || value.startsWith("http://"));
+}
+function compactUrl(value) {
+    try {
+        const url = new URL(value);
+        const tail = url.pathname.split("/").filter(Boolean).at(-1);
+        return tail ? `${url.hostname}/…/${tail}` : url.hostname;
+    }
+    catch {
+        return value;
+    }
+}
+function displayRowValue(value) {
+    return isUrl(value) ? compactUrl(value) : displayScalar(value);
+}
+function directScalarRows(result) {
+    return Object.entries(result)
+        .filter(([, value]) => !isObject(value) && !Array.isArray(value))
+        .map(([key, value]) => ({ label: humanizeKey(key), value: displayRowValue(value) }));
+}
+function directObjectSections(result) {
+    return Object.entries(result)
+        .filter(([, value]) => isObject(value))
+        .map(([key, value]) => ({ title: humanizeKey(key), rows: detailRows(value) }))
+        .filter((section) => section.rows.length > 0);
+}
+function renderObjectCard(result, primitives, title) {
+    const scalarRows = directScalarRows(result);
+    const nestedSections = directObjectSections(result);
+    const listRows = Object.entries(result)
+        .filter(([, value]) => Array.isArray(value))
+        .map(([key, value]) => ({ label: humanizeKey(key), value: displayScalar(value) }));
+    return renderDetailCard({
+        theme: primitives.getTheme(),
+        title,
+        sections: [
+            { rows: scalarRows },
+            ...nestedSections,
+            { title: "Lists", rows: listRows }
+        ]
+    });
+}
+function richResultTitle(command) {
+    const description = command.description?.trim();
+    if (description && !description.includes("\n") && description.length <= 64) {
+        return description;
+    }
+    return command.name ? humanizeKey(command.name) : "Result";
+}
 export function renderObjectTable(result, primitives) {
-    const rows = Object.entries(result).map(([key, value]) => ({
-        key,
-        value: stringifyValue(value),
-    }));
+    const rows = detailRows(result);
+    if (rows.length === 0) {
+        return "{}";
+    }
     return primitives.renderTable({
         theme: primitives.getTheme(),
+        variant: "detail",
         columns: [
             {
-                name: "key",
-                title: "Key",
+                name: "label",
+                title: "Label",
                 alignment: "left",
-                maxLen: Math.max("Key".length, ...rows.map((row) => row.key.length)),
+                maxLen: Math.max("Label".length, ...rows.map((row) => row.label.length)),
             },
             {
                 name: "value",
@@ -111,9 +210,12 @@ export function renderArrayTable(result, primitives) {
             name,
             title: name,
             alignment: "left",
-            maxLen: Math.max(name.length, ...result.map((row) => (name in row ? stringifyValue(row[name]).length : 0))),
+            maxLen: Math.max(name.length, ...result.map((row) => Object.prototype.hasOwnProperty.call(row, name) ? stringifyValue(row[name]).length : 0)),
         })),
-        rows: result.map((row) => Object.fromEntries(columnNames.map((name) => [name, name in row ? stringifyValue(row[name]) : ""]))),
+        rows: result.map((row) => Object.fromEntries(columnNames.map((name) => [
+            name,
+            Object.prototype.hasOwnProperty.call(row, name) ? stringifyValue(row[name]) : ""
+        ]))),
     });
 }
 function renderArrayMarkdown(result) {
@@ -124,11 +226,13 @@ function renderArrayMarkdown(result) {
     const header = `| ${columnNames.join(" | ")} |`;
     const separator = `| ${columnNames.map(() => ":---").join(" | ")} |`;
     const rows = result.map((row) => `| ${columnNames
-        .map((name) => (name in row ? stringifyValue(row[name]).replaceAll("|", "\\|") : ""))
+        .map((name) => Object.prototype.hasOwnProperty.call(row, name)
+        ? stringifyValue(row[name]).replaceAll("|", "\\|")
+        : "")
         .join(" | ")} |`);
     return [header, separator, ...rows].join("\n");
 }
-function autoRender(result, output, _primitives) {
+function autoRender(command, result, output, primitives) {
     if (result === null || result === undefined) {
         if (output === "json") {
             return stringifyJson({ ok: true }, 2);
@@ -151,6 +255,7 @@ function autoRender(result, output, _primitives) {
         if (output === "json") {
             return stringifyJson(result, 2);
         }
+        return renderObjectCard(result, primitives, richResultTitle(command));
     }
     if (isArrayOfObjects(result)) {
         if (output === "md") {
@@ -159,6 +264,7 @@ function autoRender(result, output, _primitives) {
         if (output === "json") {
             return stringifyJson(result, 2);
         }
+        return renderArrayTable(result, primitives);
     }
     if (output === "rich") {
         return YAML.stringify(result);
@@ -175,7 +281,7 @@ export function renderResult(command, result, output, primitives, write = (chunk
     const unwrapped = unwrapMcpEnvelope(result);
     result = unwrapped.result;
     if (unwrapped.mcpError) {
-        const payload = autoRender(result, output, primitives);
+        const payload = autoRender(command, result, output, primitives);
         if (payload.length > 0) {
             write(`${payload}\n`, "stderr");
         }
@@ -199,7 +305,7 @@ export function renderResult(command, result, output, primitives, write = (chunk
         command.render.rich(result, primitives);
         return { mcpError: false };
     }
-    const payload = autoRender(result, output, primitives);
+    const payload = autoRender(command, result, output, primitives);
     if (payload.length > 0) {
         write(`${payload}\n`);
     }

package/dist/sdk.compile-check.js

@@ -89,6 +89,7 @@ const ignoredRoot = defineGroup({
     ],
 });
 const ignoredOptions = {
+    approvals: false,
     casing: "camel",
     services: {
         logger: console,

package/dist/sdk.d.ts

@@ -61,6 +61,7 @@ type SDKNodeShape<TNode, TInheritedScope extends ScopeInput, TInheritedHumanInLo
 } : never : EmptyRecord;
 type SDKChildrenShape<TChildren, TInheritedScope extends ScopeInput, TInheritedHumanInLoopMode extends HumanInLoopMode | undefined> = Simplify<UnionToIntersection<SDKNodeShape<RawChildrenValue<TChildren>, TInheritedScope, TInheritedHumanInLoopMode>>>;
 export interface CreateSDKOptions<TServices extends object = Record<string, unknown>> {
+    approvals?: boolean;
     services?: TServices;
     casing?: "camel";
     humanInLoop?: HumanInLoopRuntimeOptions;

package/dist/sdk.js

@@ -1,5 +1,5 @@
-import { access, readFile, writeFile } from "node:fs/promises";
-import { ToolcraftBugError, assertCommandRequirements, resolveCommandSecrets } from "./index.js";
+import { access, lstat, readFile, rename, unlink, writeFile } from "node:fs/promises";
+import { ToolcraftBugError, UserError, assertCommandRequirements, resolveCommandSecrets } from "./index.js";
 import { writeErrorReport } from "./error-report.js";
 import { mergeApprovalsGroup } from "./human-in-loop/approvals-commands.js";
 import { invokeWithHumanInLoop } from "./human-in-loop/index.js";
@@ -85,7 +85,10 @@ function createFs() {
             catch {
                 return false;
             }
-        }
+        },
+        lstat: async (path) => lstat(path),
+        rename: async (fromPath, toPath) => rename(fromPath, toPath),
+        unlink: async (path) => unlink(path)
     };
 }
 function createEnv(values = process.env) {
@@ -206,7 +209,12 @@ function validateObjectSchema(schema, value, label, errors) {
         const fieldLabel = label.length === 0 ? inputKey : `${label}.${inputKey}`;
         if (!hasValue) {
             if (childSchema.default !== undefined) {
-                result[outputKey] = childSchema.default;
+                Object.defineProperty(result, outputKey, {
+                    value: childSchema.default,
+                    enumerable: true,
+                    configurable: true,
+                    writable: true
+                });
                 continue;
             }
             if (isOptional(rawChildSchema)) {
@@ -215,10 +223,30 @@ function validateObjectSchema(schema, value, label, errors) {
             errors.push({ path: fieldLabel, message: `Missing required parameter "${fieldLabel}".` });
             continue;
         }
-        result[outputKey] = validateSchemaValue(rawChildSchema, value[inputKey], fieldLabel, errors);
+        Object.defineProperty(result, outputKey, {
+            value: validateSchemaValue(rawChildSchema, value[inputKey], fieldLabel, errors),
+            enumerable: true,
+            configurable: true,
+            writable: true
+        });
     }
     return result;
 }
+function validateUniqueSDKParameterMembers(schema) {
+    const sourceKeysByMember = new Map();
+    for (const [key, rawChildSchema] of Object.entries(schema.shape)) {
+        const member = formatSegment(key);
+        const existingKey = sourceKeysByMember.get(member);
+        if (existingKey !== undefined) {
+            throw new UserError(`Parameters "${existingKey}" and "${key}" use conflicting SDK member "${member}".`);
+        }
+        sourceKeysByMember.set(member, key);
+        const childSchema = unwrapOptional(rawChildSchema);
+        if (childSchema.kind === "object") {
+            validateUniqueSDKParameterMembers(childSchema);
+        }
+    }
+}
 function validateSDKArguments(schema, argumentsValue) {
     const errors = [];
     const result = validateObjectSchema(schema, argumentsValue ?? {}, "", errors);
@@ -238,7 +266,7 @@ function defineMember(target, key, value) {
 }
 export function createSDK(root, options = {}) {
     enableSourceMaps();
-    const mergedRoot = mergeApprovalsGroup(root);
+    const mergedRoot = options.approvals === false ? root : mergeApprovalsGroup(root);
     if (!hasMcpProxyGroups(mergedRoot)) {
         return createResolvedSDK(mergedRoot, options);
     }
@@ -251,6 +279,10 @@ function createResolvedSDK(root, options = {}) {
     validateServices(services);
     function build(node, path) {
         if (node.kind === "command") {
+            const sdkParamsSchema = filterSchemaForScope(node.params, "sdk");
+            if (sdkParamsSchema?.kind === "object") {
+                validateUniqueSDKParameterMembers(sdkParamsSchema);
+            }
             return async (params) => {
                 const commandPath = [...path, node.name].join(".");
                 let secrets;
@@ -298,19 +330,32 @@ function createResolvedSDK(root, options = {}) {
             };
         }
         const output = {};
+        const sourceNamesByMember = new Map();
         const nextPath = node === root ? path : [...path, node.name];
         for (const child of node.children) {
+            let childValue;
             if (child.kind === "command") {
                 if (!child.scope.includes("sdk")) {
                     continue;
                 }
-                defineMember(output, formatSegment(child.name), build(child, nextPath));
-                continue;
+                childValue = build(child, nextPath);
+            }
+            else {
+                childValue = build(child, nextPath);
+                if (!isPlainObject(childValue) || Object.keys(childValue).length === 0) {
+                    continue;
+                }
+            }
+            const member = formatSegment(child.name);
+            if (member === "then") {
+                throw new UserError(`SDK member "${child.name}" uses reserved member "then".`);
             }
-            const childValue = build(child, nextPath);
-            if (isPlainObject(childValue) && Object.keys(childValue).length > 0) {
-                defineMember(output, formatSegment(child.name), childValue);
+            const existingName = sourceNamesByMember.get(member);
+            if (existingName !== undefined) {
+                throw new UserError(`SDK members "${existingName}" and "${child.name}" use conflicting member "${member}".`);
             }
+            sourceNamesByMember.set(member, child.name);
+            defineMember(output, member, childValue);
         }
         return output;
     }

package/node_modules/@poe-code/agent-defs/dist/registry.d.ts

@@ -1,3 +1,3 @@
 import type { AgentDefinition } from "./types.js";
-export declare const allAgents: AgentDefinition[];
+export declare const allAgents: readonly AgentDefinition[];
 export declare function resolveAgentId(input: string): string | undefined;