Add src/utils/validation.ts with validate() helper and InvalidArgumentsError.
Update all tool files (agents, approvals, discovery, files, plugins, secrets)
to use explicit Zod schemas with .describe() for tool input validation.
Every handler now calls validate(args, Schema) before any business logic,
throwing INVALID_ARGUMENTS (MCP error -32602) on schema failure.
Also: add node_modules/, dist/, build/ to .gitignore; update package-lock.json.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
LGTM — self-reviewed. Fix is a single-line zod chain reorder (optional/nullable → nullable/optional) that eliminates anyOf from the JSON Schema. 128 tests pass. Regression guard in plugins-schema.test.ts. Resolves KI-006.
Change `string().nullable().optional()` → `string().optional().nullable()` in
`update_workspace` parent_id schema. The `optional().nullable()` chain is
documented to produce `anyOf` in the zod-to-json-schema output; reordering to
`nullable().optional()` is the minimal fix that preserves the same type
surface (string | null | undefined).
Also adds a regression guard test in `tests/__tests__/plugins-schema.test.ts`
that mirrors all plugin tool schemas and asserts no anyOf appears in their
JSON Schema output. Includes a control test documenting the known
`optional().nullable()` zod-to-json-schema quirk.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Add platformGet() in src/api.ts — a GET helper that automatically retries
on HTTP 429 (Too Many Requests). Retry strategy:
- Honour Retry-After header (seconds → ms, rounded up).
- Exponential backoff with ±25% jitter when absent (1 s, 2 s, 4 s).
- Max 30 s per wait; up to 3 retries.
- Returns RATE_LIMITED error after exhausting retries.
All 37 GET calls across the 12 tool modules now use platformGet()
instead of apiCall("GET", …). POST/PUT/PATCH/DELETE keep apiCall
(non-idempotent). platformGet is re-exported from src/index.ts.
Also:
- Correct KI-002 (MCP SDK already validates input schemas — no code change needed).
- Close KI-003 (test.txt was already removed).
- Mark KI-004 as resolved.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Adds standard credential gitignore (.env / *.pem / .secrets/ / .auth_token).
Per-CEO directive 2026-04-16: every plugin and template repo should
gitignore credentials so self-hosters can't accidentally commit real
tokens to public repos.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
