fix: harden cloud code assist tool schema sanitizing (#665) (thanks @sebslight)

src/agents/pi-embedded-helpers.test.ts

@@ -363,6 +363,37 @@ describe("sanitizeSessionMessagesImages", () => {
     expect((content as Array<{ type?: string }>)[0]?.type).toBe("toolCall");
   });
 
+  it("sanitizes tool ids for assistant blocks and tool results", async () => {
+    const input = [
+      {
+        role: "assistant",
+        content: [
+          { type: "toolUse", id: "call_abc|item:123", name: "test", input: {} },
+          {
+            type: "toolCall",
+            id: "call_abc|item:456",
+            name: "bash",
+            arguments: {},
+          },
+        ],
+      },
+      {
+        role: "toolResult",
+        toolUseId: "call_abc|item:123",
+        content: [{ type: "text", text: "ok" }],
+      },
+    ] satisfies AgentMessage[];
+
+    const out = await sanitizeSessionMessagesImages(input, "test");
+
+    const assistant = out[0] as { content?: Array<{ id?: string }> };
+    expect(assistant.content?.[0]?.id).toBe("call_abc_item_123");
+    expect(assistant.content?.[1]?.id).toBe("call_abc_item_456");
+
+    const toolResult = out[1] as { toolUseId?: string };
+    expect(toolResult.toolUseId).toBe("call_abc_item_123");
+  });
+
   it("filters whitespace-only assistant text blocks", async () => {
     const input = [
       {

src/agents/pi-embedded-helpers.ts

@@ -106,12 +106,20 @@ export async function sanitizeSessionMessagesImages(
       const sanitizedToolCallId = toolMsg.toolCallId
         ? sanitizeToolCallId(toolMsg.toolCallId)
         : undefined;
+      const toolUseId = (toolMsg as { toolUseId?: unknown }).toolUseId;
+      const sanitizedToolUseId =
+        typeof toolUseId === "string" && toolUseId
+          ? sanitizeToolCallId(toolUseId)
+          : undefined;
       const sanitizedMsg = {
         ...toolMsg,
         content: nextContent,
         ...(sanitizedToolCallId && {
           toolCallId: sanitizedToolCallId,
         }),
+        ...(sanitizedToolUseId && {
+          toolUseId: sanitizedToolUseId,
+        }),
       };
       out.push(sanitizedMsg);
       continue;
@@ -153,9 +161,13 @@ export async function sanitizeSessionMessagesImages(
             if (typeof id !== "string" || !id) return block;
 
             // Cloud Code Assist tool blocks require ids matching ^[a-zA-Z0-9_-]+$.
-            if (type === "functionCall" || type === "toolUse" || type === "toolCall") {
+            if (
+              type === "functionCall" ||
+              type === "toolUse" ||
+              type === "toolCall"
+            ) {
               return {
-                ...((block as unknown) as Record<string, unknown>),
+                ...(block as unknown as Record<string, unknown>),
                 id: sanitizeToolCallId(id),
               };
             }

src/agents/pi-tools.test.ts

@@ -385,6 +385,18 @@ describe("createClawdbotCodingTools", () => {
       "$defs",
       "definitions",
       "examples",
+      "minLength",
+      "maxLength",
+      "minimum",
+      "maximum",
+      "multipleOf",
+      "pattern",
+      "format",
+      "minItems",
+      "maxItems",
+      "uniqueItems",
+      "minProperties",
+      "maxProperties",
     ]);
 
     const findUnsupportedKeywords = (
@@ -399,9 +411,24 @@ describe("createClawdbotCodingTools", () => {
         });
         return found;
       }
-      for (const [key, value] of Object.entries(
-        schema as Record<string, unknown>,
-      )) {
+
+      const record = schema as Record<string, unknown>;
+      const properties =
+        record.properties &&
+        typeof record.properties === "object" &&
+        !Array.isArray(record.properties)
+          ? (record.properties as Record<string, unknown>)
+          : undefined;
+      if (properties) {
+        for (const [key, value] of Object.entries(properties)) {
+          found.push(
+            ...findUnsupportedKeywords(value, `${path}.properties.${key}`),
+          );
+        }
+      }
+
+      for (const [key, value] of Object.entries(record)) {
+        if (key === "properties") continue;
         if (unsupportedKeywords.has(key)) {
           found.push(`${path}.${key}`);
         }