fix(mcp): avoid top-level api_impact schema combinators

[koriyoshi2041]

Summary

• remove the top-level anyOf from the api_impact MCP input schema
• keep route and file optional at the transport layer so stricter provider validators can load the tool list
• add a regression test that rejects top-level anyOf / oneOf / allOf on this schema while relying on the existing runtime guard for missing lookup keys

Fixes #2487.

Verification

• npx vitest run test/unit/tools.test.ts
• npx vitest run test/unit/calltool-dispatch.test.ts
• npx tsc --noEmit

Risk

Low. The transport schema is looser, but callTool('api_impact', {}) still returns the existing structured error when neither route nor file is provided.

[vercel]

@koriyoshi2041 is attempting to deploy a commit to the NexusCore Team on Vercel.

A member of the Team first needs to authorize it.

[github-actions]

CI Report

✅ All checks passed

Pipeline Status

Stage	Status	Details
✅ Typecheck	success	tsc --noEmit
✅ Tests	success	unit tests, 3 platforms
✅ E2E	success	gitnexus-web changes only

Test Results

Tests	Passed	Failed	Skipped	Duration
14708	14646	0	62	18s

✅ All 14646 tests passed

62 test(s) skipped — expand for details

• PreToolUse augmentation filtering (integration) > CJS: emits the MCP-query hint on stdout, stderr silent by default, when a GitNexus MCP process owns the repo DB
• PreToolUse augmentation filtering (integration) > CJS: MCP-owner path emits the MCP query hint; stderr reason gated by GITNEXUS_DEBUG
• PreToolUse augmentation filtering (integration) > CJS: MCP-owner hint emits on stdout; stderr stays silent with GITNEXUS_DEBUG='0'
• PreToolUse augmentation filtering (integration) > CJS: MCP-owner hint emits on stdout; stderr stays silent with GITNEXUS_DEBUG='false'
• PreToolUse augmentation filtering (integration) > Plugin: emits the MCP-query hint on stdout, stderr silent by default, when a GitNexus MCP process owns the repo DB
• PreToolUse augmentation filtering (integration) > Plugin: MCP-owner path emits the MCP query hint; stderr reason gated by GITNEXUS_DEBUG
• PreToolUse augmentation filtering (integration) > Plugin: MCP-owner hint emits on stdout; stderr stays silent with GITNEXUS_DEBUG='0'
• PreToolUse augmentation filtering (integration) > Plugin: MCP-owner hint emits on stdout; stderr stays silent with GITNEXUS_DEBUG='false'
• MCP-owner hint throttle (PreToolUse hook silently skips when MCP server owns DB lock — defeats the purpose #2396) > CJS: emits once, then throttles within the window (marker gates it)
• MCP-owner hint throttle (PreToolUse hook silently skips when MCP server owns DB lock — defeats the purpose #2396) > Plugin: emits once, then throttles within the window (marker gates it)
• MCP hint pattern escaping (PreToolUse hook silently skips when MCP server owns DB lock — defeats the purpose #2396) > CJS: quote+newline pattern stays JSON-safe in additionalContext
• MCP hint pattern escaping (PreToolUse hook silently skips when MCP server owns DB lock — defeats the purpose #2396) > Plugin: quote+newline pattern stays JSON-safe in additionalContext
• Ladybug DB owner guard — production-shaped ps + failure modes (fix: skip Claude augment hook when GitNexus server owns DB #1493) > CJS: skips augment for real node_modules/gitnexus ps line (npx child)
• Ladybug DB owner guard — production-shaped ps + failure modes (fix: skip Claude augment hook when GitNexus server owns DB #1493) > CJS: npx parent command line is NOT treated as GitNexus server owner
• Ladybug DB owner guard — production-shaped ps + failure modes (fix: skip Claude augment hook when GitNexus server owns DB #1493) > CJS: skips augment for gitnexus serve child
• Ladybug DB owner guard — production-shaped ps + failure modes (fix: skip Claude augment hook when GitNexus server owns DB #1493) > CJS: ENOENT lsof → augment still runs (fail-open)
• Ladybug DB owner guard — production-shaped ps + failure modes (fix: skip Claude augment hook when GitNexus server owns DB #1493) > CJS: ETIMEDOUT lsof → augment skipped (fail-closed)
• Ladybug DB owner guard — production-shaped ps + failure modes (fix: skip Claude augment hook when GitNexus server owns DB #1493) > CJS: ETIMEDOUT lsof → emits hint on stdout, stderr silent by default
• Ladybug DB owner guard — production-shaped ps + failure modes (fix: skip Claude augment hook when GitNexus server owns DB #1493) > CJS: ETIMEDOUT lsof with wrapper disabled → identical fail-closed skip
• Ladybug DB owner guard — production-shaped ps + failure modes (fix: skip Claude augment hook when GitNexus server owns DB #1493) > CJS: bad wrapper (no -k support) is rejected by the self-test → still fail-closed
• Ladybug DB owner guard — production-shaped ps + failure modes (fix: skip Claude augment hook when GitNexus server owns DB #1493) > CJS: guard exit 124 (budget expiry) → fail-closed skip
• Ladybug DB owner guard — production-shaped ps + failure modes (fix: skip Claude augment hook when GitNexus server owns DB #1493) > CJS: guard signal-death (status null + signal, no error) → fail-closed skip
• Ladybug DB owner guard — production-shaped ps + failure modes (fix: skip Claude augment hook when GitNexus server owns DB #1493) > CJS: always-exit-0 stub guard is rejected → augment still runs and emits context
• Ladybug DB owner guard — production-shaped ps + failure modes (fix: skip Claude augment hook when GitNexus server owns DB #1493) > CJS: non-GitNexus ps line → augment runs
• Ladybug DB owner guard — production-shaped ps + failure modes (fix: skip Claude augment hook when GitNexus server owns DB #1493) > CJS: multiple PIDs — skip if any ps line is GitNexus MCP
• Ladybug DB owner guard — production-shaped ps + failure modes (fix: skip Claude augment hook when GitNexus server owns DB #1493) > CJS: ps ENOENT → augment runs (ignore that PID)
• Ladybug DB owner guard — production-shaped ps + failure modes (fix: skip Claude augment hook when GitNexus server owns DB #1493) > Plugin: skips augment for real node_modules/gitnexus ps line (npx child)
• Ladybug DB owner guard — production-shaped ps + failure modes (fix: skip Claude augment hook when GitNexus server owns DB #1493) > Plugin: npx parent command line is NOT treated as GitNexus server owner
• Ladybug DB owner guard — production-shaped ps + failure modes (fix: skip Claude augment hook when GitNexus server owns DB #1493) > Plugin: skips augment for gitnexus serve child
• Ladybug DB owner guard — production-shaped ps + failure modes (fix: skip Claude augment hook when GitNexus server owns DB #1493) > Plugin: ENOENT lsof → augment still runs (fail-open)
• Ladybug DB owner guard — production-shaped ps + failure modes (fix: skip Claude augment hook when GitNexus server owns DB #1493) > Plugin: ETIMEDOUT lsof → augment skipped (fail-closed)
• Ladybug DB owner guard — production-shaped ps + failure modes (fix: skip Claude augment hook when GitNexus server owns DB #1493) > Plugin: ETIMEDOUT lsof → emits hint on stdout, stderr silent by default
• Ladybug DB owner guard — production-shaped ps + failure modes (fix: skip Claude augment hook when GitNexus server owns DB #1493) > Plugin: ETIMEDOUT lsof with wrapper disabled → identical fail-closed skip
• Ladybug DB owner guard — production-shaped ps + failure modes (fix: skip Claude augment hook when GitNexus server owns DB #1493) > Plugin: bad wrapper (no -k support) is rejected by the self-test → still fail-closed
• Ladybug DB owner guard — production-shaped ps + failure modes (fix: skip Claude augment hook when GitNexus server owns DB #1493) > Plugin: guard exit 124 (budget expiry) → fail-closed skip
• Ladybug DB owner guard — production-shaped ps + failure modes (fix: skip Claude augment hook when GitNexus server owns DB #1493) > Plugin: guard signal-death (status null + signal, no error) → fail-closed skip
• Ladybug DB owner guard — production-shaped ps + failure modes (fix: skip Claude augment hook when GitNexus server owns DB #1493) > Plugin: always-exit-0 stub guard is rejected → augment still runs and emits context
• Ladybug DB owner guard — production-shaped ps + failure modes (fix: skip Claude augment hook when GitNexus server owns DB #1493) > Plugin: non-GitNexus ps line → augment runs
• Ladybug DB owner guard — production-shaped ps + failure modes (fix: skip Claude augment hook when GitNexus server owns DB #1493) > Plugin: multiple PIDs — skip if any ps line is GitNexus MCP
• Ladybug DB owner guard — production-shaped ps + failure modes (fix: skip Claude augment hook when GitNexus server owns DB #1493) > Plugin: ps ENOENT → augment runs (ignore that PID)
• buildTypeEnv > known limitations (documented skip tests) > Ruby block parameter: users.each { |user| } — closure param inference, different feature
• Go pipeline benchmark > scales with file count (workers enabled)
• Go pipeline benchmark — worker pool (issue Worker idle timeout kills long Go scope extraction and surfaces as Napi::Error during analyze #1848) > does not quarantine the large generated Go file on sub-batch idle timeout
• Go structural interface detection benchmark > scales linearly with interface × struct count
• Go structural interface detection split-phase benchmark > separates index-build and detection time
• antigravity hook adapter e2e > AfterTool — MCP-query hint when MCP server owns the DB (PreToolUse hook silently skips when MCP server owns DB lock — defeats the purpose #2396) > emits the MCP-query hint on stdout, no stderr noise, exit 0 (CLI augment never ran)
• antigravity hook adapter e2e > AfterTool — MCP-query hint when MCP server owns the DB (PreToolUse hook silently skips when MCP server owns DB lock — defeats the purpose #2396) > surfaces the skip reason on stderr only under GITNEXUS_DEBUG=1
• C# pipeline benchmark > scales with file count — namespaces spread across the solution
• C# pipeline benchmark > scales with file count — all types in one (global) namespace bucket
• C# pipeline benchmark > scales with file count — all types in one (named) namespace bucket
• C++ pipeline benchmark > scales with file count
• Rust pipeline benchmark > scales with file count (workers enabled)
• C++ ADL emit benchmark > emit phase scales sub-quadratically with co-scaled files and sites
• PHP pipeline benchmark > scales with file count (workers enabled)
• getOsPageSize > returns undefined on Windows without forking
• COBOL pipeline benchmark > scales with file count
• Vue pipeline benchmark > scales with component count
• Spring inheritance scaling benchmark (Spring route extraction: ingestion does not resolve interface-inherited mappings (#2280) #2288) > scales linearly with interface×controller pair count
• Spring inheritance pipeline benchmark — end-to-end (Spring route extraction: ingestion does not resolve interface-inherited mappings (#2280) #2288) > full analyze scales linearly with interface→controller pair count
• Ruby pipeline benchmark > scales with file count (workers enabled)
• C++ capture identifier-type-lookup benchmark > capture emit scales sub-quadratically with co-scaled enums and call sites
• run.cjs direct-exec entrypoint (fix(cli): steer docs, skills, and hooks through a CLI-neutral project-local runner (#1939) #1945) > resolves a .cmd shim via the Windows shell branch, passing args and exit code

Code Coverage

Tests

Metric	Coverage	Covered	Base	Delta	Status
Statements	80.94%	54609/67464	80.71%	📈 +0.2	🟢 ████████████████░░░░
Branches	68.06%	33505/49223	67.75%	📈 +0.3	🟢 █████████████░░░░░░░
Functions	87.07%	6339/7280	86.75%	📈 +0.3	🟢 █████████████████░░░
Lines	84.46%	48707/57666	84.24%	📈 +0.2	🟢 ████████████████░░░░

---

_{📋 View full run · Generated by CI}

[100yenadmin]

Downstream validation from the Electric maintenance fork is now complete: electricsheephq#123

The fork generalized the compatibility contract across every advertised MCP tool: no top-level anyOf, oneOf, or allOf; existing property names remain stable; and the api_impact route/file plus impact target/name/symbol requirements are enforced during runtime normalization before repository resolution. The focused matrix covers canonical, agreeing, conflicting, missing, grouped, read-only, allowlisted, stdio, and HTTP paths. All 317 focused cases and the complete cross-platform PR matrix passed at exact head 3d0daebd9738a7f53b71dae3a458b72550e9f766.

This is provider-neutral implementation evidence; the tests use deterministic temporary data and contain no credentials or private repository policy.

[koriyoshi2041]

CI readback after the rebase: all quality/typecheck/build/CodeQL jobs passed. The only non-Vercel failure is tests / windows-latest (platform-sensitive) 1/3, where test/integration/lbug-multiwriter-deadlock.test.ts hit the 15-minute Vitest timeout after the real checkpoint-vs-reader race test retried once.

That test looks unrelated to this PR's api_impact schema diff; the same run has Windows shards 2/3 and 3/3 green. I tried to rerun failed jobs, but GitHub requires repo admin rights for that action on this repo.

[magyargergo]

Review: PR #2489 (rios/bedrock-api-impact-schema @ 470384b vs merge-base a05b501)

Findings

• [MEDIUM] gitnexus/test/unit/tools.test.ts — the branch is CONFLICTING with main and cannot be merged as-is (inline comment with resolution guidance). This is the only blocking item.

No defects found in the change itself.

Change and blast-radius summary

• The fix is real and verified end-to-end: server.ts:157 forwards inputSchema verbatim in ListTools, so the top-level anyOf did reach Bedrock's validator; removing it addresses TOOL_SCHEMA_INVALID (#2487).
• The runtime guard the PR relies on exists and is structured: local-backend.ts apiImpact() returns { error: 'Either "route" or "file" parameter is required.' } when both are missing — no behavioral hole opens up from loosening the transport schema.
• The tool description already documents the constraint (tools.ts:744 — Requires at least "route" or "file" parameter), and the new test pins it.
• Removing the anyOf field from the ToolDefinition interface is safe: after merging with current main there are no remaining writers or readers of inputSchema.anyOf anywhere in gitnexus/ or gitnexus-web/ (only negative toHaveProperty assertions in tests, which don't depend on the TS type).
• This matches the repo's established direction — main's 3f3494f ("fix(mcp): validate aliases without schema combinators") applied the same no-top-level-combinators pattern to the impact tool.
• GitNexus detect_changes (compare vs merge-base): LOW risk, 0 affected execution flows. Graph impact on GITNEXUS_TOOLS returned 0 upstream hits, so consumers were verified by source instead: server.ts (ListTools) and the schema self-check loop at tools.ts:896.
• No competing fix landed on main; #2487 is still open and this PR is the only candidate.

Coverage and residual risk

• The regression test locks out anyOf/oneOf/allOf at the top level of the api_impact schema and asserts the description carries the requirement; calltool-dispatch.test.ts already covers the runtime rejection path.
• The failing tests / windows-latest 1/3 shard is test/integration/lbug-multiwriter-deadlock.test.ts — an LadybugDB multi-writer integration test unrelated to this 2-file MCP schema change (known Windows flake family). CI Gate is red only transitively; the rebase this review requires will trigger fresh CI anyway.
• Out of scope but worth tracking from the #2487 discussion: the client-side swallowing of Bedrock's 400 into a generic streaming error is a separate diagnosability issue this PR doesn't (and needn't) address.

Verdict

REQUEST CHANGES — solely for mergeability. Rebase onto main and resolve the tools.test.ts conflict; the change itself is correct and I'll approve once the branch is mergeable with green (or flake-explained) CI.

---

Reviewed with the gitnexus-review skill (PR #2431) — GitNexus detect_changes/impact + source verification in a detached worktree at head.

[magyargergo]

[MEDIUM — the one blocking item] This file conflicts with current main: since your branch point (a05b501), main added adjacent tests in this exact region — context tool advertises file as a compatibility alias right above, and impact tool requires direction … without combinators right below (from 3f3494f/a75844b6) — while this PR rewrites the api_impact test in between, so the merge is positional-conflicted.

Resolution is mechanical: rebase onto main, keep both of main's neighboring tests unchanged, and take this PR's rewritten api_impact test in place of the old anyOf one. Your interface-field removal in tools.ts auto-merges cleanly (verified with git merge-tree), and post-merge nothing else reads or writes inputSchema.anyOf.

For the record, the red tests / windows-latest 1/3 shard is lbug-multiwriter-deadlock.test.ts — unrelated to this change; the rebase push will re-run CI.

[koriyoshi2041]

Rebased onto current main and resolved the tools.test.ts conflict while preserving the newer context-alias and impact-schema coverage. Focused MCP tests pass (258/258); new head is cb33f6ba and fresh CI is running.