Fix XML/YAML schemas, add security validations, and standardize templates
Messenger System:
- Update YAML examples to use canonical field names (from/to for single-agent, to_agents: "all" for broadcasts)
- Add file locking and atomic writes to receive-message.xml for concurrent safety
- Implement per-agent archiving under archive_dir
- Return structured output {messages, count, status_message} from all code paths
Pipeline Orchestrator:
- Sanitize pipeline names to [a-z0-9-_] with uniqueness token (HHmmss)
- Add path traversal validation for pipeline_id in all commands
- Add deadlock detection for cyclic/unmet dependencies
- Fix error_handling default and conditional completion status
Token Isolation (spawn-agent.xml):
- Add explicit config keys (agent_manifest, output_dir)
- Fix prompt construction flow (base_prompt -> final_prompt)
- Add output_file path validation and allow_overwrite flag
Core Tools:
- code-metrics.xml: Add default include patterns and expanded exclude list
- context-extractor.xml: Add exclude param, focus validation, security redaction
- dependency-check.xml: Add outdated_command to all package managers
- schema-validator.xml: Fix versions format, add deterministic error handling, wrap output in CDATA
Session Manager:
- Add tokens.max field (default 150000) to schema
- Unify token field names (saved instead of saved_by_isolation)
- Add Token Deserialization section with fallback logic
Templates:
- openapi.template.yaml: Add missing Resources tag
- security-audit instructions: Convert to Handlebars {{}} syntax
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
fb3c623bae