fix(validators): reject invalid argument types and empty positional arguments - #1583

Cross-validated this PR against live registry data (same protocol as the #1555 cross-validation).

Disclosure: baobabcat is an AI-operated account; this comment is data for reviewers, not a review approval.

Method

• Worktrees of main (6036804) and this PR (053877e); a thin harness unmarshals each payload into apiv0.ServerJSON and calls validators.ValidateServerJSON(&srv, validators.ValidationSemanticOnly).
• Violators: the 60 real class-B/C payloads from the Registry accepts server.json with empty "repository": {} though schema requires url + source #1546 fixtures (52 B, 8 C), each re-fetched from the public API and re-verified live today.
• Controls: 50 fresh entries from a 1,300-entry /v0/servers sample (today), chosen for bearing arguments that are all enum-valid and whose positionals carry value/valueHint — the entries whose verdict must not change.

Results

• Zero misses: every fixture is rejected with its class-matching message; the 52/8 split matches the 2026-08-25 full-registry scan exactly.
• Zero false positives: no control verdict or issue changed between branches.
• No collateral edits: per violator, the PR's issue list is a strict superset of main's.
• go test ./internal/validators/... passes on the PR branch; PR CI green.

Together with #1555 (class A), this covers classes A–C of #1546; class D (version: "latest") is already rejected on main, so merging both PRs would close every class found by the 50k-manifest scan.

Found a compatibility regression that we should address before merging: the positional-argument check rejects {"type":"positional","value":""}.

The published 2025-12-11 schema requires the value or valueHint property to be present, but does not require value to be nonempty. An explicit empty string is also a meaningful CLI argument. The Go string field currently conflates an omitted value with an explicitly empty value, so checking obj.Value == "" && obj.ValueHint == "" rejects a schema-valid input.

I reproduced this with a full manifest that passes the published JSON Schema but fails this PR's semantic validation and receives HTTP 422 from /v0.1/publish in the local API test harness.

Please preserve the distinction between an absent value and an explicitly empty value, and add a regression test for the raw JSON case above. The invalid argument-type validation looks reasonable; this finding concerns the positional value-presence check.

Implemented the empty-argument compatibility fix in 1ac3761 and rebased onto current main.

Argument now preserves explicit empty value and valueHint strings during JSON decoding and encoding, without changing the existing exported string fields. Positional validation checks property presence rather than string length. This also preserves empty values through JSONB storage and responses. Missing fields remain rejected; invalid argument-type validation is unchanged.

Added raw-JSON publish coverage for both /v0 and /v0.1, under both runtimeArguments and packageArguments, including empty/nonempty values and hints, named arguments, missing fields, null, and invalid types. Accepted arguments are read back from the database and checked for JSON preservation. The empty-string regressions fail with the original guard and pass with the fix.

Local validation passed: go test -race ./pkg/... ./internal/... ./cmd/..., targeted go vet, golangci-lint v2.14.0 (0 issues), make validate, and make build. Waiting for CI on this exact head before merging.