chore: add shared-schemas package and refactor type definitions

- Add new @snowflake/shared-schemas package for shared Zod schemas
- Refactor agent-bridge to use shared schemas
- Add SDK boundary schemas with z.looseObject() for flexibility
- Add file path validation with security refinements
- Add Zod error formatting utilities

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

Author: fazxes

agent-bridge/package.json

@@ -15,7 +15,9 @@
     "@anthropic-ai/claude-agent-sdk": "^0.1.76",
     "@anthropic-ai/claude-code": "^2.0.76",
     "@anthropic-ai/sdk": "^0.71.2",
-    "@modelcontextprotocol/sdk": "^1.0.0"
+    "@modelcontextprotocol/sdk": "^1.0.0",
+    "@snowflake/shared-schemas": "workspace:*",
+    "zod": "^4.2.1"
   },
   "devDependencies": {
     "@types/node": "^22.19.3",

agent-bridge/src/credentials.ts

@@ -1,36 +1,12 @@
 import { execSync } from 'child_process';
 
+import { formatZodError } from '@snowflake/shared-schemas';
+
 import { createLogger } from './logger.js';
+import { KeychainCredentialsSchema } from './schemas.js';
 
 const logger = createLogger('ClaudeCredentials');
 
-/**
- * Keychain credentials structure from Claude Code CLI
- */
-interface KeychainCredentials {
-  claudeAiOauth?: {
-    accessToken?: string;
-    expiresAt?: string;
-  };
-}
-
-/**
- * Type guard to check if parsed JSON is valid KeychainCredentials
- */
-function isKeychainCredentials(value: unknown): value is KeychainCredentials {
-  if (typeof value !== 'object' || value === null) {
-    return false;
-  }
-  const obj = value as Record<string, unknown>;
-  if (obj.claudeAiOauth === undefined) {
-    return true; // claudeAiOauth is optional
-  }
-  if (typeof obj.claudeAiOauth !== 'object' || obj.claudeAiOauth === null) {
-    return false;
-  }
-  return true;
-}
-
 /**
  * Reads OAuth token from macOS Keychain where Claude Code CLI stores credentials
  * @returns OAuth access token if valid and not expired, null otherwise
@@ -42,14 +18,18 @@ function getOAuthTokenFromKeychain(): string | null {
       encoding: 'utf-8',
     }).trim();
 
-    // Parse the JSON credentials structure
-    const parsed: unknown = JSON.parse(output);
-    if (!isKeychainCredentials(parsed)) {
-      logger.debug('Invalid credentials structure in Keychain');
+    // Parse and validate the JSON credentials structure with Zod
+    const json: unknown = JSON.parse(output);
+    const result = KeychainCredentialsSchema.safeParse(json);
+    if (!result.success) {
+      logger.debug(
+        { error: formatZodError(result.error) },
+        'Invalid credentials structure in Keychain'
+      );
       return null;
     }
 
-    const claudeAuth = parsed.claudeAiOauth;
+    const claudeAuth = result.data.claudeAiOauth;
     if (claudeAuth === undefined) {
       logger.debug('No Claude OAuth credentials found in Keychain');
       return null;

agent-bridge/src/index.ts

@@ -30,6 +30,8 @@ process.env.PATH = Array.from(pathSet).join(':');
 
 import * as readline from 'readline';
 
+import { formatZodError } from '@snowflake/shared-schemas';
+
 import {
   createAgent,
   deleteAgent,
@@ -45,6 +47,7 @@ import {
   updateCommand,
 } from './command-definitions.js';
 import { createLogger } from './logger.js';
+import { BridgeRequestSchema } from './schemas.js';
 import { SessionManager } from './session-manager.js';
 import {
   cleanupOldSessions,
@@ -163,9 +166,21 @@ function main(): void {
 
     let request: BridgeRequest;
     try {
-      request = JSON.parse(line) as BridgeRequest;
+      const parsed: unknown = JSON.parse(line);
+      const result = BridgeRequestSchema.safeParse(parsed);
+      if (!result.success) {
+        const errorMessage = formatZodError(result.error);
+        logger.error({ error: errorMessage, line }, 'Invalid request schema');
+        sendResponse({
+          type: 'error',
+          requestType: 'unknown',
+          error: `Invalid request: ${errorMessage}`,
+        });
+        return;
+      }
+      request = result.data;
     } catch (error) {
-      logger.error({ error, line }, 'Failed to parse request');
+      logger.error({ error, line }, 'Failed to parse request JSON');
       sendResponse({
         type: 'error',
         requestType: 'unknown',