Fix next group of failing tools from audit using bundled approach with strict Workspace V2 contract - PR_26124_007-bundle-next-tools

Author: DavidQ

docs/dev/codex_commands.md

@@ -306,3 +306,10 @@ PR_26124_006-playwright-ctrl-tap-debug
 ```bash
 npx @openai/codex run --model gpt-5.3-codex --reasoning medium "Implement PR_26124_006: add shared Ctrl tap (Control down/up) before key Playwright click actions for Workspace V2 navigation/tool/workspace interaction points without changing runtime behavior."
 ```
+
+---
+PR_26124_007-tool-payload-guards-group
+
+```bash
+npx @openai/codex run --model gpt-5.3-codex --reasoning medium "Implement PR_26124_007: fix next small group of failing tools (asset-manager-v2 + palette-manager-v2) by adding strict pre-render cross-tool payload guards while preserving workspace launch behavior."
+```

docs/dev/commit_comment.txt

@@ -1 +1 @@
-Add shared Playwright Ctrl-tap-before-click helper for Workspace V2 navigation and tool/workspace interaction actions - PR_26124_006-playwright-ctrl-tap-debug
+Add strict pre-render cross-tool payload guards for Asset Manager V2 and Palette Manager V2 without schema/runtime feature changes - PR_26124_007-tool-payload-guards-group

docs/dev/reports/PR_26124_007_report.md

@@ -0,0 +1,30 @@
+# PR_26124_007 Report
+
+## Scope
+- Small related tool group fix (2 tools):
+  - `asset-manager-v2`
+  - `palette-manager-v2`
+
+## Changes
+1. `tools/asset-manager-v2/index.js`
+   - Added pre-render rejection for invalid root key `paletteJson`.
+   - Error shown before render:
+     - `Asset Manager V2 session data is invalid. paletteJson is not supported; use payloadJson.assetCatalog.`
+
+2. `tools/palette-manager-v2/index.js`
+   - Added pre-render rejection for invalid `payloadJson.assetCatalog`.
+   - Error shown before render:
+     - `Palette Manager V2 session data is invalid. payloadJson.assetCatalog is not supported; use payloadJson.paletteDocument.`
+
+## Contract Outcomes
+- Valid JSON: unchanged, loads/renders correctly.
+- Invalid cross-tool JSON: rejected before render with clear visible error.
+- No fallback/default data introduced.
+- Workspace integration remains `payloadJson`-based with no schema changes.
+- Workspace launch remains functional for valid matching sessions.
+
+## Validation
+- `node --check tools/asset-manager-v2/index.js` -> PASS
+- `node --check tools/palette-manager-v2/index.js` -> PASS
+- `npm run test:workspace-v2` -> PASS
+  - `Workspace V2 Playwright Gate Summary: passed=1 failed=0`

docs/pr/PR_26124_007_TOOL_PAYLOAD_GUARDS_GROUP/BUILD_PR.md

@@ -0,0 +1,32 @@
+# BUILD_PR — PR_26124_007
+
+## Scope
+- Exactly two related tools:
+  - `tools/asset-manager-v2/index.js`
+  - `tools/palette-manager-v2/index.js`
+- No schema changes
+- No sample JSON changes
+- No other tool changes
+
+## Implemented
+1. Asset Manager V2 (`asset-manager-v2`)
+   - Added invalid payload guard:
+     - reject root `paletteJson`
+     - clear error:
+       - `paletteJson is not supported; use payloadJson.assetCatalog.`
+
+2. Palette Manager V2 (`palette-manager-v2`)
+   - Added invalid payload guard:
+     - reject `payloadJson.assetCatalog`
+     - clear error:
+       - `payloadJson.assetCatalog is not supported; use payloadJson.paletteDocument.`
+
+## Why
+- Prevent cross-tool payload mixing before render.
+- Keep strict tool-owned `payloadJson` contracts.
+- Preserve deterministic workspace launch behavior without fallback/default injection.
+
+## Validation
+- `node --check tools/asset-manager-v2/index.js` -> PASS
+- `node --check tools/palette-manager-v2/index.js` -> PASS
+- `npm run test:workspace-v2` -> PASS (`1 passed`, `failed=0`)

docs/pr/PR_26124_007_TOOL_PAYLOAD_GUARDS_GROUP/PLAN_PR.md

@@ -0,0 +1,18 @@
+# PLAN_PR — PR_26124_007
+
+## Goal
+Fix the next small group of failing tools (2 tools) from the Workspace V2 completion audit with minimal, low-risk changes.
+
+## Tools in Scope
+- `asset-manager-v2`
+- `palette-manager-v2`
+
+## Planned Fix Type
+- Tighten pre-render payload contract validation with explicit cross-tool/legacy key rejection.
+- No schema updates.
+- No runtime feature additions.
+
+## Planned Validation
+- `node --check tools/asset-manager-v2/index.js`
+- `node --check tools/palette-manager-v2/index.js`
+- `npm run test:workspace-v2`

tools/asset-manager-v2/index.js

@@ -304,6 +304,10 @@ class AssetBrowserV2 {
       this.renderError("Asset Manager V2 session data is invalid. Expected toolId 'asset-manager-v2'.");
       return;
     }
+    if (Object.prototype.hasOwnProperty.call(versionCheck.payload, "paletteJson")) {
+      this.renderError("Asset Manager V2 session data is invalid. paletteJson is not supported; use payloadJson.assetCatalog.");
+      return;
+    }
     if (!versionCheck.payload.payloadJson || typeof versionCheck.payload.payloadJson !== "object" || Array.isArray(versionCheck.payload.payloadJson)) {
       this.renderError("Asset Manager V2 session data is invalid. Expected payloadJson only.");
       return;

tools/palette-manager-v2/index.js

@@ -182,6 +182,10 @@ class PaletteManagerV2 {
       this.renderError("Palette Manager V2 session data is invalid. Expected payloadJson.paletteDocument.");
       return;
     }
+    if (Object.prototype.hasOwnProperty.call(versionCheck.payload.payloadJson, "assetCatalog")) {
+      this.renderError("Palette Manager V2 session data is invalid. payloadJson.assetCatalog is not supported; use payloadJson.paletteDocument.");
+      return;
+    }
     if (Object.prototype.hasOwnProperty.call(versionCheck.payload.payloadJson.paletteDocument, "colors")) {
       this.renderError("Palette Manager V2 session data is invalid. payloadJson.paletteDocument.colors is not supported; use payloadJson.paletteDocument.swatches.");
       return;