Sanitizes tool function declaration schemas before they are sent to the
Gemini API. This resolves a persistent '400 Bad Request' error that
occurred when a tool parameter of type STRING had a `format` property
other than 'enum' or 'date-time'.

This commit inspects all discovered tools and sets unsupported `format`
properties to `undefined`, ensuring API compatibility. It also adds
array validation for tool declarations to prevent `missing field` errors.

This single commit also includes the necessary test coverage and fixes
for related flaky tests.

Fixes google-gemini#2141
Fixes google-gemini#2706
Fixes google-gemini#3178
Fixes google-gemini#2237
Related to google-gemini#2522

This commit introduces a comprehensive set of improvements to the tool discovery mechanism in the `ToolRegistry`.

The key changes include:
- Replacing `execSync` with `spawn` to mitigate command injection risks.
- Implementing robust error handling for the `spawn` process, including an `error` event listener and re-throwing errors to prevent silent failures.
- Adding comprehensive input validation for the tool discovery command and its outputs to ensure stability.
- Fixing a memory leak in `sanitizeParameters` by creating a new `Set` for each top-level call, preventing the `visited` set from growing indefinitely.
- Adding a size limit to the `stdout` buffer in `discoverTools` to prevent potential memory exhaustion.
- Fixing a broken test in `getFolderStructure.test.ts` by adding the missing `path` and `parentPath` properties to the `createDirent` mock.
- Consolidating multiple related commits into a single, cohesive update.

feat(tool-registry): improve robustness of tool discovery

This commit enhances the robustness of the tool discovery process in several ways:

- Replaces `execSync` with `spawn` to prevent command injection vulnerabilities.
- Adds comprehensive error handling for the `spawn` process, including listening for the 'error' event.
- Validates the discovery command to prevent the use of shell operators and to handle empty commands gracefully.
- Implements size limits for both `stdout` and `stderr` to prevent excessive memory usage.
- Uses `StringDecoder` to correctly handle multi-byte UTF-8 characters in the output of the discovery command.
- Ensures that `func.parameters` is a valid object before use.
- Refactors `sanitizeParameters` to use a non-exported helper function, avoiding issues with mutable default values.
- Re-throws errors caught during tool discovery to prevent silent failures.

These changes make the tool discovery process more secure, resilient, and reliable.

feat(tool-discovery): Enhance tool discovery robustness

This commit addresses multiple feedback points from `gemini-code-assist` in GitHub PR google-gemini#3300, focusing on improving the robustness, security, and error handling of the tool discovery mechanism.

Key changes include:

- **Memory Usage Optimization**: Enforced size limits for both `stdout` and `stderr` to prevent potential memory exhaustion from excessive output by external commands.
- **Secure Execution**: Replaced the `execSync` call with the more secure `spawn` to mitigate command injection risks.
- **Enhanced Robustness**:
    - Added null checks for the `tool` object returned by `discoveryCmd` to prevent potential `TypeError`.
    - Implemented strict type validation for `func.parameters`, defaulting to an empty object `{}` if it's not a valid object, thus avoiding API errors from invalid schemas.
    - Corrected the `visited` parameter handling in `sanitizeParameters` by creating a new `Set` for each call, resolving a potential memory leak from a mutable default argument.
- **Improved Error Handling**:
    - Strengthened error handling by listening for the `error` event on the `spawn` process, ensuring process launch failures are caught and properly handled.
    - Validated the output of `shell-quote.parse` to ensure all command parts are strings, preventing runtime crashes from invalid arguments.
    - Elevated the log level from `console.warn` to `console.error` for tool discovery failures and re-threw the exception to make issues more visible.
- **Encoding Correctness**: Introduced `StringDecoder` to process data streams from `stdout` and `stderr`, ensuring correct parsing of multi-byte UTF-8 characters and preventing `JSON.parse` errors.
- **Byte Length Correction**: Fixed the size-limiting logic for `stdout` and `stderr`, which incorrectly compared character length with byte length, to ensure accurate enforcement of the limits.

Together, these changes significantly improve the reliability and security of the tool discovery feature, providing a more stable user experience.

feat(tool-discovery): Enhance tool discovery robustness

This commit addresses multiple feedback points from `gemini-code-assist` in GitHub PR google-gemini#3300, focusing on improving the robustness, security, and error handling of the tool discovery mechanism.

Key changes include:

- **Memory Usage Optimization**: Enforced size limits for both `stdout` and `stderr` to prevent potential memory exhaustion from excessive output by external commands.
- **Secure Execution**: Replaced the `execSync` call with the more secure `spawn` to mitigate command injection risks.
- **Enhanced Robustness**:
    - Added null checks for the `tool` object returned by `discoveryCmd` to prevent potential `TypeError`.
    - Implemented strict type validation for `func.parameters`, defaulting to an empty object `{}` if it's not a valid object, thus avoiding API errors from invalid schemas.
    - Corrected the `visited` parameter handling in `sanitizeParameters` by creating a new `Set` for each call, resolving a potential memory leak from a mutable default argument.
- **Improved Error Handling**:
    - Strengthened error handling by listening for the `error` event on the `spawn` process, ensuring process launch failures are caught and properly handled.
    - Validated the output of `shell-quote.parse` to ensure all command parts are strings, preventing runtime crashes from invalid arguments.
    - Elevated the log level from `console.warn` to `console.error` for tool discovery failures and re-threw the exception to make issues more visible.
- **Encoding Correctness**: Introduced `StringDecoder` to process data streams from `stdout` and `stderr`, ensuring correct parsing of multi-byte UTF-8 characters and preventing `JSON.parse` errors.
- **Byte Length Correction**: Fixed the size-limiting logic for `stdout` and `stderr`, which incorrectly compared character length with byte length, to ensure accurate enforcement of the limits.
- **Encapsulation**: Switched from calling the internal `_sanitizeParameters` function to the public `sanitizeParameters` function to respect encapsulation and improve maintainability.

Together, these changes significantly improve the reliability and security of the tool discovery feature, providing a more stable user experience.

This commit implements a series of improvements to the tool discovery mechanism in `packages/core/src/tools/tool-registry.ts`, addressing feedback from the `gemini-code-assist` bot to enhance robustness, security, and error handling.

The following changes have been made:

- **Command Injection Prevention**: Replaced the use of `execSync` with `spawn` to prevent potential command injection vulnerabilities when executing the tool discovery command. This ensures that the command and its arguments are treated as separate entities, mitigating the risk of malicious code execution.

- **Graceful Error Handling**: Implemented more robust error handling for the `spawn` process. This includes listening for the 'error' event to catch process launch failures and rejecting the promise accordingly. This prevents unhandled exceptions from crashing the application.

- **Input Validation**: Added validation to ensure that the parsed command from `shell-quote` is an array of strings, preventing runtime errors when the command contains shell operators. An informative error message is now thrown to guide users on how to correctly format complex commands.

- **Output Size Limiting**: Introduced a size limit for both `stdout` and `stderr` to prevent excessive memory usage from commands that produce large amounts of data. If the output exceeds the defined limit, the child process is terminated, and an appropriate error is thrown.

- **Correct Character Encoding**: Implemented the use of `StringDecoder` for both `stdout` and `stderr` streams to correctly handle multi-byte UTF-8 characters. This prevents potential data corruption and ensures that JSON output is parsed correctly.

- **Safe Parameter Handling**: Added validation to ensure that `func.parameters` is a valid object before it is used. If it is not a valid object, it now defaults to an empty object `{}` to prevent runtime errors and invalid schemas from being sent to the Gemini API.

- **Improved Error Logging**: Changed the error logging for failed discovery commands from `console.warn` to `console.error` and re-throwing the error to make failures more prominent and prevent silent failures.

- **Decoder Flushing**: Ensured that the `StringDecoder` is properly flushed by calling `.end()` in the `close` event handler. This guarantees that any remaining buffered characters are correctly decoded before parsing, preventing data corruption.

These changes collectively make the tool discovery process more secure, resilient, and user-friendly by providing clearer error messages and preventing common sources of runtime failures.

This commit reintroduces the previously removed tests for MCP (Model Context Protocol) tool discovery functionality in `packages/core/src/tools/tool-registry.test.ts`.

The restored tests ensure that the `discoverTools` method correctly handles tool discovery from MCP servers configured via `getMcpServers`. This improves the test coverage for a core feature of the tool registry and helps prevent future regressions.

This commit implements a series of improvements to the tool registry based on feedback from @NTaylorMullen and gemini-code-assist.

Key changes:
- Refactored the `discoverTools` method by extracting the command-based discovery logic into a new private method, `discoverAndRegisterToolsFromCommand`, to improve readability and maintainability.
- Moved the `shell-quote` dependency from the root `package.json` to `packages/core/package.json` where it is actually used.
- Restored the unintentionally removed test code in `useLoadingIndicator.test.ts`.
- Added a `null` check for `discoveredItems` in `tool-registry.ts` to prevent potential crashes.
- Re-instated the previously removed MCP tool discovery tests in `tool-registry.test.ts` to ensure proper test coverage.