Reject unknown OpenAPI tool arguments

[RhysSullivan]

Generated tool schemas declare additionalProperties: false, but nothing enforced it: an unknown top-level argument was silently dropped from the outgoing request, so a mis-named payload key (requestBody instead of body) produced a confusing upstream 400 instead of a local error.

buildRequest now compares the caller's keys against what the operation actually consumes (declared parameters, path placeholders, body/input, bodyBase64 and contentType where applicable, server for multi-server operations) and fails locally naming the unknown keys and listing the accepted ones. Both the direct invoke path and the approval-gated validation route go through the same check.

Fixes #1382

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	executor-marketing	56f5441	Commit Preview URL Branch Preview URL	Jul 10 2026, 02:37 AM

[github-actions]

Cloudflare preview

Console	https://executor-preview-pr-1388.executor-e2e.workers.dev
MCP	https://executor-preview-pr-1388.executor-e2e.workers.dev/mcp
Deployed commit	56f5441

Sign-in is Cloudflare Access (one-time PIN to an allowed email). The preview has its own database and encryption key; it is destroyed when this PR closes.

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Updated (UTC)
✅ Deployment successful! View logs	executor-cloud	56f5441	Jul 10 2026, 02:39 AM

[pkg-pr-new]

Open in StackBlitz

@executor-js/cli

npm i https://pkg.pr.new/@executor-js/cli@1388

@executor-js/config

npm i https://pkg.pr.new/@executor-js/config@1388

@executor-js/execution

npm i https://pkg.pr.new/@executor-js/execution@1388

@executor-js/sdk

npm i https://pkg.pr.new/@executor-js/sdk@1388

@executor-js/codemode-core

npm i https://pkg.pr.new/@executor-js/codemode-core@1388

@executor-js/runtime-quickjs

npm i https://pkg.pr.new/@executor-js/runtime-quickjs@1388

@executor-js/plugin-file-secrets

npm i https://pkg.pr.new/@executor-js/plugin-file-secrets@1388

@executor-js/plugin-graphql

npm i https://pkg.pr.new/@executor-js/plugin-graphql@1388

@executor-js/plugin-keychain

npm i https://pkg.pr.new/@executor-js/plugin-keychain@1388

@executor-js/plugin-mcp

npm i https://pkg.pr.new/@executor-js/plugin-mcp@1388

@executor-js/plugin-onepassword

npm i https://pkg.pr.new/@executor-js/plugin-onepassword@1388

@executor-js/plugin-openapi

npm i https://pkg.pr.new/@executor-js/plugin-openapi@1388

executor

npm i https://pkg.pr.new/executor@1388

commit: 56f5441