fix(inventory): detach numeric schema bounds and dedupe default traversal

Two Copilot findings on 431b7a2:

- CloneSchemas only deep-copies subschema nodes, so pointer-valued
  numeric validation keywords (Minimum, Maximum, MinLength, MinItems,
  etc.) remained aliased with the caller-owned schema after
  CloneSchema/CachedSchema. A caller mutating one of those pointers
  after caching could race with concurrent cached-schema
  serialization or silently change the cached validation bounds.
  Clone every *int/*float64 keyword explicitly alongside the existing
  collection/metadata cloning.

- CloneSchemaWithoutDefaults's removeSchemaDefaults visited every
  map/pointer child twice: once via two literal child-collection
  loops, and again via schemaChildren, which already covers the same
  fields. This doubled traversal at every nested level, making
  default removal exponential for deeply nested object/array schemas.
  Traverse only the single comprehensive schemaChildren list.

Add regression coverage across CloneSchema, CachedSchema, schema
inference option cloning, and CloneSchemaWithoutDefaults: every
*int/*float64 keyword is isolated from caller mutation (including
under concurrent marshaling), and a 48-level deep chain is used for
every schema-child field kind to confirm linear, non-exponential
default removal.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Author: SamMorrowDrums

docs/typed-tool-schemas.md

@@ -38,7 +38,8 @@ The SDK applies defaults from the runtime input schema before decoding. If an
 omitted field must remain omitted, build the runtime schema with
 `inventory.CloneSchemaWithoutDefaults` before applying validation-only
 changes. Use `inventory.CloneSchema` when deriving other runtime-only schema
-variants so nested metadata is detached as well as subschemas. The advertised
+variants so numeric bound pointers and nested metadata are detached as well as
+subschemas. Default removal visits each child once per parent. The advertised
 schema can retain its defaults; the constructor caches the runtime schema
 without mutating either caller-owned schema.
 

pkg/inventory/typed_output_test.go

@@ -241,6 +241,143 @@ func TestCachedSchemaDeepCopiesMutableMetadata(t *testing.T) {
 	workers.Wait()
 }
 
+func TestSchemaClonesDetachEveryNumericKeyword(t *testing.T) {
+	for name, clone := range map[string]func(*jsonschema.Schema) *jsonschema.Schema{
+		"direct": CloneSchema,
+		"cache": func(schema *jsonschema.Schema) *jsonschema.Schema {
+			cached, err := CachedSchema(schema)
+			require.NoError(t, err)
+			return cached
+		},
+		"inference options": func(schema *jsonschema.Schema) *jsonschema.Schema {
+			options := cloneJSONSchemaForOptions(&jsonschema.ForOptions{
+				TypeSchemas: map[reflect.Type]*jsonschema.Schema{reflect.TypeFor[int](): schema},
+			})
+			return options.TypeSchemas[reflect.TypeFor[int]()]
+		},
+		"without defaults": CloneSchemaWithoutDefaults,
+	} {
+		t.Run(name, func(t *testing.T) {
+			bounds := &jsonschema.Schema{}
+			fields := reflect.ValueOf(bounds).Elem()
+			var numericFields []int
+			for i := range fields.NumField() {
+				field := fields.Field(i)
+				if field.Type() != reflect.TypeFor[*int]() && field.Type() != reflect.TypeFor[*float64]() {
+					continue
+				}
+				value := reflect.New(field.Type().Elem())
+				if value.Elem().Kind() == reflect.Int {
+					value.Elem().SetInt(11)
+				} else {
+					value.Elem().SetFloat(11)
+				}
+				field.Set(value)
+				numericFields = append(numericFields, i)
+			}
+			require.NotEmpty(t, numericFields)
+			original := &jsonschema.Schema{
+				Type:       "object",
+				Comment:    "numeric keyword isolation " + name,
+				Properties: map[string]*jsonschema.Schema{"bounds": bounds},
+			}
+			cloned := clone(original)
+			clonedFields := reflect.ValueOf(cloned.Properties["bounds"]).Elem()
+			for _, i := range numericFields {
+				keyword := fields.Type().Field(i).Name
+				assert.NotEqual(t, fields.Field(i).Pointer(), clonedFields.Field(i).Pointer(), keyword)
+				assert.Equal(t, fields.Field(i).Elem().Interface(), clonedFields.Field(i).Elem().Interface(), keyword)
+			}
+
+			// Mutating caller-owned bounds must not race with cached-schema reads.
+			var workers sync.WaitGroup
+			workers.Add(2)
+			go func() {
+				defer workers.Done()
+				for range 100 {
+					for _, i := range numericFields {
+						value := fields.Field(i).Elem()
+						if value.Kind() == reflect.Int {
+							value.SetInt(22)
+						} else {
+							value.SetFloat(22)
+						}
+					}
+				}
+			}()
+			go func() {
+				defer workers.Done()
+				for range 100 {
+					if _, err := json.Marshal(cloned); err != nil {
+						t.Errorf("marshal detached schema: %v", err)
+						return
+					}
+				}
+			}()
+			workers.Wait()
+			for _, i := range numericFields {
+				value := clonedFields.Field(i).Elem()
+				if value.Kind() == reflect.Int {
+					assert.Equal(t, int64(11), value.Int())
+				} else {
+					assert.Equal(t, float64(11), value.Float())
+				}
+			}
+			assert.Nil(t, cloned.Minimum, "absent bounds must remain absent")
+		})
+	}
+}
+
+func TestCloneSchemaWithoutDefaultsTraversesAllChildKinds(t *testing.T) {
+	schemaType := reflect.TypeFor[jsonschema.Schema]()
+	for i := range schemaType.NumField() {
+		field := schemaType.Field(i)
+		if field.Type != reflect.TypeFor[*jsonschema.Schema]() &&
+			field.Type != reflect.TypeFor[[]*jsonschema.Schema]() &&
+			field.Type != reflect.TypeFor[map[string]*jsonschema.Schema]() {
+			continue
+		}
+		t.Run(field.Name, func(t *testing.T) {
+			original := &jsonschema.Schema{Default: json.RawMessage(`1`)}
+			// A single deep chain makes repeated per-level traversal exponential.
+			const depth = 48
+			for range depth {
+				parent := &jsonschema.Schema{Default: json.RawMessage(`1`)}
+				target := reflect.ValueOf(parent).Elem().Field(i)
+				switch field.Type {
+				case reflect.TypeFor[*jsonschema.Schema]():
+					target.Set(reflect.ValueOf(original))
+				case reflect.TypeFor[[]*jsonschema.Schema]():
+					target.Set(reflect.ValueOf([]*jsonschema.Schema{original}))
+				case reflect.TypeFor[map[string]*jsonschema.Schema]():
+					target.Set(reflect.ValueOf(map[string]*jsonschema.Schema{"child": original}))
+				}
+				original = parent
+			}
+			cloned := CloneSchemaWithoutDefaults(original)
+			for level := 0; level <= depth; level++ {
+				require.NotSame(t, original, cloned)
+				assert.Equal(t, json.RawMessage(`1`), original.Default)
+				assert.Nil(t, cloned.Default)
+				var originalChild, clonedChild *jsonschema.Schema
+				for _, child := range schemaChildren(original) {
+					if child != nil {
+						originalChild = child
+					}
+				}
+				for _, child := range schemaChildren(cloned) {
+					if child != nil {
+						clonedChild = child
+					}
+				}
+				original, cloned = originalChild, clonedChild
+			}
+			assert.Nil(t, original)
+			assert.Nil(t, cloned)
+		})
+	}
+}
+
 func TestSchemaInferenceOptionsDeepCopyOverrides(t *testing.T) {
 	type input struct {
 		State string `json:"state"`

pkg/inventory/typed_schema.go

@@ -122,7 +122,7 @@ func CloneSchemaWithoutDefaults(schema *jsonschema.Schema) *jsonschema.Schema {
 	return clonedSchema
 }
 
-// CloneSchema deep-copies schema nodes and mutable metadata collections.
+// CloneSchema deep-copies schema nodes, numeric bounds, and mutable metadata.
 func CloneSchema(schema *jsonschema.Schema) *jsonschema.Schema {
 	clonedSchema := schema.CloneSchemas()
 	cloneSchemaMetadata(clonedSchema)
@@ -138,6 +138,19 @@ func cloneSchemaMetadata(schema *jsonschema.Schema) {
 	if schema == nil {
 		return
 	}
+	schema.MultipleOf = cloneSchemaPointer(schema.MultipleOf)
+	schema.Minimum = cloneSchemaPointer(schema.Minimum)
+	schema.Maximum = cloneSchemaPointer(schema.Maximum)
+	schema.ExclusiveMinimum = cloneSchemaPointer(schema.ExclusiveMinimum)
+	schema.ExclusiveMaximum = cloneSchemaPointer(schema.ExclusiveMaximum)
+	schema.MinLength = cloneSchemaPointer(schema.MinLength)
+	schema.MaxLength = cloneSchemaPointer(schema.MaxLength)
+	schema.MinItems = cloneSchemaPointer(schema.MinItems)
+	schema.MaxItems = cloneSchemaPointer(schema.MaxItems)
+	schema.MinContains = cloneSchemaPointer(schema.MinContains)
+	schema.MaxContains = cloneSchemaPointer(schema.MaxContains)
+	schema.MinProperties = cloneSchemaPointer(schema.MinProperties)
+	schema.MaxProperties = cloneSchemaPointer(schema.MaxProperties)
 	schema.Types = slices.Clone(schema.Types)
 	schema.Enum = cloneSchemaValue(reflect.ValueOf(schema.Enum), make(map[schemaValueVisit]reflect.Value)).Interface().([]any)
 	schema.Default = slices.Clone(schema.Default)
@@ -176,6 +189,14 @@ func cloneSchemaMetadata(schema *jsonschema.Schema) {
 	}
 }
 
+func cloneSchemaPointer[T int | float64](value *T) *T {
+	if value == nil {
+		return nil
+	}
+	cloned := *value
+	return &cloned
+}
+
 // cloneSchemaValue preserves the concrete metadata types while detaching
 // nested mutable collections from schemas retained by callers.
 func cloneSchemaValue(value reflect.Value, visited map[schemaValueVisit]reflect.Value) reflect.Value {
@@ -284,34 +305,6 @@ func removeSchemaDefaults(schema *jsonschema.Schema) {
 		return
 	}
 	schema.Default = nil
-	for _, children := range []map[string]*jsonschema.Schema{
-		schema.Defs,
-		schema.Definitions,
-		schema.Properties,
-		schema.PatternProperties,
-		schema.DependentSchemas,
-		schema.DependencySchemas,
-	} {
-		for _, child := range children {
-			removeSchemaDefaults(child)
-		}
-	}
-	for _, child := range []*jsonschema.Schema{
-		schema.Items,
-		schema.AdditionalItems,
-		schema.Contains,
-		schema.UnevaluatedItems,
-		schema.AdditionalProperties,
-		schema.PropertyNames,
-		schema.UnevaluatedProperties,
-		schema.Not,
-		schema.If,
-		schema.Then,
-		schema.Else,
-		schema.ContentSchema,
-	} {
-		removeSchemaDefaults(child)
-	}
 	for _, child := range schemaChildren(schema) {
 		removeSchemaDefaults(child)
 	}