Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@schemas/blueprint.schema.json`:
- Around line 20-24: The JSON Schema for the property "min_openclaw_version"
currently uses the regex pattern "^[0-9]+\\.[0-9]+\\.[0-9]+" which is missing
the end anchor and allows trailing characters; update the pattern for
min_openclaw_version to include the trailing "$" anchor (match the style used by
"version" and "min_openshell_version") so it becomes
"^[0-9]+\\.[0-9]+\\.[0-9]+$" to strictly enforce the three-part numeric version
format.
- Around line 121-133: The endpoint items object inside the policyAddition
schema (the "items" object that declares required ["host","port"] and properties
host, port, protocol, enforcement, tls, access) lacks additionalProperties:
false; add additionalProperties: false to that object so unknown keys (typos
like "protocl") are rejected and the definition is consistent with the other
strict object schemas.

In `@schemas/policy-preset.schema.json`:
- Around line 56-65: The schema currently only requires "protocol" for REST
entries, allowing rule-less REST policies; update the JSON Schema to
conditionally require "rules" when "protocol" is "rest" by adding an if/then
clause (or equivalent conditional) that checks properties.protocol const "rest"
and in the then branch adds "required": ["rules"] (ensuring the existing "rules"
definition still references "$defs/rule" and its minItems). Locate the block
containing "protocol" and "rules" in the policy-preset schema and add the
conditional requirement so REST entries cannot validate without rules.

In `@schemas/sandbox-policy.schema.json`:
- Around line 84-93: The base sandbox policy schema allows a REST endpoint
without requiring "rules", weakening validation; update the object that
currently has "required": ["protocol"] (the schema block containing "protocol",
"enforcement", "tls", "rules") to also require "rules" so REST entries must
include the "rules" array (items referencing "#/$defs/rule"); ensure the
"required" array includes both "protocol" and "rules" and that "rules" retains
its existing type/constraints (type: array, minItems: 1).

In `@scripts/validate-configs.ts`:
- Around line 90-103: The CLI currently treats a single provided flag as a
signal to fall back to discoverTargets(), which hides misuse; in the
args-parsing block around fileIdx and schemaIdx you should detect the case where
exactly one of fileIdx or schemaIdx is present and reject it: when (fileIdx ===
-1) !== (schemaIdx === -1) print the usage message (same as when both are
missing) and set process.exitCode = 1 (or exit) so the process fails; keep the
existing behavior for the both-present case that reads file = args[fileIdx+1]
and schema = args[schemaIdx+1] and populates targets = [{ schema, files: [file]
}], otherwise call discoverTargets().
- Around line 44-56: The catch around readdirSync(presetsDir) is too broad and
silently swallows real IO/permission errors; update the try/catch so you catch
the error object (e.g., err) and only ignore it when err.code === 'ENOENT'
(directory missing), otherwise rethrow or surface the error so CI fails; locate
the block using readdirSync(presetsDir) and the targets.push call (schema:
"schemas/policy-preset.schema.json") and modify the catch to conditionally
handle ENOENT while propagating other errors.

---

Nitpick comments:
In @.github/actions/basic-checks/action.yaml:
- Line 43: Replace the hardcoded command in the action YAML run step with the
package script to prevent drift: change the run entry that currently executes
"npx tsx scripts/validate-configs.ts" to invoke the npm script
"validate:configs" (i.e., use "npm run validate:configs" or your project's
package manager equivalent) so the CI step uses the package.json script instead
of duplicating the command.

In `@test/validate-config-schemas.test.ts`:
- Around line 106-110: The try/catch around readdirSync(presetsDir) currently
swallows all errors; change it to only ignore missing-directory errors by
checking the caught error's errno/code (e.g., NodeJS.ErrnoException.code ===
'ENOENT') and rethrow any other errors so permission/IO failures still surface;
update the catch in the block that assigns presetFiles from
readdirSync(presetsDir) to perform this conditional rethrow.

Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@schemas/blueprint.schema.json`:
- Around line 39-92: The schema currently allows unknown keys under components
and some nested component objects; add "additionalProperties": false to the
components object and to the components.inference and components.policy objects
so only the declared properties (e.g., components.sandbox,
components.inference.profiles, components.policy.base/additions) are allowed;
keep existing additionalProperties settings for sandbox and
policy.additions/profiles items intact while adding these new
additionalProperties:false constraints to prevent structural typos and
undeclared properties.

---

Duplicate comments:
In `@schemas/blueprint.schema.json`:
- Around line 95-130: The schemas inferenceProfile, policyAddition, and the
endpoint item schema at policyAddition.endpoints.items currently allow unknown
properties; add "additionalProperties": false to each of these object schemas
(the inferenceProfile object, the policyAddition object, and the items object
under policyAddition.endpoints) so unexpected or typoed fields are rejected,
ensuring the existing required and properties definitions remain unchanged.

Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@scripts/validate-configs.ts`:
- Around line 100-109: The current flag parsing (when hasFileFlag &&
hasSchemaFlag) reads file and schema from args using fileIdx/schemaIdx but does
not reject cases where those values are other flags (e.g. "--schema"), so bad
CLI usage slips through; update the validation around fileIdx/schemaIdx and the
variables file and schema to ensure both exist and are not flag-like tokens
(e.g. start with "-" or "--" or match /^-/) and that fileIdx+1 and schemaIdx+1
are within bounds of args; on any invalid value, print the same usage message
and set process.exitCode = 1 and return. Ensure you modify the block that
references hasFileFlag, hasSchemaFlag, args, fileIdx, schemaIdx, file, schema.