MCP HTTP dispatch binds an OMITTED string tool-parameter to Unit, causing a stdlib crash instead of defaulting to "" or returning a clean validation error.

Repro

Streamable-HTTP MCP server (ailang serve-api --mcp-http). Reproduced against deployed ailang-api 0.8.1 at https://docparse.ailang.sunholo.com/mcp/.

Tool signature:
export func mcpParse(filepath: string, outputFormat: string, apiKey: string, requestId: string) -> string ! {...}

MCP tools/call with arguments {"filepath":"sample_docx_formatting","outputFormat":"markdown"} — i.e. apiKey OMITTED — returns:
isError=true, content: "function call failed: _str_len: expected String, got *eval.UnitValue"

The handler's first line is: if length(apiKey) == 0 then ... (std/string.length -> _str_len). So the omitted apiKey arrives as Unit, and _str_len crashes before the guard can run.

Contrast (the smoking gun)

• Passing apiKey="dp_anything" (any string): works — handler runs, returns INVALID_API_KEY cleanly.
• Omitting apiKey entirely: crashes in _str_len on Unit.
  So a declared string parameter is being bound to Unit purely because the MCP client omitted it.

Expected

A declared non-optional string MCP param that the client omits should either (a) default to "", or (b) cause the dispatcher to return a structured 'missing required parameter' error to the client. It should never bind Unit and let execution reach stdlib, which produces an internal _str_len crash with no actionable message.

Impact

Breaks the documented first-run agent auth flow for the docparse MCP skill: an unauthenticated mcpParse call is supposed to return AUTH_REQUIRED (the handler explicitly builds that response), but instead crashes. This is the exact path a brand-new skill user hits.

Note

Could not fully isolate in a local serve-api repro: ailang lock fails in this project first on a duplicate dependency key, then on 'circular dependency: sunholo/ailang_parse -> sunholo/ailang_parse'. Repro above is therefore against the deployed server. Also: AILANG appears to offer no docparse-side guard (no optional params / default values / Unit detection / null-safe string ops), which is why this needs a framework-level fix.

Binary info (auto-attached):
ailang version: v0.22.0-3-g49664aaf-dirty
binary md5: e32d1ae7e09e0f2c94780c43e567f3c2
binary path: /Users/voightkampff/go/bin/ailang
git commit: 49664aa

Reported by: cli via ailang messages