fix(core): drop undefined metadata values from permission requests

[rvaccone]

Issue for this PR

Closes #37650

Supersedes #37679, which was closed by the automated cleanup and which GitHub will not reopen.

Type of change

• Bug fix
• New feature
• Refactor / code improvement
• Documentation

What does this PR do?

Pending glob and grep permissions store absent optional inputs as undefined inside permission metadata (for example metadata: { path: input.path, limit: input.limit }). The metadata record is Schema.Record(Schema.String, Schema.Unknown) and the wire codec serializes Unknown as a JSON value, so session.permission.list fails to encode its response with Expected JSON value, got undefined.

Since #37679 the set of affected fields has grown: glob now also passes hidden (#46724) and grep passes literal and caseSensitive. A glob call that omits hidden trips the same 400 at metadata.hidden.

This strips undefined values in request() in packages/core/src/permission.ts, the one place every pending request is constructed for both assert and ask. That covers every field above without touching either tool, and protects the event publish path as well as the list and get endpoints. I re-audited the permission.assert and permission.ask call sites on current v2: glob and grep are still the only ones passing raw optional inputs through. The one nested value, files in the patch tool, is a typed FileDiff.Info built from the diff rather than from tool input, so a shallow strip is still sufficient. A deep JSON round trip was rejected because it would silently normalize values that should fail loudly.

How did you verify your code works?

One regression test: ask for a permission whose metadata contains undefined values, then assert the pending request omits those keys. On current v2 it fails without the fix and passes with it. The permission suite in packages/core (104 tests) and the packages/core typecheck pass. I also previously reproduced the reported error against the JSON value codec with the old metadata shape and confirmed the stripped shape encodes cleanly.

Screenshots / recordings

Not a UI change.

Checklist

• I have tested my changes locally
• I have not included unrelated changes in this PR

https://claude.ai/code/session_01VfnVqHyavHygRQS2KBChYb

[github-actions]

Thanks for your contribution!

This PR doesn't have a linked issue. All PRs must reference an existing issue.

Please:

1. Open an issue describing the bug/feature (if one doesn't exist)
2. Add Fixes #<number> or Closes #<number> to this PR description

See CONTRIBUTING.md for details.

[github-actions]

The following comment was made by an LLM, it may be inaccurate:

Potential Duplicate Found

PR #46906: fix(core): drop undefined permission metadata values before publishing requests

• fix(core): drop undefined permission metadata values before publishing requests #46906
• Why it's related: This PR appears to address the exact same issue—removing undefined metadata values from permission requests. It's likely a related or competing solution to the same problem that PR fix(core): drop undefined metadata values from permission requests #46964 is fixing.

The PR mentions it supersedes PR #37679, which suggests there's an existing attempt to fix this. PR #46906 should be checked to see if it's the same fix or an alternative approach.