Every identifier these tools interpolate into a request path — `tailnet`,
`deviceId`, `userId`, `keyId`, `playlistId`, `albumId`, `artistId`, `trackId`,
`showId`, `episodeId`, `audiobookId`, `tweetId`, `targetUserId`, `username`,
`woeid` — is `visibility: 'user-or-llm'`, so prompt injection controls it. A
value like `../../users/victim` escaped its API prefix once `fetch` normalized
the URL, re-aiming the request and the caller's credential at a different
resource, including on the DELETE routes that remove a Tailscale device or
user, unfollow a Spotify playlist, or delete a post on X.

Spotify and X interpolated the value with no encoding at all. Tailscale already
wrapped it in `encodeURIComponent`, which is not sufficient: `.` and `..` are
unreserved, so they survive encoding untouched and the URL parser then removes
them as dot segments, popping a path segment off a fixed host. Only rejecting
the value closes it, so all 71 call sites now route through
`safeUrlPathSegment` from `@/tools/url-path`.

Legitimate input is unchanged. A dot inside a longer segment is preserved, so a
Tailscale tailnet keeps working as an organization name (`example.com`), an
emailish login name (`user@example.com`), or the `-` default alias, and Spotify
base-62 ids and X numeric snowflakes pass through verbatim. Dropping the
`.trim()` calls also lets a snowflake arrive as a JSON number, which previously
threw a bare `TypeError`.

Adds `path_safety.test.ts` per service. Each enumerates its tools from the
barrel, so a newly added unguarded path parameter fails CI, and resolves every
built URL with `new URL(...)` rather than string-matching the template — string
matching is what let this through. Reverting any one guard turns them red.

…tion

The harness these three files inherited had two blind spots that let a real
regression pass.

**Every parameter shared one fuzz value.** The assertion swallowed the throw
(`try { build() } catch { return }`), so the moment one parameter was guarded
the whole vector was skipped and its siblings stopped being tested. Reverting
`targetUserId` in `x_manage_block` — leaving it completely unguarded — kept the
suite at 622/622 green. Discovery now enumerates (tool, parameter) pairs and
fuzzes one at a time with every sibling held safe; that same revert now fails
15 assertions.

Finding the second identifier at all needs the branch explored: `targetUserId`
only appears on the `action === 'unblock'` path, and `action` declares no enum,
so the literals are harvested from the URL builder's own source. That keeps it
self-maintaining — a new branch value is picked up without editing the tests.

**A shape check cannot see a trailing dot.** `https://host/a/.` normalizes to
`https://host/a/`, preserving the segment count and every other segment, and
most of these routes end in the guarded id — including DELETE routes. Reverting
`tailscale_delete_device` produced no `cannot reshape the path with "."`
failure at all. Rejection is now asserted directly per parameter, so that same
revert fails 12 assertions instead of 2.

Also drops `ToolConfig<any, any>` and `url(fill as any)` for a structural
`PathTool` narrowed by a type guard, and surfaces any tool whose URL cannot be
built from all-safe values rather than letting it fall out of the suite unseen.

79 pairs (tailscale 26, spotify 24, x 29), matching the guarded call sites
exactly. 2653 assertions, all green.

Several X tools carry the same identifier in the path on one branch and in the
body on the other: `x_manage_block` sends `targetUserId` as a path segment to
unblock and as a body field to block. Guarding only the path left the two
branches disagreeing about what a caller may send — a numeric id that unblocked
successfully threw a bare `TypeError` from `params.targetUserId.trim()` when
used to block.

Adds `xIdBodyValue`, which defers to `safeUrlPathSegment` and decodes the
result rather than restating which value kinds an id may take, so the path and
body rules cannot drift. Percent-encoding is a path concern; a JSON body
carries the raw value. Applied to the six body sites across `create_bookmark`,
`manage_block`, `manage_follow`, `manage_mute`, `manage_like`, and
`manage_retweet`.

Also makes the harness's shape assertion non-vacuous: it caught every throw and
returned, so an unrelated `TypeError` would have read as a pass. It now asserts
the error names the parameter under test before returning.

…ness

The body suite reached `request.body` through `as unknown as`, which is the
same type erasure the harness had already removed everywhere else. `PathTool`
carries a narrowed `body` member, so the accessor reads it directly.

Also fixes escaped backticks that leaked into the `xIdBodyValue` TSDoc.

The traversal assertion exempted the slot under test — `if (segment === TARGET)
return` — so it proved the path kept its length and its surrounding segments
but never checked what landed in the guarded position. A *balanced* vector
walks straight through that: `783214/../999999` on an unguarded
`x_delete_tweet` yields

  ["", "2", "tweets", "999999"]   vs   ["", "2", "tweets", "SAFEID"]

Same length, same surrounding segments, only the exempted slot differing — and
the request now deletes a different post. The assertion now pins the slot to
`encodeURIComponent(value.trim())`, and one balanced vector is added per
service so the property is exercised directly.

This also closes a second blind spot for free. A bare `.` collapses the slot to
an empty segment without changing the count, so `cannot reshape the path with
"."` could never fail before; it does now.

Scoped reverts, failures per guard: `tailscale_delete_device` 12 to 14,
`spotify_get_playlist` 17 to 23, `x_delete_tweet` 22 to 27.

Widening the guard to accept a numeric id made an existing echo reachable.
Eight Tailscale tools return the id they were given straight back in their
success output, declared `type: 'string'`. Before this PR a numeric `userId`
threw from `params.userId.trim()` in the URL builder and never got that far;
now the request succeeds and the echo emitted a number, turning a hard failure
into a quiet contract violation.

`String(params?.id ?? '')` is sufficient rather than a second guard call: the
URL builder has already run and rejected every kind but string, number, and
bigint by the time `transformResponse` executes, so the coercion cannot invent
a value. `ECHOED_ID_TOOLS` pins it, and reverting one site turns it red.

Also corrects two things the tests claimed but did not do:

- The Tailscale header said reverting a guard to `encodeURIComponent` leaves
  "every slash-bearing vector still passing". That stopped being true once
  `REJECTED_IDS` began asserting those vectors are refused outright; the claim
  now describes the shape assertions specifically, which is where it holds.
- `discovers every identifier of a multi-ID route` asserted a pinned count,
  which for Spotify is zero — a name that read as the opposite of the
  assertion. Renamed to say what it pins.