add typed IPC command-schema framework (T-120)

Per D-74: commands register an argument schema beside their handler
instead of hand-validating args inline. DaemonDispatcher accumulates a
cmd->schema registry and, before invoking a handler, normalises the
argv-translator shape ({positional, flags}) into named args, coerces
types, and checks per-arg constraints (charset/pattern, leading-dash
rejection, numeric range, list caps). Violations return userError so no
handler sees malformed input. Schema adoption is opt-in per command —
unschema'd commands dispatch unchanged.

panel.resize adopts a schema (dropping the _ResizeArgs hand-lift from
T-119); git.checkout and git.push gain schemas that reject leading-dash
refs at the dispatcher and, via positional ordering, fix the C-client
CLI path — `clide git checkout <branch>` now reaches the handler, where
the positional token previously never mapped to `branch`. The T-104
validateGitRef + count/path caps stay in place as defense-in-depth
because the git client is reachable directly from the UI, not only
through the dispatcher.

Co-Authored-By: Claude <noreply@anthropic.com>

lib/src/daemon/dispatcher.dart

@@ -1,4 +1,5 @@
 import 'package:clide/clide.dart' show clideVersion;
+import 'package:clide/src/ipc/command_schema.dart';
 import 'package:clide/src/ipc/envelope.dart';
 import 'package:clide/src/ipc/schema_v1.dart';
 
@@ -12,13 +13,26 @@ class DaemonDispatcher {
 
   final Map<String, CommandHandler> _handlers = {};
 
-  void register(String cmd, CommandHandler handler) {
+  /// Per-command argument schemas (T-120 / D-74). Populated alongside
+  /// handlers by registrants. A command with no entry dispatches
+  /// unvalidated — schema adoption is opt-in per command.
+  final Map<String, CommandSchema> _schemas = {};
+
+  /// Register [handler] for [cmd]. Pass [schema] to have the dispatcher
+  /// normalise + validate `req.args` before the handler runs (D-74).
+  void register(String cmd, CommandHandler handler, {CommandSchema? schema}) {
     _handlers[cmd] = handler;
+    if (schema != null) {
+      _schemas[cmd] = schema;
+    } else {
+      _schemas.remove(cmd);
+    }
   }
 
   /// Remove all registered handlers except ping/version.
   void clear() {
     _handlers.removeWhere((k, _) => k != 'ping' && k != 'version');
+    _schemas.removeWhere((k, _) => k != 'ping' && k != 'version');
   }
 
   bool get isEmpty => _handlers.length <= 2; // only ping + version
@@ -36,7 +50,13 @@ class DaemonDispatcher {
         ),
       );
     }
-    return h(req);
+    final schema = _schemas[req.cmd];
+    if (schema == null) return h(req);
+    final result = schema.validate(schema.normalize(req.args));
+    if (!result.isOk) {
+      return schemaError(req.id, result.error!);
+    }
+    return h(IpcRequest(id: req.id, cmd: req.cmd, args: result.values!));
   }
 
   Future<IpcResponse> _ping(IpcRequest req) async => IpcResponse.ok(

lib/src/daemon/git_commands.dart

@@ -7,6 +7,7 @@ library;
 
 import '../git/client.dart';
 import '../git/operations.dart' show GitException;
+import '../ipc/command_schema.dart';
 import '../ipc/envelope.dart';
 import '../ipc/schema_v1.dart';
 import '../panes/event_sink.dart';
@@ -22,6 +23,30 @@ const int _gitLogMaxCount = 1000;
 /// arguments.
 const int _gitPathsMaxCount = 256;
 
+/// Schema for `git.checkout` (D-74). `positional[0]` → `branch`, so
+/// `clide git checkout <branch>` from the C client now reaches the
+/// handler; the leading-dash guard stops argv injection at the
+/// dispatcher (mirrors [validateGitRef], kept below as
+/// defense-in-depth since the git client is also UI-reachable).
+const CommandSchema _checkoutSchema = CommandSchema(
+  positional: ['branch'],
+  args: {
+    'branch': ArgSpec(required: true, rejectLeadingDash: true),
+  },
+);
+
+/// Schema for `git.push` (D-74). `clide git push <remote> <branch>`.
+/// Both refs optional (bare `git.push` is valid); leading-dash
+/// rejected on each.
+const CommandSchema _pushSchema = CommandSchema(
+  positional: ['remote', 'branch'],
+  args: {
+    'remote': ArgSpec(rejectLeadingDash: true),
+    'branch': ArgSpec(rejectLeadingDash: true),
+    'setUpstream': ArgSpec(type: ArgType.boolean),
+  },
+);
+
 void registerGitCommands(
   DaemonDispatcher d,
   GitClient git,
@@ -245,7 +270,7 @@ void registerGitCommands(
     } on GitException catch (e) {
       return _gitError(req.id, e);
     }
-  });
+  }, schema: _pushSchema);
 
   d.register('git.branches', (req) async {
     try {
@@ -279,7 +304,7 @@ void registerGitCommands(
     } on GitException catch (e) {
       return _gitError(req.id, e);
     }
-  });
+  }, schema: _checkoutSchema);
 }
 
 List<String> _pathList(Object? raw) {

lib/src/daemon/panel_commands.dart

@@ -13,6 +13,7 @@
 /// `lib/src/daemon/panel_resizer_kernel.dart`.
 library;
 
+import '../ipc/command_schema.dart';
 import '../ipc/envelope.dart';
 import '../ipc/schema_v1.dart';
 import 'dispatcher.dart';
@@ -47,29 +48,40 @@ abstract class PanelResizer {
 /// [PanelResizer.bumpEditorRatio] instead of [PanelResizer.setSlotSize].
 const String editorSplitSlot = 'editor';
 
+/// Schema for `panel.resize` (D-74). The dispatcher normalises the
+/// argv shape (`positional[0]` → `slot`, `--to/--by` flags) and
+/// coerces `to`/`by` to numbers before the handler runs. The
+/// "exactly one of to/by" rule is cross-argument semantics, so it
+/// stays in the handler.
+const CommandSchema _resizeSchema = CommandSchema(
+  positional: ['slot'],
+  args: {
+    'slot': ArgSpec(required: true),
+    'to': ArgSpec(type: ArgType.number),
+    'by': ArgSpec(type: ArgType.number),
+  },
+);
+
 void registerPanelCommands(DaemonDispatcher d, PanelResizer resizer) {
-  d.register('panel.resize', (req) => _resize(req, resizer));
+  d.register('panel.resize', (req) => _resize(req, resizer), schema: _resizeSchema);
 }
 
 Future<IpcResponse> _resize(IpcRequest req, PanelResizer r) async {
-  final view = _ResizeArgs.from(req.args);
-  if (view.slot == null || view.slot!.isEmpty) {
-    return _userErr(req.id, 'slot is required (e.g. "sidebar", "context", "$editorSplitSlot")');
-  }
-  if (!view.hasTo && !view.hasBy) {
+  // Args are schema-normalised + coerced by the dispatcher: `slot` is a
+  // non-empty string, `to`/`by` are num? when present.
+  final slot = req.args['slot'] as String;
+  final hasTo = req.args['to'] != null;
+  final hasBy = req.args['by'] != null;
+  if (!hasTo && !hasBy) {
     return _userErr(req.id, 'one of `to` (absolute) or `by` (delta) is required');
   }
-  if (view.hasTo && view.hasBy) {
+  if (hasTo && hasBy) {
     return _userErr(req.id, 'pass only one of `to` and `by`');
   }
-  final value = view.value;
-  if (value == null) {
-    return _userErr(req.id, '${view.hasTo ? "to" : "by"} must be numeric');
-  }
-  final slot = view.slot!;
+  final value = ((hasTo ? req.args['to'] : req.args['by']) as num).toDouble();
 
   if (slot == editorSplitSlot) {
-    if (view.hasTo) {
+    if (hasTo) {
       r.setEditorRatio(value);
     } else {
       r.bumpEditorRatio(value);
@@ -80,7 +92,7 @@ Future<IpcResponse> _resize(IpcRequest req, PanelResizer r) async {
     });
   }
 
-  final ok = view.hasTo ? r.setSlotSize(slot, value) : r.bumpSlotSize(slot, value);
+  final ok = hasTo ? r.setSlotSize(slot, value) : r.bumpSlotSize(slot, value);
   if (!ok) {
     return _notFound(req.id, 'no such slot: $slot');
   }
@@ -90,58 +102,6 @@ Future<IpcResponse> _resize(IpcRequest req, PanelResizer r) async {
   });
 }
 
-/// Tiny adapter that lifts `panel.resize` arguments out of either
-/// the direct call shape (`{slot: ..., to: ...}`) or the argv-
-/// translator shape (`{positional: [slot], flags: {to: '...'}}`).
-/// Until T-120 formalises a shared schema, individual commands carry
-/// the lift themselves.
-class _ResizeArgs {
-  _ResizeArgs._({
-    required this.slot,
-    required this.hasTo,
-    required this.hasBy,
-    required this.value,
-  });
-
-  final String? slot;
-  final bool hasTo;
-  final bool hasBy;
-  final double? value;
-
-  factory _ResizeArgs.from(Map<String, Object?> args) {
-    String? slot;
-    final rawSlot = args['slot'];
-    if (rawSlot is String) slot = rawSlot;
-    final positional = args['positional'];
-    if (slot == null && positional is List && positional.isNotEmpty) {
-      slot = positional.first.toString();
-    }
-    final flags = args['flags'];
-    final flagsMap = flags is Map ? flags : const <Object?, Object?>{};
-    final hasTo = args.containsKey('to') || flagsMap.containsKey('to');
-    final hasBy = args.containsKey('by') || flagsMap.containsKey('by');
-    final raw = args.containsKey('to')
-        ? args['to']
-        : args.containsKey('by')
-            ? args['by']
-            : flagsMap.containsKey('to')
-                ? flagsMap['to']
-                : flagsMap['by'];
-    return _ResizeArgs._(
-      slot: slot,
-      hasTo: hasTo,
-      hasBy: hasBy,
-      value: _coerceNum(raw),
-    );
-  }
-
-  static double? _coerceNum(Object? v) {
-    if (v is num) return v.toDouble();
-    if (v is String) return double.tryParse(v);
-    return null;
-  }
-}
-
 IpcResponse _userErr(String id, String message, {String? hint}) => IpcResponse.err(
       id: id,
       error: IpcError(