fix: address PR review findings - types and defensive guards

- Add BehaviorFlagKey type export to types/index.ts (fixes Vercel build
  error: 'BehaviorFlagKey' not exported from types)
- getSharedServiceDomain: add typeof string guard before accepting a
  serviceDomains entry; prevents TypeError if JSON has a non-string value
  calling .replace() on a Badge label (high severity)
- matchesBehaviorFlags: skip entries where expected is undefined; with
  Partial<Record<BehaviorFlagKey, boolean>> a key can be undefined to
  mean "don't filter", but the old code compared !== expected which
  incorrectly excluded tools (low severity)

Made-with: Cursor

Author: jottakka

app/_components/toolkit-docs/components/available-tools-table.tsx

@@ -535,8 +535,11 @@ function matchesBehaviorFlags(
 ): boolean {
   for (const [key, expected] of Object.entries(behaviorFlags) as [
     BehaviorFlagKey,
-    boolean,
+    boolean | undefined,
   ][]) {
+    if (expected === undefined) {
+      continue;
+    }
     if (tool.metadata?.behavior?.[key] !== expected) {
       return false;
     }

app/_components/toolkit-docs/components/toolkit-page.tsx

@@ -232,7 +232,7 @@ export function getSharedServiceDomain(
     }
 
     const domain = serviceDomains[0];
-    if (!domain) {
+    if (!domain || typeof domain !== "string") {
       return null;
     }
 

app/_components/toolkit-docs/types/index.ts

@@ -197,6 +197,12 @@ export type ToolMetadataBehavior = {
   openWorld?: boolean;
 };
 
+export type BehaviorFlagKey =
+  | "readOnly"
+  | "destructive"
+  | "idempotent"
+  | "openWorld";
+
 export type ToolMetadata = {
   classification: ToolMetadataClassification;
   behavior: ToolMetadataBehavior;