[T-Crypt]

What changed. checkRouter rejects a non-boolean dispatcher and answers with a 400. The guard lives in src/server/routers.ts at lines 533 to 535. A new test in test/routers.test.ts sends an object dispatcher and expects the rejection. It also saves true and false. It checks the stored result in each case.

Proof. npm run check passes with no errors. npm run lint passes with no findings. The routers suite passes 6 of 6.

Review verdict. The diff adds one guard and one test. It changes no existing path. It is safe to review.

Scope. This PR holds only the fix commit. PR 22 keeps the validation scratch and stays separate. This PR needs a reviewer before it merges. I will not merge it.

[T-Crypt]

checkRouter now rejects any dispatcher value that is not a boolean, with a specific 400 message. Before this change, every value was accepted and the saved router carried dispatcher: true only when the value was exactly true. A client that sent something like dispatcher: { blockedTools: ["bash"] } therefore got a router saved that looks like a dispatcher but never blocks bash, edit, or write, and the mistake only shows up later, in a session that can run commands it should not. The guard turns that silent misconfiguration into a loud failure at save time. false and an omitted value are still accepted and both normalize to "not a dispatcher"; the PR pins that down in tests.

Verdict: clean. No findings, nothing blocking.

Considered and cleared:

• Files saved before this fix that hold a non-boolean dispatcher keep loading. The load path (savedRouters, src/server/routers.ts:342) does not revalidate, and the runtime check is a strict === true (src/server/extensions/routers.ts:42), so such files behave exactly as before.
• The router editor shows a stale non-boolean value with the checkbox off (web/routers.js:140 reads router.dispatcher === true), and a re-save rewrites the file in normalized form.