[haseebahmed248]

Summary

The checker classified a null literal as String, so echo(text: null) passed compilation. Infer null separately and compare type structure rather than diagnostic names, rejecting the invalid call before execution.

Related issue

Closes #35

This follows up the now-closed #46 against current main.

Changes

• Add an internal null inferred type without changing the grammar or public IR.
• Keep a declared record named null distinct from a null literal during type comparison.
• Add the original reproduction to the diagnostic corpus, with an exact GS2105 message and range checked through the compiler API and CLI.
• Test rejection for String, Url, record and list parameters, valid string arguments including "null", and null model context through JSON IR, generated contracts and execution.
• Document the distinction between null literals and strings.

Validation

• npm run check
• npm run check:generated
• npm test — 184 tests passed.
• Additional validation: npm run test:release — 4 passed; npm run test:package — 115 files, 7 exports and 2 executables verified; git diff --check passed.

Before the fix, the reproduction passed CLI checking and the new String rejection test failed with a missing exception. After the fix, it is rejected with GS2105. The positive string and null-context tests pass before and after.

Risk and compatibility

• Security or permission effects: prevents checked source from passing null as a non-nullable tool argument. Host modules remain trusted code; this is not a sandbox or an arbitrary-IR validator.
• Compatibility or breaking changes: previously accepted invalid null/type combinations now fail compilation. Diagnostic codes retain their existing meanings; no new nullable declarations, grammar, public IR version or runtime adapter interface is introduced. The npm package version is unchanged.

Checklist

• This change is focused on one issue.
• Behavioral changes include tests.
• Null behavior and the absence of nullable syntax are documented.
• Generated files are current.
• No credentials, private data, or unredacted model output are included.
• The commit includes the required DCO Signed-off-by line.