[AI] manage_patches input schema doesn't tell the model install requires patchIds + deviceIds

[ToddHebebrand]

Description

When asked to remediate a vulnerability, the model's first manage_patches call regularly fails with:

{"error":"Invalid input: : patchIds and deviceIds are required for install"}

It then retries with the right shape and succeeds — but that's a wasted turn, extra cost, and an error card in the chat UI on every run that hits it. The conditional requirement (action: "install" needs patchIds + deviceIds) is enforced at runtime but evidently not visible enough in the tool's input_schema/description for the model to get it right first try.

Repro

Org-scoped AI chat on a seeded dev stack: "Remediate the Chrome findings on by queueing the approved patch." First manage_patches call omits patchIds/deviceIds, fails, retries.

Proposed Fix

Spell out the per-action required fields in the tool description (e.g. "action=install requires patchIds and deviceIds") and/or restructure the schema so the requirement is explicit. Also worth double-checking the doubled colon in the error message ("Invalid input: :").

Affected Files

• apps/api/src/services/aiToolsPatch*.ts (manage_patches definition)