From eb3e865f15943e07baa0a0784a5c1ab79fd082c3 Mon Sep 17 00:00:00 2001
From: Peter Steinberger <steipete@gmail.com>
Date: Thu, 15 Jan 2026 04:33:35 +0000
Subject: [PATCH] fix(build): restore tool policy typing

---
 src/config/types.tools.ts              | 18 ++++++++++++++++++
 src/config/zod-schema.agent-runtime.ts |  8 ++++++++
 src/gateway/server-methods/config.ts   |  4 ++--
 3 files changed, 28 insertions(+), 2 deletions(-)

diff --git a/src/config/types.tools.ts b/src/config/types.tools.ts
index 8f7a36fa5..2662c5000 100644
--- a/src/config/types.tools.ts
+++ b/src/config/types.tools.ts
@@ -7,6 +7,15 @@ export type AgentToolsConfig = {
   profile?: ToolProfileId;
   allow?: string[];
   deny?: string[];
+  /** Optional tool policy overrides keyed by provider id or "provider/model". */
+  byProvider?: Record<
+    string,
+    {
+      profile?: ToolProfileId;
+      allow?: string[];
+      deny?: string[];
+    }
+  >;
   /** Per-agent elevated exec gate (can only further restrict global tools.elevated). */
   elevated?: {
     /** Enable or disable elevated mode for this agent (default: true). */
@@ -73,6 +82,15 @@ export type ToolsConfig = {
   profile?: ToolProfileId;
   allow?: string[];
   deny?: string[];
+  /** Optional tool policy overrides keyed by provider id or "provider/model". */
+  byProvider?: Record<
+    string,
+    {
+      profile?: ToolProfileId;
+      allow?: string[];
+      deny?: string[];
+    }
+  >;
   web?: {
     search?: {
       /** Enable web search tool (default: true when API key is present). */
diff --git a/src/config/zod-schema.agent-runtime.ts b/src/config/zod-schema.agent-runtime.ts
index 7dbd95730..341fadbb3 100644
--- a/src/config/zod-schema.agent-runtime.ts
+++ b/src/config/zod-schema.agent-runtime.ts
@@ -146,6 +146,12 @@ export const ToolProfileSchema = z
   .union([z.literal("minimal"), z.literal("coding"), z.literal("messaging"), z.literal("full")])
   .optional();
 
+const ByProviderPolicySchema = z.object({
+  profile: ToolProfileSchema,
+  allow: z.array(z.string()).optional(),
+  deny: z.array(z.string()).optional(),
+});
+
 // Provider docking: allowlists keyed by provider id (no schema updates when adding providers).
 export const ElevatedAllowFromSchema = z
   .record(z.string(), z.array(z.union([z.string(), z.number()])))
@@ -170,6 +176,7 @@ export const AgentToolsSchema = z
     profile: ToolProfileSchema,
     allow: z.array(z.string()).optional(),
     deny: z.array(z.string()).optional(),
+    byProvider: z.record(z.string(), ByProviderPolicySchema).optional(),
     elevated: z
       .object({
         enabled: z.boolean().optional(),
@@ -273,6 +280,7 @@ export const ToolsSchema = z
     profile: ToolProfileSchema,
     allow: z.array(z.string()).optional(),
     deny: z.array(z.string()).optional(),
+    byProvider: z.record(z.string(), ByProviderPolicySchema).optional(),
     web: ToolsWebSchema,
     audio: z
       .object({
diff --git a/src/gateway/server-methods/config.ts b/src/gateway/server-methods/config.ts
index 1e43a3c41..d1ff9d344 100644
--- a/src/gateway/server-methods/config.ts
+++ b/src/gateway/server-methods/config.ts
@@ -27,7 +27,7 @@ import {
   validateConfigSchemaParams,
   validateConfigSetParams,
 } from "../protocol/index.js";
-import type { GatewayRequestHandlers } from "./types.js";
+import type { GatewayRequestHandlers, RespondFn } from "./types.js";
 
 function resolveBaseHash(params: unknown): string | null {
   const raw = (params as { baseHash?: unknown })?.baseHash;
@@ -39,7 +39,7 @@ function resolveBaseHash(params: unknown): string | null {
 function requireConfigBaseHash(
   params: unknown,
   snapshot: Awaited<ReturnType<typeof readConfigFileSnapshot>>,
-  respond: (ok: boolean, payload?: unknown, error?: unknown) => void,
+  respond: RespondFn,
 ): boolean {
   if (!snapshot.exists) return true;
   if (typeof snapshot.raw !== "string" || !snapshot.hash) {