fix(build): restore tool policy typing

src/config/types.tools.ts

@@ -7,6 +7,15 @@ export type AgentToolsConfig = {
   profile?: ToolProfileId;
   allow?: string[];
   deny?: string[];
+  /** Optional tool policy overrides keyed by provider id or "provider/model". */
+  byProvider?: Record<
+    string,
+    {
+      profile?: ToolProfileId;
+      allow?: string[];
+      deny?: string[];
+    }
+  >;
   /** Per-agent elevated exec gate (can only further restrict global tools.elevated). */
   elevated?: {
     /** Enable or disable elevated mode for this agent (default: true). */
@@ -73,6 +82,15 @@ export type ToolsConfig = {
   profile?: ToolProfileId;
   allow?: string[];
   deny?: string[];
+  /** Optional tool policy overrides keyed by provider id or "provider/model". */
+  byProvider?: Record<
+    string,
+    {
+      profile?: ToolProfileId;
+      allow?: string[];
+      deny?: string[];
+    }
+  >;
   web?: {
     search?: {
       /** Enable web search tool (default: true when API key is present). */

src/config/zod-schema.agent-runtime.ts

@@ -146,6 +146,12 @@ export const ToolProfileSchema = z
   .union([z.literal("minimal"), z.literal("coding"), z.literal("messaging"), z.literal("full")])
   .optional();
 
+const ByProviderPolicySchema = z.object({
+  profile: ToolProfileSchema,
+  allow: z.array(z.string()).optional(),
+  deny: z.array(z.string()).optional(),
+});
+
 // Provider docking: allowlists keyed by provider id (no schema updates when adding providers).
 export const ElevatedAllowFromSchema = z
   .record(z.string(), z.array(z.union([z.string(), z.number()])))
@@ -170,6 +176,7 @@ export const AgentToolsSchema = z
     profile: ToolProfileSchema,
     allow: z.array(z.string()).optional(),
     deny: z.array(z.string()).optional(),
+    byProvider: z.record(z.string(), ByProviderPolicySchema).optional(),
     elevated: z
       .object({
         enabled: z.boolean().optional(),
@@ -273,6 +280,7 @@ export const ToolsSchema = z
     profile: ToolProfileSchema,
     allow: z.array(z.string()).optional(),
     deny: z.array(z.string()).optional(),
+    byProvider: z.record(z.string(), ByProviderPolicySchema).optional(),
     web: ToolsWebSchema,
     audio: z
       .object({