fix(build): restore tool policy typing

src/config/types.tools.ts

@@ -7,6 +7,15 @@ export type AgentToolsConfig = {
   profile?: ToolProfileId;
   allow?: string[];
   deny?: string[];
+  /** Optional tool policy overrides keyed by provider id or "provider/model". */
+  byProvider?: Record<
+    string,
+    {
+      profile?: ToolProfileId;
+      allow?: string[];
+      deny?: string[];
+    }
+  >;
   /** Per-agent elevated exec gate (can only further restrict global tools.elevated). */
   elevated?: {
     /** Enable or disable elevated mode for this agent (default: true). */
@@ -73,6 +82,15 @@ export type ToolsConfig = {
   profile?: ToolProfileId;
   allow?: string[];
   deny?: string[];
+  /** Optional tool policy overrides keyed by provider id or "provider/model". */
+  byProvider?: Record<
+    string,
+    {
+      profile?: ToolProfileId;
+      allow?: string[];
+      deny?: string[];
+    }
+  >;
   web?: {
     search?: {
       /** Enable web search tool (default: true when API key is present). */

src/config/zod-schema.agent-runtime.ts

@@ -146,6 +146,12 @@ export const ToolProfileSchema = z
   .union([z.literal("minimal"), z.literal("coding"), z.literal("messaging"), z.literal("full")])
   .optional();
 
+const ByProviderPolicySchema = z.object({
+  profile: ToolProfileSchema,
+  allow: z.array(z.string()).optional(),
+  deny: z.array(z.string()).optional(),
+});
+
 // Provider docking: allowlists keyed by provider id (no schema updates when adding providers).
 export const ElevatedAllowFromSchema = z
   .record(z.string(), z.array(z.union([z.string(), z.number()])))
@@ -170,6 +176,7 @@ export const AgentToolsSchema = z
     profile: ToolProfileSchema,
     allow: z.array(z.string()).optional(),
     deny: z.array(z.string()).optional(),
+    byProvider: z.record(z.string(), ByProviderPolicySchema).optional(),
     elevated: z
       .object({
         enabled: z.boolean().optional(),
@@ -273,6 +280,7 @@ export const ToolsSchema = z
     profile: ToolProfileSchema,
     allow: z.array(z.string()).optional(),
     deny: z.array(z.string()).optional(),
+    byProvider: z.record(z.string(), ByProviderPolicySchema).optional(),
     web: ToolsWebSchema,
     audio: z
       .object({

src/gateway/server-methods/config.ts

@@ -27,7 +27,7 @@ import {
   validateConfigSchemaParams,
   validateConfigSetParams,
 } from "../protocol/index.js";
-import type { GatewayRequestHandlers } from "./types.js";
+import type { GatewayRequestHandlers, RespondFn } from "./types.js";
 
 function resolveBaseHash(params: unknown): string | null {
   const raw = (params as { baseHash?: unknown })?.baseHash;
@@ -39,7 +39,7 @@ function resolveBaseHash(params: unknown): string | null {
 function requireConfigBaseHash(
   params: unknown,
   snapshot: Awaited<ReturnType<typeof readConfigFileSnapshot>>,
-  respond: (ok: boolean, payload?: unknown, error?: unknown) => void,
+  respond: RespondFn,
 ): boolean {
   if (!snapshot.exists) return true;
   if (typeof snapshot.raw !== "string" || !snapshot.hash) {