@evalops/maestro 0.10.21 → 0.10.23

package/dist/codex/compatibility.d.ts

@@ -36,11 +36,27 @@ export declare const CODEX_DYNAMIC_TOOL_CONFORMANCE: {
     readonly unsupportedTopLevelSchemaKeywords: readonly ["anyOf", "oneOf", "allOf", "enum", "not"];
     readonly dynamicToolCallMethod: "item/tool/call";
 };
-export declare const CODEX_DEFAULT_TOOL_PROFILE: readonly ["read", "list", "find", "search", "parallel_ripgrep", "diff", "bash", "background_tasks", "apply_patch", "edit", "write", "todo", "status", "gh_pr", "gh_issue", "gh_repo"];
+export declare const CODEX_FILE_MUTATION_TOOL_PROFILE: readonly ["apply_patch", "edit", "write"];
+export declare const CODEX_READ_ONLY_TOOL_PROFILE: readonly ["read", "list", "find", "search", "diff", "status"];
+export declare const CODEX_DEFAULT_TOOL_PROFILE: readonly ["read", "list", "find", "search", "diff", "bash", "apply_patch", "edit", "write", "todo", "status", "gh_pr"];
+export declare const CODEX_EXTENDED_TOOL_PROFILE: readonly ["read", "list", "find", "search", "parallel_ripgrep", "diff", "bash", "background_tasks", "apply_patch", "edit", "write", "todo", "status", "gh_pr", "gh_issue", "gh_repo"];
+export declare const CODEX_TOOL_PROFILES: {
+    readonly lean: readonly ["read", "list", "find", "search", "diff", "bash", "apply_patch", "edit", "write", "todo", "status", "gh_pr"];
+    readonly default: readonly ["read", "list", "find", "search", "diff", "bash", "apply_patch", "edit", "write", "todo", "status", "gh_pr"];
+    readonly "read-only": readonly ["read", "list", "find", "search", "diff", "status"];
+    readonly readonly: readonly ["read", "list", "find", "search", "diff", "status"];
+    readonly extended: readonly ["read", "list", "find", "search", "parallel_ripgrep", "diff", "bash", "background_tasks", "apply_patch", "edit", "write", "todo", "status", "gh_pr", "gh_issue", "gh_repo"];
+};
+export type CodexToolProfileName = keyof typeof CODEX_TOOL_PROFILES;
 export declare function isCodexAppServerApi(api: unknown): boolean;
 export declare function selectCodexDefaultTools<TTool extends {
     name: string;
 }>(tools: readonly TTool[]): TTool[];
+export declare function selectCodexToolProfile<TTool extends {
+    name: string;
+}>(tools: readonly TTool[], profileName: CodexToolProfileName): TTool[];
+export declare function resolveCodexToolProfileName(value: string | undefined): CodexToolProfileName;
+export declare function getCodexToolProfileNames(): CodexToolProfileName[];
 export declare function compileCodexDynamicToolSpecs(tools: readonly CodexCompatibleTool[]): CodexDynamicToolCompilation;
 export declare function createCodexDynamicToolNameMap(bindings: readonly CodexDynamicToolBinding[]): Map<string, string>;
 export declare function normalizeCodexDynamicToolInputSchema(schema: unknown): JsonObject;

package/dist/codex/compatibility.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"compatibility.d.ts","sourceRoot":"","sources":["../../src/codex/compatibility.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,mBAAmB,CAAC;AAE9C,KAAK,UAAU,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAG1C,KAAK,mBAAmB,GAAG,IAAI,CAC9B,IAAI,EACJ,MAAM,GAAG,aAAa,GAAG,YAAY,GAAG,oBAAoB,CAC5D,GAAG;IACH,iBAAiB,CAAC,EAAE,QAAQ,GAAG,QAAQ,CAAC;CACxC,CAAC;AAEF,MAAM,MAAM,oBAAoB,GAAG;IAClC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,UAAU,CAAC;IACxB,YAAY,CAAC,EAAE,OAAO,CAAC;CACvB,CAAC;AAEF,MAAM,MAAM,4BAA4B,GAAG;IAC1C,QAAQ,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAAC;IACvC,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF,MAAM,MAAM,uBAAuB,GAAG;IACrC,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;CACrB,CAAC;AAEF,MAAM,MAAM,2BAA2B,GAAG;IACzC,KAAK,EAAE,oBAAoB,EAAE,CAAC;IAC9B,QAAQ,EAAE,uBAAuB,EAAE,CAAC;IACpC,WAAW,EAAE,4BAA4B,EAAE,CAAC;CAC5C,CAAC;AAEF,eAAO,MAAM,8BAA8B;;;;;;;;;CAwBjC,CAAC;AAEX,eAAO,MAAM,0BAA0B,uLAiB7B,CAAC;AAYX,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAEzD;AAED,wBAAgB,uBAAuB,CAAC,KAAK,SAAS;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,EACrE,KAAK,EAAE,SAAS,KAAK,EAAE,GACrB,KAAK,EAAE,CAKT;AAED,wBAAgB,4BAA4B,CAC3C,KAAK,EAAE,SAAS,mBAAmB,EAAE,GACnC,2BAA2B,CAqC7B;AAED,wBAAgB,6BAA6B,CAC5C,QAAQ,EAAE,SAAS,uBAAuB,EAAE,GAC1C,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAIrB;AAED,wBAAgB,oCAAoC,CACnD,MAAM,EAAE,OAAO,GACb,UAAU,CAyBZ"}
+{"version":3,"file":"compatibility.d.ts","sourceRoot":"","sources":["../../src/codex/compatibility.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,mBAAmB,CAAC;AAE9C,KAAK,UAAU,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAG1C,KAAK,mBAAmB,GAAG,IAAI,CAC9B,IAAI,EACJ,MAAM,GAAG,aAAa,GAAG,YAAY,GAAG,oBAAoB,CAC5D,GAAG;IACH,iBAAiB,CAAC,EAAE,QAAQ,GAAG,QAAQ,CAAC;CACxC,CAAC;AAEF,MAAM,MAAM,oBAAoB,GAAG;IAClC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,UAAU,CAAC;IACxB,YAAY,CAAC,EAAE,OAAO,CAAC;CACvB,CAAC;AAEF,MAAM,MAAM,4BAA4B,GAAG;IAC1C,QAAQ,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAAC;IACvC,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF,MAAM,MAAM,uBAAuB,GAAG;IACrC,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;CACrB,CAAC;AAEF,MAAM,MAAM,2BAA2B,GAAG;IACzC,KAAK,EAAE,oBAAoB,EAAE,CAAC;IAC9B,QAAQ,EAAE,uBAAuB,EAAE,CAAC;IACpC,WAAW,EAAE,4BAA4B,EAAE,CAAC;CAC5C,CAAC;AAEF,eAAO,MAAM,8BAA8B;;;;;;;;;CAwBjC,CAAC;AAEX,eAAO,MAAM,gCAAgC,2CAInC,CAAC;AAEX,eAAO,MAAM,4BAA4B,+DAO/B,CAAC;AAEX,eAAO,MAAM,0BAA0B,wHAa7B,CAAC;AAEX,eAAO,MAAM,2BAA2B,uLAiB9B,CAAC;AAEX,eAAO,MAAM,mBAAmB;;;;;;CAMtB,CAAC;AAEX,MAAM,MAAM,oBAAoB,GAAG,MAAM,OAAO,mBAAmB,CAAC;AAYpE,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAEzD;AAED,wBAAgB,uBAAuB,CAAC,KAAK,SAAS;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,EACrE,KAAK,EAAE,SAAS,KAAK,EAAE,GACrB,KAAK,EAAE,CAET;AAED,wBAAgB,sBAAsB,CAAC,KAAK,SAAS;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,EACpE,KAAK,EAAE,SAAS,KAAK,EAAE,EACvB,WAAW,EAAE,oBAAoB,GAC/B,KAAK,EAAE,CAMT;AAED,wBAAgB,2BAA2B,CAC1C,KAAK,EAAE,MAAM,GAAG,SAAS,GACvB,oBAAoB,CAWtB;AAED,wBAAgB,wBAAwB,IAAI,oBAAoB,EAAE,CAEjE;AAMD,wBAAgB,4BAA4B,CAC3C,KAAK,EAAE,SAAS,mBAAmB,EAAE,GACnC,2BAA2B,CAqC7B;AAED,wBAAgB,6BAA6B,CAC5C,QAAQ,EAAE,SAAS,uBAAuB,EAAE,GAC1C,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAIrB;AAED,wBAAgB,oCAAoC,CACnD,MAAM,EAAE,OAAO,GACb,UAAU,CAyBZ"}

package/dist/codex/compatibility.js

@@ -23,7 +23,34 @@ export const CODEX_DYNAMIC_TOOL_CONFORMANCE = {
     unsupportedTopLevelSchemaKeywords: ["anyOf", "oneOf", "allOf", "enum", "not"],
     dynamicToolCallMethod: "item/tool/call",
 };
+export const CODEX_FILE_MUTATION_TOOL_PROFILE = [
+    "apply_patch",
+    "edit",
+    "write",
+];
+export const CODEX_READ_ONLY_TOOL_PROFILE = [
+    "read",
+    "list",
+    "find",
+    "search",
+    "diff",
+    "status",
+];
 export const CODEX_DEFAULT_TOOL_PROFILE = [
+    "read",
+    "list",
+    "find",
+    "search",
+    "diff",
+    "bash",
+    "apply_patch",
+    "edit",
+    "write",
+    "todo",
+    "status",
+    "gh_pr",
+];
+export const CODEX_EXTENDED_TOOL_PROFILE = [
     "read",
     "list",
     "find",
@@ -41,6 +68,13 @@ export const CODEX_DEFAULT_TOOL_PROFILE = [
     "gh_issue",
     "gh_repo",
 ];
+export const CODEX_TOOL_PROFILES = {
+    lean: CODEX_DEFAULT_TOOL_PROFILE,
+    default: CODEX_DEFAULT_TOOL_PROFILE,
+    "read-only": CODEX_READ_ONLY_TOOL_PROFILE,
+    readonly: CODEX_READ_ONLY_TOOL_PROFILE,
+    extended: CODEX_EXTENDED_TOOL_PROFILE,
+};
 const CODEX_DYNAMIC_TOOL_COMPOSITION_SCHEMA_KEYS = [
     "anyOf",
     "oneOf",
@@ -51,8 +85,30 @@ export function isCodexAppServerApi(api) {
     return api === "openai-codex-app-server";
 }
 export function selectCodexDefaultTools(tools) {
+    return selectCodexToolProfile(tools, "lean");
+}
+export function selectCodexToolProfile(tools, profileName) {
+    const profile = CODEX_TOOL_PROFILES[profileName];
     const byName = new Map(tools.map((tool) => [tool.name, tool]));
-    return CODEX_DEFAULT_TOOL_PROFILE.map((name) => byName.get(name)).filter((tool) => Boolean(tool));
+    return profile
+        .map((name) => byName.get(name))
+        .filter((tool) => Boolean(tool));
+}
+export function resolveCodexToolProfileName(value) {
+    if (!value || value.trim().length === 0) {
+        return "lean";
+    }
+    const normalized = value.trim().toLowerCase().replace(/_/g, "-");
+    if (isCodexToolProfileName(normalized)) {
+        return normalized;
+    }
+    throw new Error(`Unknown Codex tool profile "${value}". Available profiles: ${getCodexToolProfileNames().join(", ")}`);
+}
+export function getCodexToolProfileNames() {
+    return Object.keys(CODEX_TOOL_PROFILES);
+}
+function isCodexToolProfileName(value) {
+    return Object.hasOwn(CODEX_TOOL_PROFILES, value);
 }
 export function compileCodexDynamicToolSpecs(tools) {
     const specs = [];

package/dist/codex/compatibility.js.map

@@ -1 +1 @@
-{"version":3,"file":"compatibility.js","sourceRoot":"","sources":["../../src/codex/compatibility.ts"],"names":[],"mappings":"AAuCA,MAAM,CAAC,MAAM,8BAA8B,GAAG;IAC7C,aAAa,EAAE,GAAG;IAClB,kBAAkB,EAAE,EAAE;IACtB,iBAAiB,EAAE,kBAAkB;IACrC,kBAAkB,EAAE;QACnB,UAAU;QACV,SAAS;QACT,UAAU;QACV,WAAW;QACX,aAAa;QACb,WAAW;QACX,WAAW;QACX,gBAAgB;QAChB,QAAQ;QACR,qBAAqB;QACrB,oBAAoB;QACpB,UAAU;QACV,aAAa;QACb,KAAK;KACL;IACD,aAAa,EAAE,CAAC,KAAK,CAAC;IACtB,oBAAoB,EAAE,CAAC,OAAO,CAAC;IAC/B,iCAAiC,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC;IAC7E,qBAAqB,EAAE,gBAAgB;CAC9B,CAAC;AAEX,MAAM,CAAC,MAAM,0BAA0B,GAAG;IACzC,MAAM;IACN,MAAM;IACN,MAAM;IACN,QAAQ;IACR,kBAAkB;IAClB,MAAM;IACN,MAAM;IACN,kBAAkB;IAClB,aAAa;IACb,MAAM;IACN,OAAO;IACP,MAAM;IACN,QAAQ;IACR,OAAO;IACP,UAAU;IACV,SAAS;CACA,CAAC;AAEX,MAAM,0CAA0C,GAAG;IAClD,OAAO;IACP,OAAO;IACP,OAAO;CACE,CAAC;AAEX,MAAM,oDAAoD,GAAG,IAAI,GAAG,CACnE,8BAA8B,CAAC,iCAAiC,CAChE,CAAC;AAEF,MAAM,UAAU,mBAAmB,CAAC,GAAY;IAC/C,OAAO,GAAG,KAAK,yBAAyB,CAAC;AAC1C,CAAC;AAED,MAAM,UAAU,uBAAuB,CACtC,KAAuB;IAEvB,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;IAC/D,OAAO,0BAA0B,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CACvE,CAAC,IAAI,EAAiB,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CACtC,CAAC;AACH,CAAC;AAED,MAAM,UAAU,4BAA4B,CAC3C,KAAqC;IAErC,MAAM,KAAK,GAA2B,EAAE,CAAC;IACzC,MAAM,QAAQ,GAA8B,EAAE,CAAC;IAC/C,MAAM,WAAW,GAAmC,EAAE,CAAC;IACvD,MAAM,iBAAiB,GAAG,IAAI,GAAG,EAAU,CAAC;IAC5C,MAAM,cAAc,GAAG,IAAI,GAAG,EAAU,CAAC;IAEzC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QAC1B,IAAI,IAAI,CAAC,kBAAkB,IAAI,IAAI,CAAC,iBAAiB,KAAK,QAAQ,EAAE,CAAC;YACpE,SAAS;QACV,CAAC;QACD,IAAI,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACtC,SAAS;QACV,CAAC;QACD,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAEjC,MAAM,SAAS,GAAG,4BAA4B,CAAC,IAAI,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;QAC1E,IAAI,SAAS,KAAK,IAAI,CAAC,IAAI,EAAE,CAAC;YAC7B,WAAW,CAAC,IAAI,CAAC;gBAChB,QAAQ,EAAE,SAAS;gBACnB,IAAI,EAAE,cAAc;gBACpB,OAAO,EAAE,SAAS,IAAI,CAAC,IAAI,6BAA6B,SAAS,sDAAsD;gBACvH,QAAQ,EAAE,IAAI,CAAC,IAAI;gBACnB,SAAS;aACT,CAAC,CAAC;QACJ,CAAC;QAED,cAAc,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC9B,KAAK,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,SAAS;YACf,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,WAAW,EAAE,oCAAoC,CAAC,IAAI,CAAC,UAAU,CAAC;SAClE,CAAC,CAAC;QACH,QAAQ,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,YAAY,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;IACvD,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAC;AACzC,CAAC;AAED,MAAM,UAAU,6BAA6B,CAC5C,QAA4C;IAE5C,OAAO,IAAI,GAAG,CACb,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC,CACpE,CAAC;AACH,CAAC;AAED,MAAM,UAAU,oCAAoC,CACnD,MAAe;IAEf,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QACvB,OAAO,gCAAgC,EAAE,CAAC;IAC3C,CAAC;IAED,MAAM,SAAS,GAAG,gCAAgC,CAAC,MAAM,CAAC,CAAC;IAC3D,IAAI,SAAS,EAAE,CAAC;QACf,OAAO,SAAS,CAAC;IAClB,CAAC;IAED,MAAM,UAAU,GAAe,EAAE,CAAC;IAClC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QACnD,IAAI,oDAAoD,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YACnE,SAAS;QACV,CAAC;QACD,UAAU,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IACzB,CAAC;IACD,UAAU,CAAC,IAAI,GAAG,QAAQ,CAAC;IAC3B,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QACtC,UAAU,CAAC,UAAU,GAAG,EAAE,CAAC;IAC5B,CAAC;IACD,IAAI,CAAC,CAAC,sBAAsB,IAAI,UAAU,CAAC,EAAE,CAAC;QAC7C,UAAU,CAAC,oBAAoB,GAAG,KAAK,CAAC;IACzC,CAAC;IACD,OAAO,UAAU,CAAC;AACnB,CAAC;AAED,SAAS,4BAA4B,CACpC,QAAgB,EAChB,cAAmC;IAEnC,MAAM,QAAQ,GAAG,sBAAsB,CAAC,QAAQ,CAAC,CAAC;IAClD,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;QACnC,OAAO,QAAQ,CAAC;IACjB,CAAC;IACD,KAAK,IAAI,KAAK,GAAG,CAAC,GAAI,KAAK,IAAI,CAAC,EAAE,CAAC;QAClC,MAAM,MAAM,GAAG,IAAI,KAAK,EAAE,CAAC;QAC3B,MAAM,SAAS,GAAG,GAAG,kBAAkB,CACtC,QAAQ,EACR,8BAA8B,CAAC,aAAa,GAAG,MAAM,CAAC,MAAM,CAC5D,GAAG,MAAM,EAAE,CAAC;QACb,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;YACpC,OAAO,SAAS,CAAC;QAClB,CAAC;IACF,CAAC;AACF,CAAC;AAED,SAAS,sBAAsB,CAAC,QAAgB;IAC/C,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC;IAChC,IAAI,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,iBAAiB,EAAE,GAAG,CAAC,CAAC;IACxD,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5B,SAAS,GAAG,cAAc,CAAC;IAC5B,CAAC;IACD,IAAI,oCAAoC,CAAC,SAAS,CAAC,EAAE,CAAC;QACrD,SAAS,GAAG,WAAW,SAAS,EAAE,CAAC;IACpC,CAAC;IACD,OAAO,kBAAkB,CACxB,SAAS,EACT,8BAA8B,CAAC,aAAa,CAC5C,CAAC;AACH,CAAC;AAED,SAAS,oCAAoC,CAAC,KAAa;IAC1D,OAAO,CACN,8BAA8B,CAAC,aAAa,CAAC,IAAI,CAChD,CAAC,YAAY,EAAE,EAAE,CAAC,KAAK,KAAK,YAAY,CACxC;QACD,8BAA8B,CAAC,oBAAoB,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CACnE,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CACxB,CACD,CAAC;AACH,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAa,EAAE,SAAiB;IAC3D,IAAI,KAAK,CAAC,MAAM,IAAI,SAAS,EAAE,CAAC;QAC/B,OAAO,KAAK,CAAC;IACd,CAAC;IACD,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,CAAC;AAC/C,CAAC;AAED,SAAS,gCAAgC;IACxC,OAAO;QACN,IAAI,EAAE,QAAQ;QACd,UAAU,EAAE,EAAE;QACd,oBAAoB,EAAE,KAAK;KAC3B,CAAC;AACH,CAAC;AAED,SAAS,gCAAgC,CACxC,MAAkB;IAElB,KAAK,MAAM,GAAG,IAAI,0CAA0C,EAAE,CAAC;QAC9D,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;QAC7B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC9B,SAAS;QACV,CAAC;QACD,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;YACxD,OAAO,gCAAgC,EAAE,CAAC;QAC3C,CAAC;QACD,OAAO,2BAA2B,CAAC,MAAM,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAC;IAC3D,CAAC;IACD,OAAO,IAAI,CAAC;AACb,CAAC;AAED,SAAS,2BAA2B,CACnC,MAAkB,EAClB,cAA2E,EAC3E,QAAsB;IAEtB,MAAM,eAAe,GAAG,IAAI,GAAG,EAAqB,CAAC;IACrD,MAAM,kBAAkB,GAAG,MAAM,CAAC,UAAU,CAAC;IAC7C,IAAI,QAAQ,CAAC,kBAAkB,CAAC,EAAE,CAAC;QAClC,KAAK,MAAM,CAAC,IAAI,EAAE,cAAc,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,kBAAkB,CAAC,EAAE,CAAC;YACzE,iBAAiB,CAAC,eAAe,EAAE,IAAI,EAAE,cAAc,CAAC,CAAC;QAC1D,CAAC;IACF,CAAC;IAED,MAAM,kBAAkB,GAAuB,EAAE,CAAC;IAClD,KAAK,MAAM,MAAM,IAAI,QAAQ,EAAE,CAAC;QAC/B,MAAM,gBAAgB,GAAG,MAAM,CAAC,UAAU,CAAC;QAC3C,IAAI,QAAQ,CAAC,gBAAgB,CAAC,EAAE,CAAC;YAChC,KAAK,MAAM,CAAC,IAAI,EAAE,cAAc,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,gBAAgB,CAAC,EAAE,CAAC;gBACvE,iBAAiB,CAAC,eAAe,EAAE,IAAI,EAAE,cAAc,CAAC,CAAC;YAC1D,CAAC;QACF,CAAC;QACD,kBAAkB,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,eAAe,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;IACpE,CAAC;IAED,MAAM,UAAU,GAAe,EAAE,CAAC;IAClC,KAAK,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,eAAe,CAAC,OAAO,EAAE,EAAE,CAAC;QACzD,UAAU,CAAC,IAAI,CAAC,GAAG,oBAAoB,CAAC,OAAO,CAAC,CAAC;IAClD,CAAC;IAED,MAAM,QAAQ,GAAG,wBAAwB,CACxC,MAAM,EACN,cAAc,EACd,kBAAkB,CAClB,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,IAAI,UAAU,CAAC,CAAC;IACvC,MAAM,SAAS,GAAe;QAC7B,IAAI,EAAE,QAAQ;QACd,UAAU;QACV,oBAAoB,EAAE,oCAAoC,CACzD,MAAM,EACN,cAAc,EACd,QAAQ,CACR;KACD,CAAC;IACF,IAAI,OAAO,MAAM,CAAC,WAAW,KAAK,QAAQ,EAAE,CAAC;QAC5C,SAAS,CAAC,WAAW,GAAG,MAAM,CAAC,WAAW,CAAC;IAC5C,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACzB,SAAS,CAAC,QAAQ,GAAG,QAAQ,CAAC;IAC/B,CAAC;IACD,OAAO,SAAS,CAAC;AAClB,CAAC;AAED,SAAS,iBAAiB,CACzB,eAAuC,EACvC,IAAY,EACZ,cAAuB;IAEvB,MAAM,OAAO,GAAG,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC1C,IAAI,OAAO,EAAE,CAAC;QACb,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QAC7B,OAAO;IACR,CAAC;IACD,eAAe,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,cAAc,CAAC,CAAC,CAAC;AAC7C,CAAC;AAED,SAAS,wBAAwB,CAChC,MAAkB,EAClB,cAA2E,EAC3E,kBAAsC;IAEtC,MAAM,gBAAgB,GAAG,eAAe,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC1D,IAAI,kBAAkB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACrC,OAAO,gBAAgB,CAAC;IACzB,CAAC;IACD,IAAI,cAAc,KAAK,OAAO,EAAE,CAAC;QAChC,OAAO,aAAa,CAAC;YACpB,GAAG,gBAAgB;YACnB,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC;SAChD,CAAC,CAAC;IACJ,CAAC;IACD,MAAM,mBAAmB,GAAG,kBAAkB,CAAC,CAAC,CAAC,IAAI,IAAI,GAAG,EAAU,CAAC;IACvE,MAAM,qBAAqB,GAAG,CAAC,GAAG,mBAAmB,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CACtE,kBAAkB,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAChD,CAAC;IACF,OAAO,aAAa,CAAC,CAAC,GAAG,gBAAgB,EAAE,GAAG,qBAAqB,CAAC,CAAC,CAAC;AACvE,CAAC;AAED,SAAS,oBAAoB,CAAC,OAAkB;IAC/C,MAAM,aAAa,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;IAC/C,IAAI,aAAa,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;QAC/B,OAAO,aAAa,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC/B,CAAC;IAED,MAAM,WAAW,GAAG,aAAa,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;IACtD,IAAI,WAAW,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;QAC/C,MAAM,WAAW,GAAG,aAAa,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;QACtD,MAAM,UAAU,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,WAAW,CAAC,CAAC,CAAC,CAAC;YACtE,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC;YAChB,CAAC,CAAC,SAAS,CAAC;QACb,OAAO;YACN,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3C,IAAI,EAAE,eAAe,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;SAC9D,CAAC;IACH,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC;AACjC,CAAC;AAED,SAAS,oCAAoC,CAC5C,MAAkB,EAClB,cAA2E,EAC3E,QAAsB;IAEtB,MAAM,kBAAkB,GAAG,kCAAkC,CAC5D,MAAM,CAAC,oBAAoB,CAC3B,CAAC;IACF,IAAI,kBAAkB,KAAK,KAAK,EAAE,CAAC;QAClC,OAAO,KAAK,CAAC;IACd,CAAC;IACD,MAAM,gBAAgB,GACrB,cAAc,KAAK,OAAO;QACzB,CAAC,CAAC,wCAAwC,CACxC,QAAQ,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CACvB,kCAAkC,CAAC,MAAM,CAAC,oBAAoB,CAAC,CAC/D,CACD;QACF,CAAC,CAAC,oCAAoC,CACpC,QAAQ,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CACvB,kCAAkC,CAAC,MAAM,CAAC,oBAAoB,CAAC,CAC/D,CACD,CAAC;IACL,OAAO,wCAAwC,CAAC;QAC/C,kBAAkB;QAClB,gBAAgB;KAChB,CAAC,CAAC;AACJ,CAAC;AAED,SAAS,kCAAkC,CAC1C,KAAc;IAEd,IAAI,KAAK,KAAK,KAAK,EAAE,CAAC;QACrB,OAAO,KAAK,CAAC;IACd,CAAC;IACD,IAAI,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACrB,OAAO,KAAK,CAAC;IACd,CAAC;IACD,OAAO,IAAI,CAAC;AACb,CAAC;AAED,SAAS,oCAAoC,CAC5C,WAA6C;IAE7C,IAAI,WAAW,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,KAAK,KAAK,CAAC,EAAE,CAAC;QAC5D,OAAO,KAAK,CAAC;IACd,CAAC;IACD,IAAI,WAAW,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,KAAK,IAAI,CAAC,EAAE,CAAC;QAC3D,OAAO,IAAI,CAAC;IACb,CAAC;IACD,MAAM,OAAO,GAAG,WAAW,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC7C,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,KAAK,CAAC;IACd,CAAC;IACD,OAAO,kCAAkC,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;AAC7D,CAAC;AAED,SAAS,wCAAwC,CAChD,WAA6C;IAE7C,IAAI,WAAW,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,KAAK,KAAK,CAAC,EAAE,CAAC;QAC5D,OAAO,KAAK,CAAC;IACd,CAAC;IACD,MAAM,OAAO,GAAG,WAAW,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC7C,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,IAAI,CAAC;IACb,CAAC;IACD,OAAO,kCAAkC,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;AAC7D,CAAC;AAED,SAAS,kCAAkC,CAC1C,cAAiC,EACjC,OAAqB;IAErB,MAAM,aAAa,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAChE,IAAI,aAAa,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;QAC/B,OAAO,aAAa,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC/B,CAAC;IACD,OAAO,EAAE,CAAC,cAAc,CAAC,EAAE,aAAa,EAAE,CAAC;AAC5C,CAAC;AAED,SAAS,eAAe,CAAC,KAAc;IACtC,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAC1B,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAkB,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC;QAClE,CAAC,CAAC,EAAE,CAAC;AACP,CAAC;AAED,SAAS,aAAa,CAAC,MAAgB;IACtC,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;AACpC,CAAC;AAED,SAAS,eAAe,CAAC,MAAiB;IACzC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,MAAM,GAAc,EAAE,CAAC;IAC7B,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC5B,MAAM,GAAG,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;QACjC,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YACnB,SAAS;QACV,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACd,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACpB,CAAC;IACD,OAAO,MAAM,CAAC;AACf,CAAC;AAED,SAAS,aAAa,CAAC,KAAc;IACpC,IAAI,CAAC;QACJ,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAC9B,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;IACtB,CAAC;AACF,CAAC;AAED,SAAS,cAAc,CAAC,MAAe;IACtC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,OAAO,IAAI,MAAM,CAAC,EAAE,CAAC;QAC/C,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;IACzB,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC;AAC7C,CAAC;AAED,SAAS,cAAc,CAAC,MAAe;IACtC,OAAO,QAAQ,CAAC,MAAM,CAAC,IAAI,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ;QACzD,CAAC,CAAC,MAAM,CAAC,IAAI;QACb,CAAC,CAAC,SAAS,CAAC;AACd,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC/B,OAAO,OAAO,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;AAC7E,CAAC","sourcesContent":["import type { Tool } from \"../agent/types.js\";\n\ntype JsonObject = Record<string, unknown>;\ntype AdditionalPropertiesConstraint = boolean | JsonObject;\n\ntype CodexCompatibleTool = Pick<\n\tTool,\n\t\"name\" | \"description\" | \"parameters\" | \"deferApiDefinition\"\n> & {\n\texecutionLocation?: \"server\" | \"client\";\n};\n\nexport type CodexDynamicToolSpec = {\n\tnamespace?: string;\n\tname: string;\n\tdescription: string;\n\tinputSchema: JsonObject;\n\tdeferLoading?: boolean;\n};\n\nexport type CodexCompatibilityDiagnostic = {\n\tseverity: \"info\" | \"warning\" | \"error\";\n\tcode: string;\n\tmessage: string;\n\ttoolName?: string;\n\tcodexName?: string;\n};\n\nexport type CodexDynamicToolBinding = {\n\tcodexName: string;\n\toriginalName: string;\n};\n\nexport type CodexDynamicToolCompilation = {\n\tspecs: CodexDynamicToolSpec[];\n\tbindings: CodexDynamicToolBinding[];\n\tdiagnostics: CodexCompatibilityDiagnostic[];\n};\n\nexport const CODEX_DYNAMIC_TOOL_CONFORMANCE = {\n\tnameMaxLength: 128,\n\tnamespaceMaxLength: 64,\n\tidentifierPattern: /^[a-zA-Z0-9_-]+$/,\n\treservedNamespaces: [\n\t\t\"api_tool\",\n\t\t\"browser\",\n\t\t\"computer\",\n\t\t\"container\",\n\t\t\"file_search\",\n\t\t\"functions\",\n\t\t\"image_gen\",\n\t\t\"multi_tool_use\",\n\t\t\"python\",\n\t\t\"python_user_visible\",\n\t\t\"submodel_delegator\",\n\t\t\"terminal\",\n\t\t\"tool_search\",\n\t\t\"web\",\n\t],\n\treservedNames: [\"mcp\"],\n\treservedNamePrefixes: [\"mcp__\"],\n\tunsupportedTopLevelSchemaKeywords: [\"anyOf\", \"oneOf\", \"allOf\", \"enum\", \"not\"],\n\tdynamicToolCallMethod: \"item/tool/call\",\n} as const;\n\nexport const CODEX_DEFAULT_TOOL_PROFILE = [\n\t\"read\",\n\t\"list\",\n\t\"find\",\n\t\"search\",\n\t\"parallel_ripgrep\",\n\t\"diff\",\n\t\"bash\",\n\t\"background_tasks\",\n\t\"apply_patch\",\n\t\"edit\",\n\t\"write\",\n\t\"todo\",\n\t\"status\",\n\t\"gh_pr\",\n\t\"gh_issue\",\n\t\"gh_repo\",\n] as const;\n\nconst CODEX_DYNAMIC_TOOL_COMPOSITION_SCHEMA_KEYS = [\n\t\"anyOf\",\n\t\"oneOf\",\n\t\"allOf\",\n] as const;\n\nconst UNSUPPORTED_CODEX_DYNAMIC_TOOL_TOP_LEVEL_SCHEMA_KEYS = new Set<string>(\n\tCODEX_DYNAMIC_TOOL_CONFORMANCE.unsupportedTopLevelSchemaKeywords,\n);\n\nexport function isCodexAppServerApi(api: unknown): boolean {\n\treturn api === \"openai-codex-app-server\";\n}\n\nexport function selectCodexDefaultTools<TTool extends { name: string }>(\n\ttools: readonly TTool[],\n): TTool[] {\n\tconst byName = new Map(tools.map((tool) => [tool.name, tool]));\n\treturn CODEX_DEFAULT_TOOL_PROFILE.map((name) => byName.get(name)).filter(\n\t\t(tool): tool is TTool => Boolean(tool),\n\t);\n}\n\nexport function compileCodexDynamicToolSpecs(\n\ttools: readonly CodexCompatibleTool[],\n): CodexDynamicToolCompilation {\n\tconst specs: CodexDynamicToolSpec[] = [];\n\tconst bindings: CodexDynamicToolBinding[] = [];\n\tconst diagnostics: CodexCompatibilityDiagnostic[] = [];\n\tconst seenOriginalNames = new Set<string>();\n\tconst seenCodexNames = new Set<string>();\n\n\tfor (const tool of tools) {\n\t\tif (tool.deferApiDefinition || tool.executionLocation === \"client\") {\n\t\t\tcontinue;\n\t\t}\n\t\tif (seenOriginalNames.has(tool.name)) {\n\t\t\tcontinue;\n\t\t}\n\t\tseenOriginalNames.add(tool.name);\n\n\t\tconst codexName = toUniqueCodexDynamicToolName(tool.name, seenCodexNames);\n\t\tif (codexName !== tool.name) {\n\t\t\tdiagnostics.push({\n\t\t\t\tseverity: \"warning\",\n\t\t\t\tcode: \"renamed_tool\",\n\t\t\t\tmessage: `Tool \"${tool.name}\" is exposed to Codex as \"${codexName}\" to match app-server dynamic tool identifier rules.`,\n\t\t\t\ttoolName: tool.name,\n\t\t\t\tcodexName,\n\t\t\t});\n\t\t}\n\n\t\tseenCodexNames.add(codexName);\n\t\tspecs.push({\n\t\t\tname: codexName,\n\t\t\tdescription: tool.description,\n\t\t\tinputSchema: normalizeCodexDynamicToolInputSchema(tool.parameters),\n\t\t});\n\t\tbindings.push({ codexName, originalName: tool.name });\n\t}\n\n\treturn { specs, bindings, diagnostics };\n}\n\nexport function createCodexDynamicToolNameMap(\n\tbindings: readonly CodexDynamicToolBinding[],\n): Map<string, string> {\n\treturn new Map(\n\t\tbindings.map((binding) => [binding.codexName, binding.originalName]),\n\t);\n}\n\nexport function normalizeCodexDynamicToolInputSchema(\n\tschema: unknown,\n): JsonObject {\n\tif (!isRecord(schema)) {\n\t\treturn emptyCodexDynamicToolInputSchema();\n\t}\n\n\tconst flattened = flattenTopLevelCompositionSchema(schema);\n\tif (flattened) {\n\t\treturn flattened;\n\t}\n\n\tconst normalized: JsonObject = {};\n\tfor (const [key, value] of Object.entries(schema)) {\n\t\tif (UNSUPPORTED_CODEX_DYNAMIC_TOOL_TOP_LEVEL_SCHEMA_KEYS.has(key)) {\n\t\t\tcontinue;\n\t\t}\n\t\tnormalized[key] = value;\n\t}\n\tnormalized.type = \"object\";\n\tif (!isRecord(normalized.properties)) {\n\t\tnormalized.properties = {};\n\t}\n\tif (!(\"additionalProperties\" in normalized)) {\n\t\tnormalized.additionalProperties = false;\n\t}\n\treturn normalized;\n}\n\nfunction toUniqueCodexDynamicToolName(\n\ttoolName: string,\n\tseenCodexNames: ReadonlySet<string>,\n): string {\n\tconst baseName = toCodexDynamicToolName(toolName);\n\tif (!seenCodexNames.has(baseName)) {\n\t\treturn baseName;\n\t}\n\tfor (let index = 2; ; index += 1) {\n\t\tconst suffix = `_${index}`;\n\t\tconst candidate = `${truncateIdentifier(\n\t\t\tbaseName,\n\t\t\tCODEX_DYNAMIC_TOOL_CONFORMANCE.nameMaxLength - suffix.length,\n\t\t)}${suffix}`;\n\t\tif (!seenCodexNames.has(candidate)) {\n\t\t\treturn candidate;\n\t\t}\n\t}\n}\n\nfunction toCodexDynamicToolName(toolName: string): string {\n\tconst trimmed = toolName.trim();\n\tlet codexName = trimmed.replace(/[^a-zA-Z0-9_-]/g, \"_\");\n\tif (codexName.length === 0) {\n\t\tcodexName = \"maestro_tool\";\n\t}\n\tif (isReservedCodexDynamicToolIdentifier(codexName)) {\n\t\tcodexName = `maestro_${codexName}`;\n\t}\n\treturn truncateIdentifier(\n\t\tcodexName,\n\t\tCODEX_DYNAMIC_TOOL_CONFORMANCE.nameMaxLength,\n\t);\n}\n\nfunction isReservedCodexDynamicToolIdentifier(value: string): boolean {\n\treturn (\n\t\tCODEX_DYNAMIC_TOOL_CONFORMANCE.reservedNames.some(\n\t\t\t(reservedName) => value === reservedName,\n\t\t) ||\n\t\tCODEX_DYNAMIC_TOOL_CONFORMANCE.reservedNamePrefixes.some((prefix) =>\n\t\t\tvalue.startsWith(prefix),\n\t\t)\n\t);\n}\n\nfunction truncateIdentifier(value: string, maxLength: number): string {\n\tif (value.length <= maxLength) {\n\t\treturn value;\n\t}\n\treturn value.slice(0, Math.max(1, maxLength));\n}\n\nfunction emptyCodexDynamicToolInputSchema(): JsonObject {\n\treturn {\n\t\ttype: \"object\",\n\t\tproperties: {},\n\t\tadditionalProperties: false,\n\t};\n}\n\nfunction flattenTopLevelCompositionSchema(\n\tschema: JsonObject,\n): JsonObject | null {\n\tfor (const key of CODEX_DYNAMIC_TOOL_COMPOSITION_SCHEMA_KEYS) {\n\t\tconst branches = schema[key];\n\t\tif (!Array.isArray(branches)) {\n\t\t\tcontinue;\n\t\t}\n\t\tif (branches.length === 0 || !branches.every(isRecord)) {\n\t\t\treturn emptyCodexDynamicToolInputSchema();\n\t\t}\n\t\treturn flattenObjectSchemaBranches(schema, key, branches);\n\t}\n\treturn null;\n}\n\nfunction flattenObjectSchemaBranches(\n\tschema: JsonObject,\n\tcompositionKey: (typeof CODEX_DYNAMIC_TOOL_COMPOSITION_SCHEMA_KEYS)[number],\n\tbranches: JsonObject[],\n): JsonObject {\n\tconst propertySchemas = new Map<string, unknown[]>();\n\tconst topLevelProperties = schema.properties;\n\tif (isRecord(topLevelProperties)) {\n\t\tfor (const [name, propertySchema] of Object.entries(topLevelProperties)) {\n\t\t\taddPropertySchema(propertySchemas, name, propertySchema);\n\t\t}\n\t}\n\n\tconst branchRequiredSets: Array<Set<string>> = [];\n\tfor (const branch of branches) {\n\t\tconst branchProperties = branch.properties;\n\t\tif (isRecord(branchProperties)) {\n\t\t\tfor (const [name, propertySchema] of Object.entries(branchProperties)) {\n\t\t\t\taddPropertySchema(propertySchemas, name, propertySchema);\n\t\t\t}\n\t\t}\n\t\tbranchRequiredSets.push(new Set(readStringArray(branch.required)));\n\t}\n\n\tconst properties: JsonObject = {};\n\tfor (const [name, schemas] of propertySchemas.entries()) {\n\t\tproperties[name] = mergePropertySchemas(schemas);\n\t}\n\n\tconst required = computeFlattenedRequired(\n\t\tschema,\n\t\tcompositionKey,\n\t\tbranchRequiredSets,\n\t).filter((name) => name in properties);\n\tconst flattened: JsonObject = {\n\t\ttype: \"object\",\n\t\tproperties,\n\t\tadditionalProperties: computeFlattenedAdditionalProperties(\n\t\t\tschema,\n\t\t\tcompositionKey,\n\t\t\tbranches,\n\t\t),\n\t};\n\tif (typeof schema.description === \"string\") {\n\t\tflattened.description = schema.description;\n\t}\n\tif (required.length > 0) {\n\t\tflattened.required = required;\n\t}\n\treturn flattened;\n}\n\nfunction addPropertySchema(\n\tpropertySchemas: Map<string, unknown[]>,\n\tname: string,\n\tpropertySchema: unknown,\n): void {\n\tconst schemas = propertySchemas.get(name);\n\tif (schemas) {\n\t\tschemas.push(propertySchema);\n\t\treturn;\n\t}\n\tpropertySchemas.set(name, [propertySchema]);\n}\n\nfunction computeFlattenedRequired(\n\tschema: JsonObject,\n\tcompositionKey: (typeof CODEX_DYNAMIC_TOOL_COMPOSITION_SCHEMA_KEYS)[number],\n\tbranchRequiredSets: Array<Set<string>>,\n): string[] {\n\tconst topLevelRequired = readStringArray(schema.required);\n\tif (branchRequiredSets.length === 0) {\n\t\treturn topLevelRequired;\n\t}\n\tif (compositionKey === \"allOf\") {\n\t\treturn uniqueStrings([\n\t\t\t...topLevelRequired,\n\t\t\t...branchRequiredSets.flatMap((set) => [...set]),\n\t\t]);\n\t}\n\tconst firstBranchRequired = branchRequiredSets[0] ?? new Set<string>();\n\tconst requiredByEveryBranch = [...firstBranchRequired].filter((name) =>\n\t\tbranchRequiredSets.every((set) => set.has(name)),\n\t);\n\treturn uniqueStrings([...topLevelRequired, ...requiredByEveryBranch]);\n}\n\nfunction mergePropertySchemas(schemas: unknown[]): unknown {\n\tconst uniqueSchemas = uniqueJsonItems(schemas);\n\tif (uniqueSchemas.length <= 1) {\n\t\treturn uniqueSchemas[0] ?? {};\n\t}\n\n\tconst constValues = uniqueSchemas.map(readConstValue);\n\tif (constValues.every((entry) => entry.found)) {\n\t\tconst schemaTypes = uniqueSchemas.map(readSchemaType);\n\t\tconst commonType = schemaTypes.every((type) => type === schemaTypes[0])\n\t\t\t? schemaTypes[0]\n\t\t\t: undefined;\n\t\treturn {\n\t\t\t...(commonType ? { type: commonType } : {}),\n\t\t\tenum: uniqueJsonItems(constValues.map((entry) => entry.value)),\n\t\t};\n\t}\n\n\treturn { anyOf: uniqueSchemas };\n}\n\nfunction computeFlattenedAdditionalProperties(\n\tschema: JsonObject,\n\tcompositionKey: (typeof CODEX_DYNAMIC_TOOL_COMPOSITION_SCHEMA_KEYS)[number],\n\tbranches: JsonObject[],\n): AdditionalPropertiesConstraint {\n\tconst topLevelConstraint = readAdditionalPropertiesConstraint(\n\t\tschema.additionalProperties,\n\t);\n\tif (topLevelConstraint === false) {\n\t\treturn false;\n\t}\n\tconst branchConstraint =\n\t\tcompositionKey === \"allOf\"\n\t\t\t? intersectAdditionalPropertiesConstraints(\n\t\t\t\t\tbranches.map((branch) =>\n\t\t\t\t\t\treadAdditionalPropertiesConstraint(branch.additionalProperties),\n\t\t\t\t\t),\n\t\t\t\t)\n\t\t\t: unionAdditionalPropertiesConstraints(\n\t\t\t\t\tbranches.map((branch) =>\n\t\t\t\t\t\treadAdditionalPropertiesConstraint(branch.additionalProperties),\n\t\t\t\t\t),\n\t\t\t\t);\n\treturn intersectAdditionalPropertiesConstraints([\n\t\ttopLevelConstraint,\n\t\tbranchConstraint,\n\t]);\n}\n\nfunction readAdditionalPropertiesConstraint(\n\tvalue: unknown,\n): AdditionalPropertiesConstraint {\n\tif (value === false) {\n\t\treturn false;\n\t}\n\tif (isRecord(value)) {\n\t\treturn value;\n\t}\n\treturn true;\n}\n\nfunction unionAdditionalPropertiesConstraints(\n\tconstraints: AdditionalPropertiesConstraint[],\n): AdditionalPropertiesConstraint {\n\tif (constraints.some((constraint) => constraint === false)) {\n\t\treturn false;\n\t}\n\tif (constraints.some((constraint) => constraint === true)) {\n\t\treturn true;\n\t}\n\tconst schemas = constraints.filter(isRecord);\n\tif (schemas.length === 0) {\n\t\treturn false;\n\t}\n\treturn combineAdditionalPropertiesSchemas(\"anyOf\", schemas);\n}\n\nfunction intersectAdditionalPropertiesConstraints(\n\tconstraints: AdditionalPropertiesConstraint[],\n): AdditionalPropertiesConstraint {\n\tif (constraints.some((constraint) => constraint === false)) {\n\t\treturn false;\n\t}\n\tconst schemas = constraints.filter(isRecord);\n\tif (schemas.length === 0) {\n\t\treturn true;\n\t}\n\treturn combineAdditionalPropertiesSchemas(\"allOf\", schemas);\n}\n\nfunction combineAdditionalPropertiesSchemas(\n\tcompositionKey: \"allOf\" | \"anyOf\",\n\tschemas: JsonObject[],\n): JsonObject {\n\tconst uniqueSchemas = uniqueJsonItems(schemas).filter(isRecord);\n\tif (uniqueSchemas.length <= 1) {\n\t\treturn uniqueSchemas[0] ?? {};\n\t}\n\treturn { [compositionKey]: uniqueSchemas };\n}\n\nfunction readStringArray(value: unknown): string[] {\n\treturn Array.isArray(value)\n\t\t? value.filter((item): item is string => typeof item === \"string\")\n\t\t: [];\n}\n\nfunction uniqueStrings(values: string[]): string[] {\n\treturn Array.from(new Set(values));\n}\n\nfunction uniqueJsonItems(values: unknown[]): unknown[] {\n\tconst seen = new Set<string>();\n\tconst unique: unknown[] = [];\n\tfor (const value of values) {\n\t\tconst key = schemaJsonKey(value);\n\t\tif (seen.has(key)) {\n\t\t\tcontinue;\n\t\t}\n\t\tseen.add(key);\n\t\tunique.push(value);\n\t}\n\treturn unique;\n}\n\nfunction schemaJsonKey(value: unknown): string {\n\ttry {\n\t\treturn JSON.stringify(value);\n\t} catch {\n\t\treturn String(value);\n\t}\n}\n\nfunction readConstValue(schema: unknown): { found: boolean; value?: unknown } {\n\tif (!isRecord(schema) || !(\"const\" in schema)) {\n\t\treturn { found: false };\n\t}\n\treturn { found: true, value: schema.const };\n}\n\nfunction readSchemaType(schema: unknown): string | undefined {\n\treturn isRecord(schema) && typeof schema.type === \"string\"\n\t\t? schema.type\n\t\t: undefined;\n}\n\nfunction isRecord(value: unknown): value is JsonObject {\n\treturn Boolean(value && typeof value === \"object\" && !Array.isArray(value));\n}\n"]}
+{"version":3,"file":"compatibility.js","sourceRoot":"","sources":["../../src/codex/compatibility.ts"],"names":[],"mappings":"AAuCA,MAAM,CAAC,MAAM,8BAA8B,GAAG;IAC7C,aAAa,EAAE,GAAG;IAClB,kBAAkB,EAAE,EAAE;IACtB,iBAAiB,EAAE,kBAAkB;IACrC,kBAAkB,EAAE;QACnB,UAAU;QACV,SAAS;QACT,UAAU;QACV,WAAW;QACX,aAAa;QACb,WAAW;QACX,WAAW;QACX,gBAAgB;QAChB,QAAQ;QACR,qBAAqB;QACrB,oBAAoB;QACpB,UAAU;QACV,aAAa;QACb,KAAK;KACL;IACD,aAAa,EAAE,CAAC,KAAK,CAAC;IACtB,oBAAoB,EAAE,CAAC,OAAO,CAAC;IAC/B,iCAAiC,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC;IAC7E,qBAAqB,EAAE,gBAAgB;CAC9B,CAAC;AAEX,MAAM,CAAC,MAAM,gCAAgC,GAAG;IAC/C,aAAa;IACb,MAAM;IACN,OAAO;CACE,CAAC;AAEX,MAAM,CAAC,MAAM,4BAA4B,GAAG;IAC3C,MAAM;IACN,MAAM;IACN,MAAM;IACN,QAAQ;IACR,MAAM;IACN,QAAQ;CACC,CAAC;AAEX,MAAM,CAAC,MAAM,0BAA0B,GAAG;IACzC,MAAM;IACN,MAAM;IACN,MAAM;IACN,QAAQ;IACR,MAAM;IACN,MAAM;IACN,aAAa;IACb,MAAM;IACN,OAAO;IACP,MAAM;IACN,QAAQ;IACR,OAAO;CACE,CAAC;AAEX,MAAM,CAAC,MAAM,2BAA2B,GAAG;IAC1C,MAAM;IACN,MAAM;IACN,MAAM;IACN,QAAQ;IACR,kBAAkB;IAClB,MAAM;IACN,MAAM;IACN,kBAAkB;IAClB,aAAa;IACb,MAAM;IACN,OAAO;IACP,MAAM;IACN,QAAQ;IACR,OAAO;IACP,UAAU;IACV,SAAS;CACA,CAAC;AAEX,MAAM,CAAC,MAAM,mBAAmB,GAAG;IAClC,IAAI,EAAE,0BAA0B;IAChC,OAAO,EAAE,0BAA0B;IACnC,WAAW,EAAE,4BAA4B;IACzC,QAAQ,EAAE,4BAA4B;IACtC,QAAQ,EAAE,2BAA2B;CAC5B,CAAC;AAIX,MAAM,0CAA0C,GAAG;IAClD,OAAO;IACP,OAAO;IACP,OAAO;CACE,CAAC;AAEX,MAAM,oDAAoD,GAAG,IAAI,GAAG,CACnE,8BAA8B,CAAC,iCAAiC,CAChE,CAAC;AAEF,MAAM,UAAU,mBAAmB,CAAC,GAAY;IAC/C,OAAO,GAAG,KAAK,yBAAyB,CAAC;AAC1C,CAAC;AAED,MAAM,UAAU,uBAAuB,CACtC,KAAuB;IAEvB,OAAO,sBAAsB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;AAC9C,CAAC;AAED,MAAM,UAAU,sBAAsB,CACrC,KAAuB,EACvB,WAAiC;IAEjC,MAAM,OAAO,GAAG,mBAAmB,CAAC,WAAW,CAAC,CAAC;IACjD,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;IAC/D,OAAO,OAAO;SACZ,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;SAC/B,MAAM,CAAC,CAAC,IAAI,EAAiB,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;AAClD,CAAC;AAED,MAAM,UAAU,2BAA2B,CAC1C,KAAyB;IAEzB,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzC,OAAO,MAAM,CAAC;IACf,CAAC;IACD,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACjE,IAAI,sBAAsB,CAAC,UAAU,CAAC,EAAE,CAAC;QACxC,OAAO,UAAU,CAAC;IACnB,CAAC;IACD,MAAM,IAAI,KAAK,CACd,+BAA+B,KAAK,0BAA0B,wBAAwB,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACrG,CAAC;AACH,CAAC;AAED,MAAM,UAAU,wBAAwB;IACvC,OAAO,MAAM,CAAC,IAAI,CAAC,mBAAmB,CAA2B,CAAC;AACnE,CAAC;AAED,SAAS,sBAAsB,CAAC,KAAa;IAC5C,OAAO,MAAM,CAAC,MAAM,CAAC,mBAAmB,EAAE,KAAK,CAAC,CAAC;AAClD,CAAC;AAED,MAAM,UAAU,4BAA4B,CAC3C,KAAqC;IAErC,MAAM,KAAK,GAA2B,EAAE,CAAC;IACzC,MAAM,QAAQ,GAA8B,EAAE,CAAC;IAC/C,MAAM,WAAW,GAAmC,EAAE,CAAC;IACvD,MAAM,iBAAiB,GAAG,IAAI,GAAG,EAAU,CAAC;IAC5C,MAAM,cAAc,GAAG,IAAI,GAAG,EAAU,CAAC;IAEzC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QAC1B,IAAI,IAAI,CAAC,kBAAkB,IAAI,IAAI,CAAC,iBAAiB,KAAK,QAAQ,EAAE,CAAC;YACpE,SAAS;QACV,CAAC;QACD,IAAI,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACtC,SAAS;QACV,CAAC;QACD,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAEjC,MAAM,SAAS,GAAG,4BAA4B,CAAC,IAAI,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;QAC1E,IAAI,SAAS,KAAK,IAAI,CAAC,IAAI,EAAE,CAAC;YAC7B,WAAW,CAAC,IAAI,CAAC;gBAChB,QAAQ,EAAE,SAAS;gBACnB,IAAI,EAAE,cAAc;gBACpB,OAAO,EAAE,SAAS,IAAI,CAAC,IAAI,6BAA6B,SAAS,sDAAsD;gBACvH,QAAQ,EAAE,IAAI,CAAC,IAAI;gBACnB,SAAS;aACT,CAAC,CAAC;QACJ,CAAC;QAED,cAAc,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC9B,KAAK,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,SAAS;YACf,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,WAAW,EAAE,oCAAoC,CAAC,IAAI,CAAC,UAAU,CAAC;SAClE,CAAC,CAAC;QACH,QAAQ,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,YAAY,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;IACvD,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAC;AACzC,CAAC;AAED,MAAM,UAAU,6BAA6B,CAC5C,QAA4C;IAE5C,OAAO,IAAI,GAAG,CACb,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC,CACpE,CAAC;AACH,CAAC;AAED,MAAM,UAAU,oCAAoC,CACnD,MAAe;IAEf,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QACvB,OAAO,gCAAgC,EAAE,CAAC;IAC3C,CAAC;IAED,MAAM,SAAS,GAAG,gCAAgC,CAAC,MAAM,CAAC,CAAC;IAC3D,IAAI,SAAS,EAAE,CAAC;QACf,OAAO,SAAS,CAAC;IAClB,CAAC;IAED,MAAM,UAAU,GAAe,EAAE,CAAC;IAClC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QACnD,IAAI,oDAAoD,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YACnE,SAAS;QACV,CAAC;QACD,UAAU,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IACzB,CAAC;IACD,UAAU,CAAC,IAAI,GAAG,QAAQ,CAAC;IAC3B,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QACtC,UAAU,CAAC,UAAU,GAAG,EAAE,CAAC;IAC5B,CAAC;IACD,IAAI,CAAC,CAAC,sBAAsB,IAAI,UAAU,CAAC,EAAE,CAAC;QAC7C,UAAU,CAAC,oBAAoB,GAAG,KAAK,CAAC;IACzC,CAAC;IACD,OAAO,UAAU,CAAC;AACnB,CAAC;AAED,SAAS,4BAA4B,CACpC,QAAgB,EAChB,cAAmC;IAEnC,MAAM,QAAQ,GAAG,sBAAsB,CAAC,QAAQ,CAAC,CAAC;IAClD,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;QACnC,OAAO,QAAQ,CAAC;IACjB,CAAC;IACD,KAAK,IAAI,KAAK,GAAG,CAAC,GAAI,KAAK,IAAI,CAAC,EAAE,CAAC;QAClC,MAAM,MAAM,GAAG,IAAI,KAAK,EAAE,CAAC;QAC3B,MAAM,SAAS,GAAG,GAAG,kBAAkB,CACtC,QAAQ,EACR,8BAA8B,CAAC,aAAa,GAAG,MAAM,CAAC,MAAM,CAC5D,GAAG,MAAM,EAAE,CAAC;QACb,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;YACpC,OAAO,SAAS,CAAC;QAClB,CAAC;IACF,CAAC;AACF,CAAC;AAED,SAAS,sBAAsB,CAAC,QAAgB;IAC/C,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC;IAChC,IAAI,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,iBAAiB,EAAE,GAAG,CAAC,CAAC;IACxD,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5B,SAAS,GAAG,cAAc,CAAC;IAC5B,CAAC;IACD,IAAI,oCAAoC,CAAC,SAAS,CAAC,EAAE,CAAC;QACrD,SAAS,GAAG,WAAW,SAAS,EAAE,CAAC;IACpC,CAAC;IACD,OAAO,kBAAkB,CACxB,SAAS,EACT,8BAA8B,CAAC,aAAa,CAC5C,CAAC;AACH,CAAC;AAED,SAAS,oCAAoC,CAAC,KAAa;IAC1D,OAAO,CACN,8BAA8B,CAAC,aAAa,CAAC,IAAI,CAChD,CAAC,YAAY,EAAE,EAAE,CAAC,KAAK,KAAK,YAAY,CACxC;QACD,8BAA8B,CAAC,oBAAoB,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CACnE,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CACxB,CACD,CAAC;AACH,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAa,EAAE,SAAiB;IAC3D,IAAI,KAAK,CAAC,MAAM,IAAI,SAAS,EAAE,CAAC;QAC/B,OAAO,KAAK,CAAC;IACd,CAAC;IACD,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,CAAC;AAC/C,CAAC;AAED,SAAS,gCAAgC;IACxC,OAAO;QACN,IAAI,EAAE,QAAQ;QACd,UAAU,EAAE,EAAE;QACd,oBAAoB,EAAE,KAAK;KAC3B,CAAC;AACH,CAAC;AAED,SAAS,gCAAgC,CACxC,MAAkB;IAElB,KAAK,MAAM,GAAG,IAAI,0CAA0C,EAAE,CAAC;QAC9D,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;QAC7B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC9B,SAAS;QACV,CAAC;QACD,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;YACxD,OAAO,gCAAgC,EAAE,CAAC;QAC3C,CAAC;QACD,OAAO,2BAA2B,CAAC,MAAM,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAC;IAC3D,CAAC;IACD,OAAO,IAAI,CAAC;AACb,CAAC;AAED,SAAS,2BAA2B,CACnC,MAAkB,EAClB,cAA2E,EAC3E,QAAsB;IAEtB,MAAM,eAAe,GAAG,IAAI,GAAG,EAAqB,CAAC;IACrD,MAAM,kBAAkB,GAAG,MAAM,CAAC,UAAU,CAAC;IAC7C,IAAI,QAAQ,CAAC,kBAAkB,CAAC,EAAE,CAAC;QAClC,KAAK,MAAM,CAAC,IAAI,EAAE,cAAc,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,kBAAkB,CAAC,EAAE,CAAC;YACzE,iBAAiB,CAAC,eAAe,EAAE,IAAI,EAAE,cAAc,CAAC,CAAC;QAC1D,CAAC;IACF,CAAC;IAED,MAAM,kBAAkB,GAAuB,EAAE,CAAC;IAClD,KAAK,MAAM,MAAM,IAAI,QAAQ,EAAE,CAAC;QAC/B,MAAM,gBAAgB,GAAG,MAAM,CAAC,UAAU,CAAC;QAC3C,IAAI,QAAQ,CAAC,gBAAgB,CAAC,EAAE,CAAC;YAChC,KAAK,MAAM,CAAC,IAAI,EAAE,cAAc,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,gBAAgB,CAAC,EAAE,CAAC;gBACvE,iBAAiB,CAAC,eAAe,EAAE,IAAI,EAAE,cAAc,CAAC,CAAC;YAC1D,CAAC;QACF,CAAC;QACD,kBAAkB,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,eAAe,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;IACpE,CAAC;IAED,MAAM,UAAU,GAAe,EAAE,CAAC;IAClC,KAAK,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,eAAe,CAAC,OAAO,EAAE,EAAE,CAAC;QACzD,UAAU,CAAC,IAAI,CAAC,GAAG,oBAAoB,CAAC,OAAO,CAAC,CAAC;IAClD,CAAC;IAED,MAAM,QAAQ,GAAG,wBAAwB,CACxC,MAAM,EACN,cAAc,EACd,kBAAkB,CAClB,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,IAAI,UAAU,CAAC,CAAC;IACvC,MAAM,SAAS,GAAe;QAC7B,IAAI,EAAE,QAAQ;QACd,UAAU;QACV,oBAAoB,EAAE,oCAAoC,CACzD,MAAM,EACN,cAAc,EACd,QAAQ,CACR;KACD,CAAC;IACF,IAAI,OAAO,MAAM,CAAC,WAAW,KAAK,QAAQ,EAAE,CAAC;QAC5C,SAAS,CAAC,WAAW,GAAG,MAAM,CAAC,WAAW,CAAC;IAC5C,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACzB,SAAS,CAAC,QAAQ,GAAG,QAAQ,CAAC;IAC/B,CAAC;IACD,OAAO,SAAS,CAAC;AAClB,CAAC;AAED,SAAS,iBAAiB,CACzB,eAAuC,EACvC,IAAY,EACZ,cAAuB;IAEvB,MAAM,OAAO,GAAG,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC1C,IAAI,OAAO,EAAE,CAAC;QACb,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QAC7B,OAAO;IACR,CAAC;IACD,eAAe,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,cAAc,CAAC,CAAC,CAAC;AAC7C,CAAC;AAED,SAAS,wBAAwB,CAChC,MAAkB,EAClB,cAA2E,EAC3E,kBAAsC;IAEtC,MAAM,gBAAgB,GAAG,eAAe,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC1D,IAAI,kBAAkB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACrC,OAAO,gBAAgB,CAAC;IACzB,CAAC;IACD,IAAI,cAAc,KAAK,OAAO,EAAE,CAAC;QAChC,OAAO,aAAa,CAAC;YACpB,GAAG,gBAAgB;YACnB,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC;SAChD,CAAC,CAAC;IACJ,CAAC;IACD,MAAM,mBAAmB,GAAG,kBAAkB,CAAC,CAAC,CAAC,IAAI,IAAI,GAAG,EAAU,CAAC;IACvE,MAAM,qBAAqB,GAAG,CAAC,GAAG,mBAAmB,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CACtE,kBAAkB,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAChD,CAAC;IACF,OAAO,aAAa,CAAC,CAAC,GAAG,gBAAgB,EAAE,GAAG,qBAAqB,CAAC,CAAC,CAAC;AACvE,CAAC;AAED,SAAS,oBAAoB,CAAC,OAAkB;IAC/C,MAAM,aAAa,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;IAC/C,IAAI,aAAa,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;QAC/B,OAAO,aAAa,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC/B,CAAC;IAED,MAAM,WAAW,GAAG,aAAa,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;IACtD,IAAI,WAAW,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;QAC/C,MAAM,WAAW,GAAG,aAAa,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;QACtD,MAAM,UAAU,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,WAAW,CAAC,CAAC,CAAC,CAAC;YACtE,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC;YAChB,CAAC,CAAC,SAAS,CAAC;QACb,OAAO;YACN,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3C,IAAI,EAAE,eAAe,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;SAC9D,CAAC;IACH,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC;AACjC,CAAC;AAED,SAAS,oCAAoC,CAC5C,MAAkB,EAClB,cAA2E,EAC3E,QAAsB;IAEtB,MAAM,kBAAkB,GAAG,kCAAkC,CAC5D,MAAM,CAAC,oBAAoB,CAC3B,CAAC;IACF,IAAI,kBAAkB,KAAK,KAAK,EAAE,CAAC;QAClC,OAAO,KAAK,CAAC;IACd,CAAC;IACD,MAAM,gBAAgB,GACrB,cAAc,KAAK,OAAO;QACzB,CAAC,CAAC,wCAAwC,CACxC,QAAQ,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CACvB,kCAAkC,CAAC,MAAM,CAAC,oBAAoB,CAAC,CAC/D,CACD;QACF,CAAC,CAAC,oCAAoC,CACpC,QAAQ,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CACvB,kCAAkC,CAAC,MAAM,CAAC,oBAAoB,CAAC,CAC/D,CACD,CAAC;IACL,OAAO,wCAAwC,CAAC;QAC/C,kBAAkB;QAClB,gBAAgB;KAChB,CAAC,CAAC;AACJ,CAAC;AAED,SAAS,kCAAkC,CAC1C,KAAc;IAEd,IAAI,KAAK,KAAK,KAAK,EAAE,CAAC;QACrB,OAAO,KAAK,CAAC;IACd,CAAC;IACD,IAAI,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACrB,OAAO,KAAK,CAAC;IACd,CAAC;IACD,OAAO,IAAI,CAAC;AACb,CAAC;AAED,SAAS,oCAAoC,CAC5C,WAA6C;IAE7C,IAAI,WAAW,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,KAAK,KAAK,CAAC,EAAE,CAAC;QAC5D,OAAO,KAAK,CAAC;IACd,CAAC;IACD,IAAI,WAAW,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,KAAK,IAAI,CAAC,EAAE,CAAC;QAC3D,OAAO,IAAI,CAAC;IACb,CAAC;IACD,MAAM,OAAO,GAAG,WAAW,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC7C,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,KAAK,CAAC;IACd,CAAC;IACD,OAAO,kCAAkC,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;AAC7D,CAAC;AAED,SAAS,wCAAwC,CAChD,WAA6C;IAE7C,IAAI,WAAW,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,KAAK,KAAK,CAAC,EAAE,CAAC;QAC5D,OAAO,KAAK,CAAC;IACd,CAAC;IACD,MAAM,OAAO,GAAG,WAAW,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC7C,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,IAAI,CAAC;IACb,CAAC;IACD,OAAO,kCAAkC,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;AAC7D,CAAC;AAED,SAAS,kCAAkC,CAC1C,cAAiC,EACjC,OAAqB;IAErB,MAAM,aAAa,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAChE,IAAI,aAAa,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;QAC/B,OAAO,aAAa,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC/B,CAAC;IACD,OAAO,EAAE,CAAC,cAAc,CAAC,EAAE,aAAa,EAAE,CAAC;AAC5C,CAAC;AAED,SAAS,eAAe,CAAC,KAAc;IACtC,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAC1B,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAkB,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC;QAClE,CAAC,CAAC,EAAE,CAAC;AACP,CAAC;AAED,SAAS,aAAa,CAAC,MAAgB;IACtC,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;AACpC,CAAC;AAED,SAAS,eAAe,CAAC,MAAiB;IACzC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,MAAM,GAAc,EAAE,CAAC;IAC7B,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC5B,MAAM,GAAG,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;QACjC,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YACnB,SAAS;QACV,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACd,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACpB,CAAC;IACD,OAAO,MAAM,CAAC;AACf,CAAC;AAED,SAAS,aAAa,CAAC,KAAc;IACpC,IAAI,CAAC;QACJ,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAC9B,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;IACtB,CAAC;AACF,CAAC;AAED,SAAS,cAAc,CAAC,MAAe;IACtC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,OAAO,IAAI,MAAM,CAAC,EAAE,CAAC;QAC/C,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;IACzB,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC;AAC7C,CAAC;AAED,SAAS,cAAc,CAAC,MAAe;IACtC,OAAO,QAAQ,CAAC,MAAM,CAAC,IAAI,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ;QACzD,CAAC,CAAC,MAAM,CAAC,IAAI;QACb,CAAC,CAAC,SAAS,CAAC;AACd,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC/B,OAAO,OAAO,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;AAC7E,CAAC","sourcesContent":["import type { Tool } from \"../agent/types.js\";\n\ntype JsonObject = Record<string, unknown>;\ntype AdditionalPropertiesConstraint = boolean | JsonObject;\n\ntype CodexCompatibleTool = Pick<\n\tTool,\n\t\"name\" | \"description\" | \"parameters\" | \"deferApiDefinition\"\n> & {\n\texecutionLocation?: \"server\" | \"client\";\n};\n\nexport type CodexDynamicToolSpec = {\n\tnamespace?: string;\n\tname: string;\n\tdescription: string;\n\tinputSchema: JsonObject;\n\tdeferLoading?: boolean;\n};\n\nexport type CodexCompatibilityDiagnostic = {\n\tseverity: \"info\" | \"warning\" | \"error\";\n\tcode: string;\n\tmessage: string;\n\ttoolName?: string;\n\tcodexName?: string;\n};\n\nexport type CodexDynamicToolBinding = {\n\tcodexName: string;\n\toriginalName: string;\n};\n\nexport type CodexDynamicToolCompilation = {\n\tspecs: CodexDynamicToolSpec[];\n\tbindings: CodexDynamicToolBinding[];\n\tdiagnostics: CodexCompatibilityDiagnostic[];\n};\n\nexport const CODEX_DYNAMIC_TOOL_CONFORMANCE = {\n\tnameMaxLength: 128,\n\tnamespaceMaxLength: 64,\n\tidentifierPattern: /^[a-zA-Z0-9_-]+$/,\n\treservedNamespaces: [\n\t\t\"api_tool\",\n\t\t\"browser\",\n\t\t\"computer\",\n\t\t\"container\",\n\t\t\"file_search\",\n\t\t\"functions\",\n\t\t\"image_gen\",\n\t\t\"multi_tool_use\",\n\t\t\"python\",\n\t\t\"python_user_visible\",\n\t\t\"submodel_delegator\",\n\t\t\"terminal\",\n\t\t\"tool_search\",\n\t\t\"web\",\n\t],\n\treservedNames: [\"mcp\"],\n\treservedNamePrefixes: [\"mcp__\"],\n\tunsupportedTopLevelSchemaKeywords: [\"anyOf\", \"oneOf\", \"allOf\", \"enum\", \"not\"],\n\tdynamicToolCallMethod: \"item/tool/call\",\n} as const;\n\nexport const CODEX_FILE_MUTATION_TOOL_PROFILE = [\n\t\"apply_patch\",\n\t\"edit\",\n\t\"write\",\n] as const;\n\nexport const CODEX_READ_ONLY_TOOL_PROFILE = [\n\t\"read\",\n\t\"list\",\n\t\"find\",\n\t\"search\",\n\t\"diff\",\n\t\"status\",\n] as const;\n\nexport const CODEX_DEFAULT_TOOL_PROFILE = [\n\t\"read\",\n\t\"list\",\n\t\"find\",\n\t\"search\",\n\t\"diff\",\n\t\"bash\",\n\t\"apply_patch\",\n\t\"edit\",\n\t\"write\",\n\t\"todo\",\n\t\"status\",\n\t\"gh_pr\",\n] as const;\n\nexport const CODEX_EXTENDED_TOOL_PROFILE = [\n\t\"read\",\n\t\"list\",\n\t\"find\",\n\t\"search\",\n\t\"parallel_ripgrep\",\n\t\"diff\",\n\t\"bash\",\n\t\"background_tasks\",\n\t\"apply_patch\",\n\t\"edit\",\n\t\"write\",\n\t\"todo\",\n\t\"status\",\n\t\"gh_pr\",\n\t\"gh_issue\",\n\t\"gh_repo\",\n] as const;\n\nexport const CODEX_TOOL_PROFILES = {\n\tlean: CODEX_DEFAULT_TOOL_PROFILE,\n\tdefault: CODEX_DEFAULT_TOOL_PROFILE,\n\t\"read-only\": CODEX_READ_ONLY_TOOL_PROFILE,\n\treadonly: CODEX_READ_ONLY_TOOL_PROFILE,\n\textended: CODEX_EXTENDED_TOOL_PROFILE,\n} as const;\n\nexport type CodexToolProfileName = keyof typeof CODEX_TOOL_PROFILES;\n\nconst CODEX_DYNAMIC_TOOL_COMPOSITION_SCHEMA_KEYS = [\n\t\"anyOf\",\n\t\"oneOf\",\n\t\"allOf\",\n] as const;\n\nconst UNSUPPORTED_CODEX_DYNAMIC_TOOL_TOP_LEVEL_SCHEMA_KEYS = new Set<string>(\n\tCODEX_DYNAMIC_TOOL_CONFORMANCE.unsupportedTopLevelSchemaKeywords,\n);\n\nexport function isCodexAppServerApi(api: unknown): boolean {\n\treturn api === \"openai-codex-app-server\";\n}\n\nexport function selectCodexDefaultTools<TTool extends { name: string }>(\n\ttools: readonly TTool[],\n): TTool[] {\n\treturn selectCodexToolProfile(tools, \"lean\");\n}\n\nexport function selectCodexToolProfile<TTool extends { name: string }>(\n\ttools: readonly TTool[],\n\tprofileName: CodexToolProfileName,\n): TTool[] {\n\tconst profile = CODEX_TOOL_PROFILES[profileName];\n\tconst byName = new Map(tools.map((tool) => [tool.name, tool]));\n\treturn profile\n\t\t.map((name) => byName.get(name))\n\t\t.filter((tool): tool is TTool => Boolean(tool));\n}\n\nexport function resolveCodexToolProfileName(\n\tvalue: string | undefined,\n): CodexToolProfileName {\n\tif (!value || value.trim().length === 0) {\n\t\treturn \"lean\";\n\t}\n\tconst normalized = value.trim().toLowerCase().replace(/_/g, \"-\");\n\tif (isCodexToolProfileName(normalized)) {\n\t\treturn normalized;\n\t}\n\tthrow new Error(\n\t\t`Unknown Codex tool profile \"${value}\". Available profiles: ${getCodexToolProfileNames().join(\", \")}`,\n\t);\n}\n\nexport function getCodexToolProfileNames(): CodexToolProfileName[] {\n\treturn Object.keys(CODEX_TOOL_PROFILES) as CodexToolProfileName[];\n}\n\nfunction isCodexToolProfileName(value: string): value is CodexToolProfileName {\n\treturn Object.hasOwn(CODEX_TOOL_PROFILES, value);\n}\n\nexport function compileCodexDynamicToolSpecs(\n\ttools: readonly CodexCompatibleTool[],\n): CodexDynamicToolCompilation {\n\tconst specs: CodexDynamicToolSpec[] = [];\n\tconst bindings: CodexDynamicToolBinding[] = [];\n\tconst diagnostics: CodexCompatibilityDiagnostic[] = [];\n\tconst seenOriginalNames = new Set<string>();\n\tconst seenCodexNames = new Set<string>();\n\n\tfor (const tool of tools) {\n\t\tif (tool.deferApiDefinition || tool.executionLocation === \"client\") {\n\t\t\tcontinue;\n\t\t}\n\t\tif (seenOriginalNames.has(tool.name)) {\n\t\t\tcontinue;\n\t\t}\n\t\tseenOriginalNames.add(tool.name);\n\n\t\tconst codexName = toUniqueCodexDynamicToolName(tool.name, seenCodexNames);\n\t\tif (codexName !== tool.name) {\n\t\t\tdiagnostics.push({\n\t\t\t\tseverity: \"warning\",\n\t\t\t\tcode: \"renamed_tool\",\n\t\t\t\tmessage: `Tool \"${tool.name}\" is exposed to Codex as \"${codexName}\" to match app-server dynamic tool identifier rules.`,\n\t\t\t\ttoolName: tool.name,\n\t\t\t\tcodexName,\n\t\t\t});\n\t\t}\n\n\t\tseenCodexNames.add(codexName);\n\t\tspecs.push({\n\t\t\tname: codexName,\n\t\t\tdescription: tool.description,\n\t\t\tinputSchema: normalizeCodexDynamicToolInputSchema(tool.parameters),\n\t\t});\n\t\tbindings.push({ codexName, originalName: tool.name });\n\t}\n\n\treturn { specs, bindings, diagnostics };\n}\n\nexport function createCodexDynamicToolNameMap(\n\tbindings: readonly CodexDynamicToolBinding[],\n): Map<string, string> {\n\treturn new Map(\n\t\tbindings.map((binding) => [binding.codexName, binding.originalName]),\n\t);\n}\n\nexport function normalizeCodexDynamicToolInputSchema(\n\tschema: unknown,\n): JsonObject {\n\tif (!isRecord(schema)) {\n\t\treturn emptyCodexDynamicToolInputSchema();\n\t}\n\n\tconst flattened = flattenTopLevelCompositionSchema(schema);\n\tif (flattened) {\n\t\treturn flattened;\n\t}\n\n\tconst normalized: JsonObject = {};\n\tfor (const [key, value] of Object.entries(schema)) {\n\t\tif (UNSUPPORTED_CODEX_DYNAMIC_TOOL_TOP_LEVEL_SCHEMA_KEYS.has(key)) {\n\t\t\tcontinue;\n\t\t}\n\t\tnormalized[key] = value;\n\t}\n\tnormalized.type = \"object\";\n\tif (!isRecord(normalized.properties)) {\n\t\tnormalized.properties = {};\n\t}\n\tif (!(\"additionalProperties\" in normalized)) {\n\t\tnormalized.additionalProperties = false;\n\t}\n\treturn normalized;\n}\n\nfunction toUniqueCodexDynamicToolName(\n\ttoolName: string,\n\tseenCodexNames: ReadonlySet<string>,\n): string {\n\tconst baseName = toCodexDynamicToolName(toolName);\n\tif (!seenCodexNames.has(baseName)) {\n\t\treturn baseName;\n\t}\n\tfor (let index = 2; ; index += 1) {\n\t\tconst suffix = `_${index}`;\n\t\tconst candidate = `${truncateIdentifier(\n\t\t\tbaseName,\n\t\t\tCODEX_DYNAMIC_TOOL_CONFORMANCE.nameMaxLength - suffix.length,\n\t\t)}${suffix}`;\n\t\tif (!seenCodexNames.has(candidate)) {\n\t\t\treturn candidate;\n\t\t}\n\t}\n}\n\nfunction toCodexDynamicToolName(toolName: string): string {\n\tconst trimmed = toolName.trim();\n\tlet codexName = trimmed.replace(/[^a-zA-Z0-9_-]/g, \"_\");\n\tif (codexName.length === 0) {\n\t\tcodexName = \"maestro_tool\";\n\t}\n\tif (isReservedCodexDynamicToolIdentifier(codexName)) {\n\t\tcodexName = `maestro_${codexName}`;\n\t}\n\treturn truncateIdentifier(\n\t\tcodexName,\n\t\tCODEX_DYNAMIC_TOOL_CONFORMANCE.nameMaxLength,\n\t);\n}\n\nfunction isReservedCodexDynamicToolIdentifier(value: string): boolean {\n\treturn (\n\t\tCODEX_DYNAMIC_TOOL_CONFORMANCE.reservedNames.some(\n\t\t\t(reservedName) => value === reservedName,\n\t\t) ||\n\t\tCODEX_DYNAMIC_TOOL_CONFORMANCE.reservedNamePrefixes.some((prefix) =>\n\t\t\tvalue.startsWith(prefix),\n\t\t)\n\t);\n}\n\nfunction truncateIdentifier(value: string, maxLength: number): string {\n\tif (value.length <= maxLength) {\n\t\treturn value;\n\t}\n\treturn value.slice(0, Math.max(1, maxLength));\n}\n\nfunction emptyCodexDynamicToolInputSchema(): JsonObject {\n\treturn {\n\t\ttype: \"object\",\n\t\tproperties: {},\n\t\tadditionalProperties: false,\n\t};\n}\n\nfunction flattenTopLevelCompositionSchema(\n\tschema: JsonObject,\n): JsonObject | null {\n\tfor (const key of CODEX_DYNAMIC_TOOL_COMPOSITION_SCHEMA_KEYS) {\n\t\tconst branches = schema[key];\n\t\tif (!Array.isArray(branches)) {\n\t\t\tcontinue;\n\t\t}\n\t\tif (branches.length === 0 || !branches.every(isRecord)) {\n\t\t\treturn emptyCodexDynamicToolInputSchema();\n\t\t}\n\t\treturn flattenObjectSchemaBranches(schema, key, branches);\n\t}\n\treturn null;\n}\n\nfunction flattenObjectSchemaBranches(\n\tschema: JsonObject,\n\tcompositionKey: (typeof CODEX_DYNAMIC_TOOL_COMPOSITION_SCHEMA_KEYS)[number],\n\tbranches: JsonObject[],\n): JsonObject {\n\tconst propertySchemas = new Map<string, unknown[]>();\n\tconst topLevelProperties = schema.properties;\n\tif (isRecord(topLevelProperties)) {\n\t\tfor (const [name, propertySchema] of Object.entries(topLevelProperties)) {\n\t\t\taddPropertySchema(propertySchemas, name, propertySchema);\n\t\t}\n\t}\n\n\tconst branchRequiredSets: Array<Set<string>> = [];\n\tfor (const branch of branches) {\n\t\tconst branchProperties = branch.properties;\n\t\tif (isRecord(branchProperties)) {\n\t\t\tfor (const [name, propertySchema] of Object.entries(branchProperties)) {\n\t\t\t\taddPropertySchema(propertySchemas, name, propertySchema);\n\t\t\t}\n\t\t}\n\t\tbranchRequiredSets.push(new Set(readStringArray(branch.required)));\n\t}\n\n\tconst properties: JsonObject = {};\n\tfor (const [name, schemas] of propertySchemas.entries()) {\n\t\tproperties[name] = mergePropertySchemas(schemas);\n\t}\n\n\tconst required = computeFlattenedRequired(\n\t\tschema,\n\t\tcompositionKey,\n\t\tbranchRequiredSets,\n\t).filter((name) => name in properties);\n\tconst flattened: JsonObject = {\n\t\ttype: \"object\",\n\t\tproperties,\n\t\tadditionalProperties: computeFlattenedAdditionalProperties(\n\t\t\tschema,\n\t\t\tcompositionKey,\n\t\t\tbranches,\n\t\t),\n\t};\n\tif (typeof schema.description === \"string\") {\n\t\tflattened.description = schema.description;\n\t}\n\tif (required.length > 0) {\n\t\tflattened.required = required;\n\t}\n\treturn flattened;\n}\n\nfunction addPropertySchema(\n\tpropertySchemas: Map<string, unknown[]>,\n\tname: string,\n\tpropertySchema: unknown,\n): void {\n\tconst schemas = propertySchemas.get(name);\n\tif (schemas) {\n\t\tschemas.push(propertySchema);\n\t\treturn;\n\t}\n\tpropertySchemas.set(name, [propertySchema]);\n}\n\nfunction computeFlattenedRequired(\n\tschema: JsonObject,\n\tcompositionKey: (typeof CODEX_DYNAMIC_TOOL_COMPOSITION_SCHEMA_KEYS)[number],\n\tbranchRequiredSets: Array<Set<string>>,\n): string[] {\n\tconst topLevelRequired = readStringArray(schema.required);\n\tif (branchRequiredSets.length === 0) {\n\t\treturn topLevelRequired;\n\t}\n\tif (compositionKey === \"allOf\") {\n\t\treturn uniqueStrings([\n\t\t\t...topLevelRequired,\n\t\t\t...branchRequiredSets.flatMap((set) => [...set]),\n\t\t]);\n\t}\n\tconst firstBranchRequired = branchRequiredSets[0] ?? new Set<string>();\n\tconst requiredByEveryBranch = [...firstBranchRequired].filter((name) =>\n\t\tbranchRequiredSets.every((set) => set.has(name)),\n\t);\n\treturn uniqueStrings([...topLevelRequired, ...requiredByEveryBranch]);\n}\n\nfunction mergePropertySchemas(schemas: unknown[]): unknown {\n\tconst uniqueSchemas = uniqueJsonItems(schemas);\n\tif (uniqueSchemas.length <= 1) {\n\t\treturn uniqueSchemas[0] ?? {};\n\t}\n\n\tconst constValues = uniqueSchemas.map(readConstValue);\n\tif (constValues.every((entry) => entry.found)) {\n\t\tconst schemaTypes = uniqueSchemas.map(readSchemaType);\n\t\tconst commonType = schemaTypes.every((type) => type === schemaTypes[0])\n\t\t\t? schemaTypes[0]\n\t\t\t: undefined;\n\t\treturn {\n\t\t\t...(commonType ? { type: commonType } : {}),\n\t\t\tenum: uniqueJsonItems(constValues.map((entry) => entry.value)),\n\t\t};\n\t}\n\n\treturn { anyOf: uniqueSchemas };\n}\n\nfunction computeFlattenedAdditionalProperties(\n\tschema: JsonObject,\n\tcompositionKey: (typeof CODEX_DYNAMIC_TOOL_COMPOSITION_SCHEMA_KEYS)[number],\n\tbranches: JsonObject[],\n): AdditionalPropertiesConstraint {\n\tconst topLevelConstraint = readAdditionalPropertiesConstraint(\n\t\tschema.additionalProperties,\n\t);\n\tif (topLevelConstraint === false) {\n\t\treturn false;\n\t}\n\tconst branchConstraint =\n\t\tcompositionKey === \"allOf\"\n\t\t\t? intersectAdditionalPropertiesConstraints(\n\t\t\t\t\tbranches.map((branch) =>\n\t\t\t\t\t\treadAdditionalPropertiesConstraint(branch.additionalProperties),\n\t\t\t\t\t),\n\t\t\t\t)\n\t\t\t: unionAdditionalPropertiesConstraints(\n\t\t\t\t\tbranches.map((branch) =>\n\t\t\t\t\t\treadAdditionalPropertiesConstraint(branch.additionalProperties),\n\t\t\t\t\t),\n\t\t\t\t);\n\treturn intersectAdditionalPropertiesConstraints([\n\t\ttopLevelConstraint,\n\t\tbranchConstraint,\n\t]);\n}\n\nfunction readAdditionalPropertiesConstraint(\n\tvalue: unknown,\n): AdditionalPropertiesConstraint {\n\tif (value === false) {\n\t\treturn false;\n\t}\n\tif (isRecord(value)) {\n\t\treturn value;\n\t}\n\treturn true;\n}\n\nfunction unionAdditionalPropertiesConstraints(\n\tconstraints: AdditionalPropertiesConstraint[],\n): AdditionalPropertiesConstraint {\n\tif (constraints.some((constraint) => constraint === false)) {\n\t\treturn false;\n\t}\n\tif (constraints.some((constraint) => constraint === true)) {\n\t\treturn true;\n\t}\n\tconst schemas = constraints.filter(isRecord);\n\tif (schemas.length === 0) {\n\t\treturn false;\n\t}\n\treturn combineAdditionalPropertiesSchemas(\"anyOf\", schemas);\n}\n\nfunction intersectAdditionalPropertiesConstraints(\n\tconstraints: AdditionalPropertiesConstraint[],\n): AdditionalPropertiesConstraint {\n\tif (constraints.some((constraint) => constraint === false)) {\n\t\treturn false;\n\t}\n\tconst schemas = constraints.filter(isRecord);\n\tif (schemas.length === 0) {\n\t\treturn true;\n\t}\n\treturn combineAdditionalPropertiesSchemas(\"allOf\", schemas);\n}\n\nfunction combineAdditionalPropertiesSchemas(\n\tcompositionKey: \"allOf\" | \"anyOf\",\n\tschemas: JsonObject[],\n): JsonObject {\n\tconst uniqueSchemas = uniqueJsonItems(schemas).filter(isRecord);\n\tif (uniqueSchemas.length <= 1) {\n\t\treturn uniqueSchemas[0] ?? {};\n\t}\n\treturn { [compositionKey]: uniqueSchemas };\n}\n\nfunction readStringArray(value: unknown): string[] {\n\treturn Array.isArray(value)\n\t\t? value.filter((item): item is string => typeof item === \"string\")\n\t\t: [];\n}\n\nfunction uniqueStrings(values: string[]): string[] {\n\treturn Array.from(new Set(values));\n}\n\nfunction uniqueJsonItems(values: unknown[]): unknown[] {\n\tconst seen = new Set<string>();\n\tconst unique: unknown[] = [];\n\tfor (const value of values) {\n\t\tconst key = schemaJsonKey(value);\n\t\tif (seen.has(key)) {\n\t\t\tcontinue;\n\t\t}\n\t\tseen.add(key);\n\t\tunique.push(value);\n\t}\n\treturn unique;\n}\n\nfunction schemaJsonKey(value: unknown): string {\n\ttry {\n\t\treturn JSON.stringify(value);\n\t} catch {\n\t\treturn String(value);\n\t}\n}\n\nfunction readConstValue(schema: unknown): { found: boolean; value?: unknown } {\n\tif (!isRecord(schema) || !(\"const\" in schema)) {\n\t\treturn { found: false };\n\t}\n\treturn { found: true, value: schema.const };\n}\n\nfunction readSchemaType(schema: unknown): string | undefined {\n\treturn isRecord(schema) && typeof schema.type === \"string\"\n\t\t? schema.type\n\t\t: undefined;\n}\n\nfunction isRecord(value: unknown): value is JsonObject {\n\treturn Boolean(value && typeof value === \"object\" && !Array.isArray(value));\n}\n"]}

package/dist/guardian/config.d.ts

@@ -3,9 +3,10 @@
  *
  * Loads configuration from (in order of precedence):
  * 1. Programmatic options passed to runGuardian()
- * 2. Project-level: .maestro/guardian.json
- * 3. User-level: ~/.maestro/guardian.json
- * 4. Default configuration
+ * 2. Environment variables
+ * 3. Project-level: .maestro/guardian.json
+ * 4. User-level: ~/.maestro/guardian.json
+ * 5. Default configuration
  */
 import type { GuardianConfig } from "./types.js";
 /** Default Guardian configuration */
@@ -23,9 +24,10 @@ export declare function getUserConfigPath(): string;
  *
  * Order of precedence (highest to lowest):
  * 1. Programmatic options
- * 2. Project-level config (.maestro/guardian.json)
- * 3. User-level config (~/.maestro/guardian.json)
- * 4. Default config
+ * 2. Environment variables
+ * 3. Project-level config (.maestro/guardian.json)
+ * 4. User-level config (~/.maestro/guardian.json)
+ * 5. Default config
  */
 export declare function resolveGuardianConfig(options?: {
     root?: string;

package/dist/guardian/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/guardian/config.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAMH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAIjD,qCAAqC;AACrC,eAAO,MAAM,uBAAuB,EAAE,QAAQ,CAAC,cAAc,CAe5D,CAAC;AAwBF;;GAEG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,MAAM,CAG1D;AAED;;GAEG;AACH,wBAAgB,iBAAiB,IAAI,MAAM,CAE1C;AAgDD;;;;;;;;GAQG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,CAAC,EAAE;IAC/C,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,cAAc,CAAC;CACxB,GAAG,QAAQ,CAAC,cAAc,CAAC,CAiC3B;AAED;;GAEG;AACH,wBAAgB,sBAAsB,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG;IAC3D,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,OAAO,EAAE,KAAK,CAAC;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACnD,CAiBA;AAkBD;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,QAAQ,CAAC,cAAc,CAAC,GAAG,MAAM,CAiCzE"}
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/guardian/config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAMH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAKjD,qCAAqC;AACrC,eAAO,MAAM,uBAAuB,EAAE,QAAQ,CAAC,cAAc,CAe5D,CAAC;AAkDF;;GAEG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,MAAM,CAG1D;AAED;;GAEG;AACH,wBAAgB,iBAAiB,IAAI,MAAM,CAE1C;AAgDD;;;;;;;;;GASG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,CAAC,EAAE;IAC/C,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,cAAc,CAAC;CACxB,GAAG,QAAQ,CAAC,cAAc,CAAC,CAmC3B;AAED;;GAEG;AACH,wBAAgB,sBAAsB,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG;IAC3D,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,OAAO,EAAE,KAAK,CAAC;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACnD,CAiBA;AAkBD;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,QAAQ,CAAC,cAAc,CAAC,GAAG,MAAM,CAiCzE"}

package/dist/guardian/config.js

@@ -3,15 +3,17 @@
  *
  * Loads configuration from (in order of precedence):
  * 1. Programmatic options passed to runGuardian()
- * 2. Project-level: .maestro/guardian.json
- * 3. User-level: ~/.maestro/guardian.json
- * 4. Default configuration
+ * 2. Environment variables
+ * 3. Project-level: .maestro/guardian.json
+ * 4. User-level: ~/.maestro/guardian.json
+ * 5. Default configuration
  */
 import { existsSync, readFileSync } from "node:fs";
 import { join, resolve } from "node:path";
 import { PATHS } from "../config/constants.js";
 import { createLogger } from "../utils/logger.js";
 const logger = createLogger("guardian:config");
+const TOOL_TIMEOUT_ENV = "MAESTRO_GUARDIAN_TOOL_TIMEOUT_MS";
 /** Default Guardian configuration */
 export const DEFAULT_GUARDIAN_CONFIG = {
     enabled: true,
@@ -50,6 +52,28 @@ function loadConfigFile(path) {
         return null;
     }
 }
+function parsePositiveIntegerEnv(name) {
+    const raw = process.env[name];
+    if (typeof raw !== "string" || raw.trim().length === 0) {
+        return undefined;
+    }
+    const parsed = Number(raw.trim());
+    if (!Number.isSafeInteger(parsed) || parsed <= 0) {
+        logger.warn("Ignoring invalid Guardian numeric environment override", {
+            name,
+            value: raw,
+        });
+        return undefined;
+    }
+    return parsed;
+}
+function loadEnvConfig() {
+    const toolTimeoutMs = parsePositiveIntegerEnv(TOOL_TIMEOUT_ENV);
+    if (toolTimeoutMs === undefined) {
+        return null;
+    }
+    return { toolTimeoutMs };
+}
 /**
  * Get the project-level config file path
  */
@@ -110,14 +134,16 @@ function mergeConfigs(...configs) {
  *
  * Order of precedence (highest to lowest):
  * 1. Programmatic options
- * 2. Project-level config (.maestro/guardian.json)
- * 3. User-level config (~/.maestro/guardian.json)
- * 4. Default config
+ * 2. Environment variables
+ * 3. Project-level config (.maestro/guardian.json)
+ * 4. User-level config (~/.maestro/guardian.json)
+ * 5. Default config
  */
 export function resolveGuardianConfig(options) {
     const userConfig = loadConfigFile(getUserConfigPath());
     const projectConfig = loadConfigFile(getProjectConfigPath(options?.root));
-    const merged = mergeConfigs(DEFAULT_GUARDIAN_CONFIG, userConfig, projectConfig, options?.config ?? null);
+    const envConfig = loadEnvConfig();
+    const merged = mergeConfigs(DEFAULT_GUARDIAN_CONFIG, userConfig, projectConfig, envConfig, options?.config ?? null);
     // Ensure all required properties are present
     return {
         enabled: merged.enabled ?? DEFAULT_GUARDIAN_CONFIG.enabled,

package/dist/guardian/config.js.map

@@ -1 +1 @@
-{"version":3,"file":"config.js","sourceRoot":"","sources":["../../src/guardian/config.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,KAAK,EAAE,MAAM,wBAAwB,CAAC;AAC/C,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAGlD,MAAM,MAAM,GAAG,YAAY,CAAC,iBAAiB,CAAC,CAAC;AAE/C,qCAAqC;AACrC,MAAM,CAAC,MAAM,uBAAuB,GAA6B;IAChE,OAAO,EAAE,IAAI;IACb,iBAAiB,EAAE,IAAI;IACvB,uBAAuB,EAAE,IAAI;IAC7B,oBAAoB,EAAE,EAAE;IACxB,eAAe,EAAE,EAAE;IACnB,KAAK,EAAE;QACN,iBAAiB,EAAE,IAAI;QACvB,OAAO,EAAE,IAAI;QACb,UAAU,EAAE,IAAI;QAChB,UAAU,EAAE,IAAI;QAChB,aAAa,EAAE,IAAI;KACnB;IACD,aAAa,EAAE,OAAO;IACtB,eAAe,EAAE,IAAI;CACrB,CAAC;AAEF;;GAEG;AACH,SAAS,cAAc,CAAC,IAAY;IACnC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACvB,OAAO,IAAI,CAAC;IACb,CAAC;IAED,IAAI,CAAC;QACJ,MAAM,OAAO,GAAG,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAC5C,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAmB,CAAC;QACrD,MAAM,CAAC,KAAK,CAAC,wBAAwB,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;QACzD,OAAO,MAAM,CAAC;IACf,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,MAAM,CAAC,IAAI,CAAC,gCAAgC,EAAE;YAC7C,IAAI;YACJ,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;SAC7D,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IACb,CAAC;AACF,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,oBAAoB,CAAC,IAAa;IACjD,MAAM,WAAW,GAAG,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;IACzD,OAAO,IAAI,CAAC,WAAW,EAAE,UAAU,EAAE,eAAe,CAAC,CAAC;AACvD,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,iBAAiB;IAChC,OAAO,IAAI,CAAC,KAAK,CAAC,YAAY,EAAE,eAAe,CAAC,CAAC;AAClD,CAAC;AAED;;GAEG;AACH,SAAS,YAAY,CAAC,GAAG,OAAkC;IAC1D,MAAM,MAAM,GAAmB,EAAE,GAAG,uBAAuB,EAAE,CAAC;IAE9D,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC9B,IAAI,CAAC,MAAM;YAAE,SAAS;QAEtB,2BAA2B;QAC3B,IAAI,MAAM,CAAC,OAAO,KAAK,SAAS;YAAE,MAAM,CAAC,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;QAClE,IAAI,MAAM,CAAC,iBAAiB,KAAK,SAAS;YACzC,MAAM,CAAC,iBAAiB,GAAG,MAAM,CAAC,iBAAiB,CAAC;QACrD,IAAI,MAAM,CAAC,uBAAuB,KAAK,SAAS;YAC/C,MAAM,CAAC,uBAAuB,GAAG,MAAM,CAAC,uBAAuB,CAAC;QACjE,IAAI,MAAM,CAAC,aAAa,KAAK,SAAS;YACrC,MAAM,CAAC,aAAa,GAAG,MAAM,CAAC,aAAa,CAAC;QAC7C,IAAI,MAAM,CAAC,eAAe,KAAK,SAAS;YACvC,MAAM,CAAC,eAAe,GAAG,MAAM,CAAC,eAAe,CAAC;QAEjD,+BAA+B;QAC/B,IAAI,MAAM,CAAC,oBAAoB,EAAE,CAAC;YACjC,MAAM,CAAC,oBAAoB,GAAG;gBAC7B,GAAG,CAAC,MAAM,CAAC,oBAAoB,IAAI,EAAE,CAAC;gBACtC,GAAG,MAAM,CAAC,oBAAoB;aAC9B,CAAC;QACH,CAAC;QACD,IAAI,MAAM,CAAC,eAAe,EAAE,CAAC;YAC5B,MAAM,CAAC,eAAe,GAAG;gBACxB,GAAG,CAAC,MAAM,CAAC,eAAe,IAAI,EAAE,CAAC;gBACjC,GAAG,MAAM,CAAC,eAAe;aACzB,CAAC;QACH,CAAC;QAED,qBAAqB;QACrB,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;YAClB,MAAM,CAAC,KAAK,GAAG;gBACd,GAAG,MAAM,CAAC,KAAK;gBACf,GAAG,MAAM,CAAC,KAAK;aACf,CAAC;QACH,CAAC;IACF,CAAC;IAED,OAAO,MAAM,CAAC;AACf,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,qBAAqB,CAAC,OAGrC;IACA,MAAM,UAAU,GAAG,cAAc,CAAC,iBAAiB,EAAE,CAAC,CAAC;IACvD,MAAM,aAAa,GAAG,cAAc,CAAC,oBAAoB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC;IAE1E,MAAM,MAAM,GAAG,YAAY,CAC1B,uBAAuB,EACvB,UAAU,EACV,aAAa,EACb,OAAO,EAAE,MAAM,IAAI,IAAI,CACvB,CAAC;IAEF,6CAA6C;IAC7C,OAAO;QACN,OAAO,EAAE,MAAM,CAAC,OAAO,IAAI,uBAAuB,CAAC,OAAO;QAC1D,iBAAiB,EAChB,MAAM,CAAC,iBAAiB,IAAI,uBAAuB,CAAC,iBAAiB;QACtE,uBAAuB,EACtB,MAAM,CAAC,uBAAuB;YAC9B,uBAAuB,CAAC,uBAAuB;QAChD,oBAAoB,EACnB,MAAM,CAAC,oBAAoB;YAC3B,uBAAuB,CAAC,oBAAoB;QAC7C,eAAe,EACd,MAAM,CAAC,eAAe,IAAI,uBAAuB,CAAC,eAAe;QAClE,KAAK,EAAE;YACN,GAAG,uBAAuB,CAAC,KAAK;YAChC,GAAG,MAAM,CAAC,KAAK;SACf;QACD,aAAa,EACZ,MAAM,CAAC,aAAa,IAAI,uBAAuB,CAAC,aAAa;QAC9D,eAAe,EACd,MAAM,CAAC,eAAe,IAAI,uBAAuB,CAAC,eAAe;KAClE,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,sBAAsB,CAAC,QAAkB;IAIxD,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,OAAO,GAA8C,EAAE,CAAC;IAE9D,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAChC,MAAM,QAAQ,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;QAC3C,IAAI,QAAQ,EAAE,CAAC;YACd,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACrB,CAAC;aAAM,CAAC;YACP,OAAO,CAAC,IAAI,CAAC;gBACZ,OAAO;gBACP,KAAK,EAAE,iCAAiC;aACxC,CAAC,CAAC;QACJ,CAAC;IACF,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;AAC3B,CAAC;AAED;;GAEG;AACH,SAAS,gBAAgB,CAAC,OAAe;IACxC,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;QACtC,OAAO,IAAI,CAAC;IACb,CAAC;IAED,IAAI,CAAC;QACJ,gGAAgG;QAChG,OAAO,IAAI,MAAM,CAAC,OAAO,CAAC,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,IAAI,CAAC;IACb,CAAC;AACF,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,gBAAgB,CAAC,MAAgC;IAChE,MAAM,KAAK,GAAa,EAAE,CAAC;IAE3B,KAAK,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC;IACtC,KAAK,CAAC,IAAI,CAAC,cAAc,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;IAC3C,KAAK,CAAC,IAAI,CAAC,0BAA0B,MAAM,CAAC,iBAAiB,EAAE,CAAC,CAAC;IACjE,KAAK,CAAC,IAAI,CAAC,gCAAgC,MAAM,CAAC,uBAAuB,EAAE,CAAC,CAAC;IAC7E,KAAK,CAAC,IAAI,CAAC,wBAAwB,MAAM,CAAC,eAAe,EAAE,CAAC,CAAC;IAC7D,KAAK,CAAC,IAAI,CAAC,mBAAmB,MAAM,CAAC,aAAa,IAAI,CAAC,CAAC;IAExD,MAAM,YAAY,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC;SAC/C,MAAM,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC;SAChC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC;IACxB,MAAM,aAAa,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC;SAChD,MAAM,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC;SACjC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC;IAExB,KAAK,CAAC,IAAI,CAAC,oBAAoB,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,MAAM,EAAE,CAAC,CAAC;IACpE,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC9B,KAAK,CAAC,IAAI,CAAC,qBAAqB,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC7D,CAAC;IAED,IAAI,MAAM,CAAC,oBAAoB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5C,KAAK,CAAC,IAAI,CACT,6BAA6B,MAAM,CAAC,oBAAoB,CAAC,MAAM,EAAE,CACjE,CAAC;IACH,CAAC;IAED,IAAI,MAAM,CAAC,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvC,KAAK,CAAC,IAAI,CAAC,sBAAsB,MAAM,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACvE,CAAC;IAED,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACzB,CAAC","sourcesContent":["/**\n * Guardian configuration loader\n *\n * Loads configuration from (in order of precedence):\n * 1. Programmatic options passed to runGuardian()\n * 2. Project-level: .maestro/guardian.json\n * 3. User-level: ~/.maestro/guardian.json\n * 4. Default configuration\n */\n\nimport { existsSync, readFileSync } from \"node:fs\";\nimport { join, resolve } from \"node:path\";\nimport { PATHS } from \"../config/constants.js\";\nimport { createLogger } from \"../utils/logger.js\";\nimport type { GuardianConfig } from \"./types.js\";\n\nconst logger = createLogger(\"guardian:config\");\n\n/** Default Guardian configuration */\nexport const DEFAULT_GUARDIAN_CONFIG: Required<GuardianConfig> = {\n\tenabled: true,\n\tscanGitOperations: true,\n\tscanDestructiveCommands: true,\n\tcustomSecretPatterns: [],\n\texcludePatterns: [],\n\ttools: {\n\t\tevidenceIntegrity: true,\n\t\tsemgrep: true,\n\t\tgitSecrets: true,\n\t\ttrufflehog: true,\n\t\theuristicScan: true,\n\t},\n\ttoolTimeoutMs: 120_000,\n\tblockOnFindings: true,\n};\n\n/**\n * Load and parse a Guardian config file\n */\nfunction loadConfigFile(path: string): GuardianConfig | null {\n\tif (!existsSync(path)) {\n\t\treturn null;\n\t}\n\n\ttry {\n\t\tconst content = readFileSync(path, \"utf-8\");\n\t\tconst config = JSON.parse(content) as GuardianConfig;\n\t\tlogger.debug(\"Loaded Guardian config\", { path, config });\n\t\treturn config;\n\t} catch (error) {\n\t\tlogger.warn(\"Failed to load Guardian config\", {\n\t\t\tpath,\n\t\t\terror: error instanceof Error ? error.message : String(error),\n\t\t});\n\t\treturn null;\n\t}\n}\n\n/**\n * Get the project-level config file path\n */\nexport function getProjectConfigPath(root?: string): string {\n\tconst projectRoot = root ? resolve(root) : process.cwd();\n\treturn join(projectRoot, \".maestro\", \"guardian.json\");\n}\n\n/**\n * Get the user-level config file path\n */\nexport function getUserConfigPath(): string {\n\treturn join(PATHS.MAESTRO_HOME, \"guardian.json\");\n}\n\n/**\n * Merge multiple configs with later configs taking precedence\n */\nfunction mergeConfigs(...configs: (GuardianConfig | null)[]): GuardianConfig {\n\tconst result: GuardianConfig = { ...DEFAULT_GUARDIAN_CONFIG };\n\n\tfor (const config of configs) {\n\t\tif (!config) continue;\n\n\t\t// Simple scalar properties\n\t\tif (config.enabled !== undefined) result.enabled = config.enabled;\n\t\tif (config.scanGitOperations !== undefined)\n\t\t\tresult.scanGitOperations = config.scanGitOperations;\n\t\tif (config.scanDestructiveCommands !== undefined)\n\t\t\tresult.scanDestructiveCommands = config.scanDestructiveCommands;\n\t\tif (config.toolTimeoutMs !== undefined)\n\t\t\tresult.toolTimeoutMs = config.toolTimeoutMs;\n\t\tif (config.blockOnFindings !== undefined)\n\t\t\tresult.blockOnFindings = config.blockOnFindings;\n\n\t\t// Arrays - merge with defaults\n\t\tif (config.customSecretPatterns) {\n\t\t\tresult.customSecretPatterns = [\n\t\t\t\t...(result.customSecretPatterns || []),\n\t\t\t\t...config.customSecretPatterns,\n\t\t\t];\n\t\t}\n\t\tif (config.excludePatterns) {\n\t\t\tresult.excludePatterns = [\n\t\t\t\t...(result.excludePatterns || []),\n\t\t\t\t...config.excludePatterns,\n\t\t\t];\n\t\t}\n\n\t\t// Tools - deep merge\n\t\tif (config.tools) {\n\t\t\tresult.tools = {\n\t\t\t\t...result.tools,\n\t\t\t\t...config.tools,\n\t\t\t};\n\t\t}\n\t}\n\n\treturn result;\n}\n\n/**\n * Resolve the effective Guardian configuration\n *\n * Order of precedence (highest to lowest):\n * 1. Programmatic options\n * 2. Project-level config (.maestro/guardian.json)\n * 3. User-level config (~/.maestro/guardian.json)\n * 4. Default config\n */\nexport function resolveGuardianConfig(options?: {\n\troot?: string;\n\tconfig?: GuardianConfig;\n}): Required<GuardianConfig> {\n\tconst userConfig = loadConfigFile(getUserConfigPath());\n\tconst projectConfig = loadConfigFile(getProjectConfigPath(options?.root));\n\n\tconst merged = mergeConfigs(\n\t\tDEFAULT_GUARDIAN_CONFIG,\n\t\tuserConfig,\n\t\tprojectConfig,\n\t\toptions?.config ?? null,\n\t);\n\n\t// Ensure all required properties are present\n\treturn {\n\t\tenabled: merged.enabled ?? DEFAULT_GUARDIAN_CONFIG.enabled,\n\t\tscanGitOperations:\n\t\t\tmerged.scanGitOperations ?? DEFAULT_GUARDIAN_CONFIG.scanGitOperations,\n\t\tscanDestructiveCommands:\n\t\t\tmerged.scanDestructiveCommands ??\n\t\t\tDEFAULT_GUARDIAN_CONFIG.scanDestructiveCommands,\n\t\tcustomSecretPatterns:\n\t\t\tmerged.customSecretPatterns ??\n\t\t\tDEFAULT_GUARDIAN_CONFIG.customSecretPatterns,\n\t\texcludePatterns:\n\t\t\tmerged.excludePatterns ?? DEFAULT_GUARDIAN_CONFIG.excludePatterns,\n\t\ttools: {\n\t\t\t...DEFAULT_GUARDIAN_CONFIG.tools,\n\t\t\t...merged.tools,\n\t\t},\n\t\ttoolTimeoutMs:\n\t\t\tmerged.toolTimeoutMs ?? DEFAULT_GUARDIAN_CONFIG.toolTimeoutMs,\n\t\tblockOnFindings:\n\t\t\tmerged.blockOnFindings ?? DEFAULT_GUARDIAN_CONFIG.blockOnFindings,\n\t};\n}\n\n/**\n * Validate custom secret patterns\n */\nexport function validateSecretPatterns(patterns: string[]): {\n\tvalid: string[];\n\tinvalid: Array<{ pattern: string; error: string }>;\n} {\n\tconst valid: string[] = [];\n\tconst invalid: Array<{ pattern: string; error: string }> = [];\n\n\tfor (const pattern of patterns) {\n\t\tconst compiled = compileUserRegex(pattern);\n\t\tif (compiled) {\n\t\t\tvalid.push(pattern);\n\t\t} else {\n\t\t\tinvalid.push({\n\t\t\t\tpattern,\n\t\t\t\terror: \"Invalid or unsafe regex pattern\",\n\t\t\t});\n\t\t}\n\t}\n\n\treturn { valid, invalid };\n}\n\n/**\n * Compile a user-provided regex string with basic safety guards.\n */\nfunction compileUserRegex(pattern: string): RegExp | null {\n\tif (!pattern || pattern.length > 500) {\n\t\treturn null;\n\t}\n\n\ttry {\n\t\t// nosemgrep: javascript.lang.security.audit.detect-non-literal-regexp.detect-non-literal-regexp\n\t\treturn new RegExp(pattern);\n\t} catch {\n\t\treturn null;\n\t}\n}\n\n/**\n * Get a summary of the current Guardian configuration\n */\nexport function getConfigSummary(config: Required<GuardianConfig>): string {\n\tconst lines: string[] = [];\n\n\tlines.push(\"Guardian Configuration:\");\n\tlines.push(`  Enabled: ${config.enabled}`);\n\tlines.push(`  Scan Git Operations: ${config.scanGitOperations}`);\n\tlines.push(`  Scan Destructive Commands: ${config.scanDestructiveCommands}`);\n\tlines.push(`  Block on Findings: ${config.blockOnFindings}`);\n\tlines.push(`  Tool Timeout: ${config.toolTimeoutMs}ms`);\n\n\tconst enabledTools = Object.entries(config.tools)\n\t\t.filter(([, enabled]) => enabled)\n\t\t.map(([name]) => name);\n\tconst disabledTools = Object.entries(config.tools)\n\t\t.filter(([, enabled]) => !enabled)\n\t\t.map(([name]) => name);\n\n\tlines.push(`  Enabled Tools: ${enabledTools.join(\", \") || \"none\"}`);\n\tif (disabledTools.length > 0) {\n\t\tlines.push(`  Disabled Tools: ${disabledTools.join(\", \")}`);\n\t}\n\n\tif (config.customSecretPatterns.length > 0) {\n\t\tlines.push(\n\t\t\t`  Custom Secret Patterns: ${config.customSecretPatterns.length}`,\n\t\t);\n\t}\n\n\tif (config.excludePatterns.length > 0) {\n\t\tlines.push(`  Custom Excludes: ${config.excludePatterns.join(\", \")}`);\n\t}\n\n\treturn lines.join(\"\\n\");\n}\n"]}
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../../src/guardian/config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,KAAK,EAAE,MAAM,wBAAwB,CAAC;AAC/C,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAGlD,MAAM,MAAM,GAAG,YAAY,CAAC,iBAAiB,CAAC,CAAC;AAC/C,MAAM,gBAAgB,GAAG,kCAAkC,CAAC;AAE5D,qCAAqC;AACrC,MAAM,CAAC,MAAM,uBAAuB,GAA6B;IAChE,OAAO,EAAE,IAAI;IACb,iBAAiB,EAAE,IAAI;IACvB,uBAAuB,EAAE,IAAI;IAC7B,oBAAoB,EAAE,EAAE;IACxB,eAAe,EAAE,EAAE;IACnB,KAAK,EAAE;QACN,iBAAiB,EAAE,IAAI;QACvB,OAAO,EAAE,IAAI;QACb,UAAU,EAAE,IAAI;QAChB,UAAU,EAAE,IAAI;QAChB,aAAa,EAAE,IAAI;KACnB;IACD,aAAa,EAAE,OAAO;IACtB,eAAe,EAAE,IAAI;CACrB,CAAC;AAEF;;GAEG;AACH,SAAS,cAAc,CAAC,IAAY;IACnC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACvB,OAAO,IAAI,CAAC;IACb,CAAC;IAED,IAAI,CAAC;QACJ,MAAM,OAAO,GAAG,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAC5C,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAmB,CAAC;QACrD,MAAM,CAAC,KAAK,CAAC,wBAAwB,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;QACzD,OAAO,MAAM,CAAC;IACf,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,MAAM,CAAC,IAAI,CAAC,gCAAgC,EAAE;YAC7C,IAAI;YACJ,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;SAC7D,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IACb,CAAC;AACF,CAAC;AAED,SAAS,uBAAuB,CAAC,IAAY;IAC5C,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC9B,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxD,OAAO,SAAS,CAAC;IAClB,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;IAClC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,MAAM,IAAI,CAAC,EAAE,CAAC;QAClD,MAAM,CAAC,IAAI,CAAC,wDAAwD,EAAE;YACrE,IAAI;YACJ,KAAK,EAAE,GAAG;SACV,CAAC,CAAC;QACH,OAAO,SAAS,CAAC;IAClB,CAAC;IAED,OAAO,MAAM,CAAC;AACf,CAAC;AAED,SAAS,aAAa;IACrB,MAAM,aAAa,GAAG,uBAAuB,CAAC,gBAAgB,CAAC,CAAC;IAChE,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;QACjC,OAAO,IAAI,CAAC;IACb,CAAC;IACD,OAAO,EAAE,aAAa,EAAE,CAAC;AAC1B,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,oBAAoB,CAAC,IAAa;IACjD,MAAM,WAAW,GAAG,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;IACzD,OAAO,IAAI,CAAC,WAAW,EAAE,UAAU,EAAE,eAAe,CAAC,CAAC;AACvD,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,iBAAiB;IAChC,OAAO,IAAI,CAAC,KAAK,CAAC,YAAY,EAAE,eAAe,CAAC,CAAC;AAClD,CAAC;AAED;;GAEG;AACH,SAAS,YAAY,CAAC,GAAG,OAAkC;IAC1D,MAAM,MAAM,GAAmB,EAAE,GAAG,uBAAuB,EAAE,CAAC;IAE9D,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC9B,IAAI,CAAC,MAAM;YAAE,SAAS;QAEtB,2BAA2B;QAC3B,IAAI,MAAM,CAAC,OAAO,KAAK,SAAS;YAAE,MAAM,CAAC,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;QAClE,IAAI,MAAM,CAAC,iBAAiB,KAAK,SAAS;YACzC,MAAM,CAAC,iBAAiB,GAAG,MAAM,CAAC,iBAAiB,CAAC;QACrD,IAAI,MAAM,CAAC,uBAAuB,KAAK,SAAS;YAC/C,MAAM,CAAC,uBAAuB,GAAG,MAAM,CAAC,uBAAuB,CAAC;QACjE,IAAI,MAAM,CAAC,aAAa,KAAK,SAAS;YACrC,MAAM,CAAC,aAAa,GAAG,MAAM,CAAC,aAAa,CAAC;QAC7C,IAAI,MAAM,CAAC,eAAe,KAAK,SAAS;YACvC,MAAM,CAAC,eAAe,GAAG,MAAM,CAAC,eAAe,CAAC;QAEjD,+BAA+B;QAC/B,IAAI,MAAM,CAAC,oBAAoB,EAAE,CAAC;YACjC,MAAM,CAAC,oBAAoB,GAAG;gBAC7B,GAAG,CAAC,MAAM,CAAC,oBAAoB,IAAI,EAAE,CAAC;gBACtC,GAAG,MAAM,CAAC,oBAAoB;aAC9B,CAAC;QACH,CAAC;QACD,IAAI,MAAM,CAAC,eAAe,EAAE,CAAC;YAC5B,MAAM,CAAC,eAAe,GAAG;gBACxB,GAAG,CAAC,MAAM,CAAC,eAAe,IAAI,EAAE,CAAC;gBACjC,GAAG,MAAM,CAAC,eAAe;aACzB,CAAC;QACH,CAAC;QAED,qBAAqB;QACrB,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;YAClB,MAAM,CAAC,KAAK,GAAG;gBACd,GAAG,MAAM,CAAC,KAAK;gBACf,GAAG,MAAM,CAAC,KAAK;aACf,CAAC;QACH,CAAC;IACF,CAAC;IAED,OAAO,MAAM,CAAC;AACf,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,qBAAqB,CAAC,OAGrC;IACA,MAAM,UAAU,GAAG,cAAc,CAAC,iBAAiB,EAAE,CAAC,CAAC;IACvD,MAAM,aAAa,GAAG,cAAc,CAAC,oBAAoB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC;IAC1E,MAAM,SAAS,GAAG,aAAa,EAAE,CAAC;IAElC,MAAM,MAAM,GAAG,YAAY,CAC1B,uBAAuB,EACvB,UAAU,EACV,aAAa,EACb,SAAS,EACT,OAAO,EAAE,MAAM,IAAI,IAAI,CACvB,CAAC;IAEF,6CAA6C;IAC7C,OAAO;QACN,OAAO,EAAE,MAAM,CAAC,OAAO,IAAI,uBAAuB,CAAC,OAAO;QAC1D,iBAAiB,EAChB,MAAM,CAAC,iBAAiB,IAAI,uBAAuB,CAAC,iBAAiB;QACtE,uBAAuB,EACtB,MAAM,CAAC,uBAAuB;YAC9B,uBAAuB,CAAC,uBAAuB;QAChD,oBAAoB,EACnB,MAAM,CAAC,oBAAoB;YAC3B,uBAAuB,CAAC,oBAAoB;QAC7C,eAAe,EACd,MAAM,CAAC,eAAe,IAAI,uBAAuB,CAAC,eAAe;QAClE,KAAK,EAAE;YACN,GAAG,uBAAuB,CAAC,KAAK;YAChC,GAAG,MAAM,CAAC,KAAK;SACf;QACD,aAAa,EACZ,MAAM,CAAC,aAAa,IAAI,uBAAuB,CAAC,aAAa;QAC9D,eAAe,EACd,MAAM,CAAC,eAAe,IAAI,uBAAuB,CAAC,eAAe;KAClE,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,sBAAsB,CAAC,QAAkB;IAIxD,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,OAAO,GAA8C,EAAE,CAAC;IAE9D,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAChC,MAAM,QAAQ,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;QAC3C,IAAI,QAAQ,EAAE,CAAC;YACd,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACrB,CAAC;aAAM,CAAC;YACP,OAAO,CAAC,IAAI,CAAC;gBACZ,OAAO;gBACP,KAAK,EAAE,iCAAiC;aACxC,CAAC,CAAC;QACJ,CAAC;IACF,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;AAC3B,CAAC;AAED;;GAEG;AACH,SAAS,gBAAgB,CAAC,OAAe;IACxC,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;QACtC,OAAO,IAAI,CAAC;IACb,CAAC;IAED,IAAI,CAAC;QACJ,gGAAgG;QAChG,OAAO,IAAI,MAAM,CAAC,OAAO,CAAC,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,IAAI,CAAC;IACb,CAAC;AACF,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,gBAAgB,CAAC,MAAgC;IAChE,MAAM,KAAK,GAAa,EAAE,CAAC;IAE3B,KAAK,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC;IACtC,KAAK,CAAC,IAAI,CAAC,cAAc,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;IAC3C,KAAK,CAAC,IAAI,CAAC,0BAA0B,MAAM,CAAC,iBAAiB,EAAE,CAAC,CAAC;IACjE,KAAK,CAAC,IAAI,CAAC,gCAAgC,MAAM,CAAC,uBAAuB,EAAE,CAAC,CAAC;IAC7E,KAAK,CAAC,IAAI,CAAC,wBAAwB,MAAM,CAAC,eAAe,EAAE,CAAC,CAAC;IAC7D,KAAK,CAAC,IAAI,CAAC,mBAAmB,MAAM,CAAC,aAAa,IAAI,CAAC,CAAC;IAExD,MAAM,YAAY,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC;SAC/C,MAAM,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC;SAChC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC;IACxB,MAAM,aAAa,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC;SAChD,MAAM,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC;SACjC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC;IAExB,KAAK,CAAC,IAAI,CAAC,oBAAoB,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,MAAM,EAAE,CAAC,CAAC;IACpE,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC9B,KAAK,CAAC,IAAI,CAAC,qBAAqB,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC7D,CAAC;IAED,IAAI,MAAM,CAAC,oBAAoB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5C,KAAK,CAAC,IAAI,CACT,6BAA6B,MAAM,CAAC,oBAAoB,CAAC,MAAM,EAAE,CACjE,CAAC;IACH,CAAC;IAED,IAAI,MAAM,CAAC,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvC,KAAK,CAAC,IAAI,CAAC,sBAAsB,MAAM,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACvE,CAAC;IAED,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACzB,CAAC","sourcesContent":["/**\n * Guardian configuration loader\n *\n * Loads configuration from (in order of precedence):\n * 1. Programmatic options passed to runGuardian()\n * 2. Environment variables\n * 3. Project-level: .maestro/guardian.json\n * 4. User-level: ~/.maestro/guardian.json\n * 5. Default configuration\n */\n\nimport { existsSync, readFileSync } from \"node:fs\";\nimport { join, resolve } from \"node:path\";\nimport { PATHS } from \"../config/constants.js\";\nimport { createLogger } from \"../utils/logger.js\";\nimport type { GuardianConfig } from \"./types.js\";\n\nconst logger = createLogger(\"guardian:config\");\nconst TOOL_TIMEOUT_ENV = \"MAESTRO_GUARDIAN_TOOL_TIMEOUT_MS\";\n\n/** Default Guardian configuration */\nexport const DEFAULT_GUARDIAN_CONFIG: Required<GuardianConfig> = {\n\tenabled: true,\n\tscanGitOperations: true,\n\tscanDestructiveCommands: true,\n\tcustomSecretPatterns: [],\n\texcludePatterns: [],\n\ttools: {\n\t\tevidenceIntegrity: true,\n\t\tsemgrep: true,\n\t\tgitSecrets: true,\n\t\ttrufflehog: true,\n\t\theuristicScan: true,\n\t},\n\ttoolTimeoutMs: 120_000,\n\tblockOnFindings: true,\n};\n\n/**\n * Load and parse a Guardian config file\n */\nfunction loadConfigFile(path: string): GuardianConfig | null {\n\tif (!existsSync(path)) {\n\t\treturn null;\n\t}\n\n\ttry {\n\t\tconst content = readFileSync(path, \"utf-8\");\n\t\tconst config = JSON.parse(content) as GuardianConfig;\n\t\tlogger.debug(\"Loaded Guardian config\", { path, config });\n\t\treturn config;\n\t} catch (error) {\n\t\tlogger.warn(\"Failed to load Guardian config\", {\n\t\t\tpath,\n\t\t\terror: error instanceof Error ? error.message : String(error),\n\t\t});\n\t\treturn null;\n\t}\n}\n\nfunction parsePositiveIntegerEnv(name: string): number | undefined {\n\tconst raw = process.env[name];\n\tif (typeof raw !== \"string\" || raw.trim().length === 0) {\n\t\treturn undefined;\n\t}\n\n\tconst parsed = Number(raw.trim());\n\tif (!Number.isSafeInteger(parsed) || parsed <= 0) {\n\t\tlogger.warn(\"Ignoring invalid Guardian numeric environment override\", {\n\t\t\tname,\n\t\t\tvalue: raw,\n\t\t});\n\t\treturn undefined;\n\t}\n\n\treturn parsed;\n}\n\nfunction loadEnvConfig(): GuardianConfig | null {\n\tconst toolTimeoutMs = parsePositiveIntegerEnv(TOOL_TIMEOUT_ENV);\n\tif (toolTimeoutMs === undefined) {\n\t\treturn null;\n\t}\n\treturn { toolTimeoutMs };\n}\n\n/**\n * Get the project-level config file path\n */\nexport function getProjectConfigPath(root?: string): string {\n\tconst projectRoot = root ? resolve(root) : process.cwd();\n\treturn join(projectRoot, \".maestro\", \"guardian.json\");\n}\n\n/**\n * Get the user-level config file path\n */\nexport function getUserConfigPath(): string {\n\treturn join(PATHS.MAESTRO_HOME, \"guardian.json\");\n}\n\n/**\n * Merge multiple configs with later configs taking precedence\n */\nfunction mergeConfigs(...configs: (GuardianConfig | null)[]): GuardianConfig {\n\tconst result: GuardianConfig = { ...DEFAULT_GUARDIAN_CONFIG };\n\n\tfor (const config of configs) {\n\t\tif (!config) continue;\n\n\t\t// Simple scalar properties\n\t\tif (config.enabled !== undefined) result.enabled = config.enabled;\n\t\tif (config.scanGitOperations !== undefined)\n\t\t\tresult.scanGitOperations = config.scanGitOperations;\n\t\tif (config.scanDestructiveCommands !== undefined)\n\t\t\tresult.scanDestructiveCommands = config.scanDestructiveCommands;\n\t\tif (config.toolTimeoutMs !== undefined)\n\t\t\tresult.toolTimeoutMs = config.toolTimeoutMs;\n\t\tif (config.blockOnFindings !== undefined)\n\t\t\tresult.blockOnFindings = config.blockOnFindings;\n\n\t\t// Arrays - merge with defaults\n\t\tif (config.customSecretPatterns) {\n\t\t\tresult.customSecretPatterns = [\n\t\t\t\t...(result.customSecretPatterns || []),\n\t\t\t\t...config.customSecretPatterns,\n\t\t\t];\n\t\t}\n\t\tif (config.excludePatterns) {\n\t\t\tresult.excludePatterns = [\n\t\t\t\t...(result.excludePatterns || []),\n\t\t\t\t...config.excludePatterns,\n\t\t\t];\n\t\t}\n\n\t\t// Tools - deep merge\n\t\tif (config.tools) {\n\t\t\tresult.tools = {\n\t\t\t\t...result.tools,\n\t\t\t\t...config.tools,\n\t\t\t};\n\t\t}\n\t}\n\n\treturn result;\n}\n\n/**\n * Resolve the effective Guardian configuration\n *\n * Order of precedence (highest to lowest):\n * 1. Programmatic options\n * 2. Environment variables\n * 3. Project-level config (.maestro/guardian.json)\n * 4. User-level config (~/.maestro/guardian.json)\n * 5. Default config\n */\nexport function resolveGuardianConfig(options?: {\n\troot?: string;\n\tconfig?: GuardianConfig;\n}): Required<GuardianConfig> {\n\tconst userConfig = loadConfigFile(getUserConfigPath());\n\tconst projectConfig = loadConfigFile(getProjectConfigPath(options?.root));\n\tconst envConfig = loadEnvConfig();\n\n\tconst merged = mergeConfigs(\n\t\tDEFAULT_GUARDIAN_CONFIG,\n\t\tuserConfig,\n\t\tprojectConfig,\n\t\tenvConfig,\n\t\toptions?.config ?? null,\n\t);\n\n\t// Ensure all required properties are present\n\treturn {\n\t\tenabled: merged.enabled ?? DEFAULT_GUARDIAN_CONFIG.enabled,\n\t\tscanGitOperations:\n\t\t\tmerged.scanGitOperations ?? DEFAULT_GUARDIAN_CONFIG.scanGitOperations,\n\t\tscanDestructiveCommands:\n\t\t\tmerged.scanDestructiveCommands ??\n\t\t\tDEFAULT_GUARDIAN_CONFIG.scanDestructiveCommands,\n\t\tcustomSecretPatterns:\n\t\t\tmerged.customSecretPatterns ??\n\t\t\tDEFAULT_GUARDIAN_CONFIG.customSecretPatterns,\n\t\texcludePatterns:\n\t\t\tmerged.excludePatterns ?? DEFAULT_GUARDIAN_CONFIG.excludePatterns,\n\t\ttools: {\n\t\t\t...DEFAULT_GUARDIAN_CONFIG.tools,\n\t\t\t...merged.tools,\n\t\t},\n\t\ttoolTimeoutMs:\n\t\t\tmerged.toolTimeoutMs ?? DEFAULT_GUARDIAN_CONFIG.toolTimeoutMs,\n\t\tblockOnFindings:\n\t\t\tmerged.blockOnFindings ?? DEFAULT_GUARDIAN_CONFIG.blockOnFindings,\n\t};\n}\n\n/**\n * Validate custom secret patterns\n */\nexport function validateSecretPatterns(patterns: string[]): {\n\tvalid: string[];\n\tinvalid: Array<{ pattern: string; error: string }>;\n} {\n\tconst valid: string[] = [];\n\tconst invalid: Array<{ pattern: string; error: string }> = [];\n\n\tfor (const pattern of patterns) {\n\t\tconst compiled = compileUserRegex(pattern);\n\t\tif (compiled) {\n\t\t\tvalid.push(pattern);\n\t\t} else {\n\t\t\tinvalid.push({\n\t\t\t\tpattern,\n\t\t\t\terror: \"Invalid or unsafe regex pattern\",\n\t\t\t});\n\t\t}\n\t}\n\n\treturn { valid, invalid };\n}\n\n/**\n * Compile a user-provided regex string with basic safety guards.\n */\nfunction compileUserRegex(pattern: string): RegExp | null {\n\tif (!pattern || pattern.length > 500) {\n\t\treturn null;\n\t}\n\n\ttry {\n\t\t// nosemgrep: javascript.lang.security.audit.detect-non-literal-regexp.detect-non-literal-regexp\n\t\treturn new RegExp(pattern);\n\t} catch {\n\t\treturn null;\n\t}\n}\n\n/**\n * Get a summary of the current Guardian configuration\n */\nexport function getConfigSummary(config: Required<GuardianConfig>): string {\n\tconst lines: string[] = [];\n\n\tlines.push(\"Guardian Configuration:\");\n\tlines.push(`  Enabled: ${config.enabled}`);\n\tlines.push(`  Scan Git Operations: ${config.scanGitOperations}`);\n\tlines.push(`  Scan Destructive Commands: ${config.scanDestructiveCommands}`);\n\tlines.push(`  Block on Findings: ${config.blockOnFindings}`);\n\tlines.push(`  Tool Timeout: ${config.toolTimeoutMs}ms`);\n\n\tconst enabledTools = Object.entries(config.tools)\n\t\t.filter(([, enabled]) => enabled)\n\t\t.map(([name]) => name);\n\tconst disabledTools = Object.entries(config.tools)\n\t\t.filter(([, enabled]) => !enabled)\n\t\t.map(([name]) => name);\n\n\tlines.push(`  Enabled Tools: ${enabledTools.join(\", \") || \"none\"}`);\n\tif (disabledTools.length > 0) {\n\t\tlines.push(`  Disabled Tools: ${disabledTools.join(\", \")}`);\n\t}\n\n\tif (config.customSecretPatterns.length > 0) {\n\t\tlines.push(\n\t\t\t`  Custom Secret Patterns: ${config.customSecretPatterns.length}`,\n\t\t);\n\t}\n\n\tif (config.excludePatterns.length > 0) {\n\t\tlines.push(`  Custom Excludes: ${config.excludePatterns.join(\", \")}`);\n\t}\n\n\treturn lines.join(\"\\n\");\n}\n"]}

package/dist/guardian/runner.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"runner.d.ts","sourceRoot":"","sources":["../../src/guardian/runner.ts"],"names":[],"mappings":"AAgBA,OAAO,KAAK,EAEX,kBAAkB,EAClB,iBAAiB,EAGjB,MAAM,YAAY,CAAC;AAqWpB,MAAM,MAAM,oBAAoB,GAC7B,gBAAgB,GAChB,gBAAgB,GAChB,mBAAmB,GACnB,iBAAiB,GACjB,aAAa,GACb,cAAc,GACd,cAAc,GACd,gBAAgB,GAChB,YAAY,GACZ,gBAAgB,GAChB,kBAAkB,GAClB,mBAAmB,GACnB,iBAAiB,GACjB,+BAA+B,GAC/B,WAAW,CAAC;AAEf,MAAM,MAAM,4BAA4B,GACrC,iCAAiC,GACjC,mCAAmC,GACnC,uCAAuC,GACvC,wBAAwB,GACxB,gDAAgD,CAAC;AA2IpD,wBAAgB,uBAAuB,CACtC,QAAQ,EAAE,MAAM,GACd,oBAAoB,EAAE,CAQxB;AAED,wBAAgB,+BAA+B,CAC9C,QAAQ,EAAE,MAAM,GACd,4BAA4B,EAAE,CAYhC;AAiJD,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,iBAAiB,GAAG,MAAM,CAoCtE;AAYD,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG;IACpD,WAAW,EAAE,OAAO,CAAC;IACrB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB,CA+BA;AAED,wBAAsB,WAAW,CAChC,OAAO,GAAE,kBAAuB,GAC9B,OAAO,CAAC,iBAAiB,CAAC,CAqI5B"}
+{"version":3,"file":"runner.d.ts","sourceRoot":"","sources":["../../src/guardian/runner.ts"],"names":[],"mappings":"AAgBA,OAAO,KAAK,EAEX,kBAAkB,EAClB,iBAAiB,EAGjB,MAAM,YAAY,CAAC;AAmbpB,MAAM,MAAM,oBAAoB,GAC7B,gBAAgB,GAChB,gBAAgB,GAChB,mBAAmB,GACnB,iBAAiB,GACjB,aAAa,GACb,cAAc,GACd,cAAc,GACd,gBAAgB,GAChB,YAAY,GACZ,gBAAgB,GAChB,kBAAkB,GAClB,mBAAmB,GACnB,iBAAiB,GACjB,+BAA+B,GAC/B,WAAW,CAAC;AAEf,MAAM,MAAM,4BAA4B,GACrC,iCAAiC,GACjC,mCAAmC,GACnC,uCAAuC,GACvC,wBAAwB,GACxB,gDAAgD,CAAC;AA2IpD,wBAAgB,uBAAuB,CACtC,QAAQ,EAAE,MAAM,GACd,oBAAoB,EAAE,CAQxB;AAED,wBAAgB,+BAA+B,CAC9C,QAAQ,EAAE,MAAM,GACd,4BAA4B,EAAE,CAYhC;AAiJD,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,iBAAiB,GAAG,MAAM,CAoCtE;AAYD,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG;IACpD,WAAW,EAAE,OAAO,CAAC;IACrB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB,CA+BA;AAED,wBAAsB,WAAW,CAChC,OAAO,GAAE,kBAAuB,GAC9B,OAAO,CAAC,iBAAiB,CAAC,CAqI5B"}

package/dist/guardian/runner.js

@@ -8,6 +8,45 @@ import { DEFAULT_EXCLUDES } from "./types.js";
 const GUARDIAN_DISABLE_VALUES = ["0", "false", "off", "no"];
 const GUARDIAN_ENABLE_VALUES = ["1", "true", "on"];
 const DEFAULT_TIMEOUT_MS = 10_000;
+const DEFAULT_SEMGREP_TIMEOUT_MS = 120_000;
+function spawnErrorCode(error) {
+    const code = error?.code;
+    return typeof code === "string" ? code : null;
+}
+function isSpawnTimeout(error) {
+    return (spawnErrorCode(error) === "ETIMEDOUT" ||
+        error?.message.includes("ETIMEDOUT") === true);
+}
+function exitCodeForSpawnResult(status, error, signal) {
+    if (typeof status === "number") {
+        return status;
+    }
+    if (isSpawnTimeout(error)) {
+        return 124;
+    }
+    if (error) {
+        return 2;
+    }
+    if (signal) {
+        const signalNumber = os.constants.signals[signal];
+        return typeof signalNumber === "number" ? 128 + signalNumber : 128;
+    }
+    return 1;
+}
+function appendSpawnFailureDetails(stderr, command, error, signal, timeoutMs) {
+    const details = [];
+    if (isSpawnTimeout(error)) {
+        details.push(`${command} timed out after ${timeoutMs}ms`);
+    }
+    if (error?.message) {
+        details.push(error.message);
+    }
+    if (signal) {
+        details.push(`${command} terminated by ${signal}`);
+    }
+    const uniqueDetails = Array.from(new Set(details));
+    return [stderr, ...uniqueDetails].filter((part) => part.trim()).join("\n");
+}
 function commandExists(command, cwd) {
     const result = spawnSync(command, ["--version"], {
         cwd,
@@ -26,19 +65,25 @@ function runCommand(command, args, cwd, timeoutMs = DEFAULT_TIMEOUT_MS, env) {
             maxBuffer: 8 * 1024 * 1024,
             timeout: timeoutMs,
         });
+        const errorMessage = result.error instanceof Error ? result.error.message : undefined;
+        const stderr = result.stderr && result.stderr.length > 0
+            ? result.stderr
+            : (errorMessage ?? "");
         return {
-            exitCode: result.status ?? 1,
+            exitCode: exitCodeForSpawnResult(result.status, result.error, result.signal ?? null),
             stdout: result.stdout ?? "",
-            stderr: result.stderr ?? "",
+            stderr: appendSpawnFailureDetails(stderr, command, result.error, result.signal ?? null, timeoutMs),
+            error: errorMessage,
             durationMs: Date.now() - started,
         };
     }
     catch (error) {
+        const thrownError = error instanceof Error ? error : new Error(String(error));
         return {
-            exitCode: 1,
+            exitCode: exitCodeForSpawnResult(null, thrownError, null),
             stdout: "",
-            stderr: error instanceof Error ? error.message : String(error),
-            error: error instanceof Error ? error.message : String(error),
+            stderr: thrownError.message,
+            error: thrownError.message,
             durationMs: Date.now() - started,
         };
     }
@@ -125,7 +170,7 @@ function locateSemgrep(root) {
     }
     return null;
 }
-function runSemgrep(files, root) {
+function runSemgrep(files, root, timeoutMs = DEFAULT_SEMGREP_TIMEOUT_MS) {
     const started = Date.now();
     const cmd = locateSemgrep(root);
     if (!cmd) {
@@ -159,8 +204,8 @@ function runSemgrep(files, root) {
         ...includeArgs,
         ".",
     ];
-    // Semgrep can take longer on larger workspaces; allow up to 2 minutes before timing out
-    const result = runCommand(cmd.command, args, root, 120_000, {
+    // Semgrep can take longer on larger workspaces, so honor the configured tool budget.
+    const result = runCommand(cmd.command, args, root, timeoutMs, {
         SEMGREP_SEND_METRICS: "off",
     });
     return {
@@ -710,7 +755,7 @@ export async function runGuardian(options = {}) {
         toolResults.push(runEvidenceIntegrityScan(files, scanRoot));
     }
     if (config.tools.semgrep) {
-        toolResults.push(runSemgrep(files, scanRoot));
+        toolResults.push(runSemgrep(files, scanRoot, config.toolTimeoutMs));
     }
     let fallback = null;
     if (config.tools.gitSecrets) {