@mono-agent/agent-runtime 0.15.1 → 0.15.3

package/MIGRATION.md

@@ -11,8 +11,30 @@ exports map, a five-bridge lazy registry, typed policy objects, stricter sandbox
 behavior, and revised provider-session semantics even when Pi is not your
 primary route.
 
+Migration policy: every newly introduced fail-closed validation belongs in the
+first affected version section, even when it tightens behavior without changing
+the configuration schema.
+
 ---
 
+## 0.15.2
+
+- **Tool-policy capability discovery:** built-in bridge capabilities now report
+  `tool_policy: "projected" | "allow_all_only"`. Pi, Claude SDK, and Claude Code
+  report `projected`; direct Codex and direct OpenCode report
+  `allow_all_only`. Custom structural bridges that omit the field have unknown
+  capability.
+- **Wildcard normalization:** any `allowedTools` list containing `"*"` is
+  semantically allow-all. Direct Codex, direct OpenCode, and the public legacy
+  Codex CLI export now accept forms such as `["*", "Read"]` when
+  `disallowedTools` is empty. Named-only lists, `[]`, and every non-empty
+  denylist still fail closed on those non-projecting routes. The guided Codex
+  readiness probe retains its exact no-tool contract.
+- **Telemetry compatibility:** the route-safety value
+  `tools: "exact-allow-all"` is unchanged. It now explicitly denotes the
+  effective unrestricted contract rather than requiring a literal one-element
+  `["*"]` array.
+
 ## 0.15.1
 
 - **Runtime-owned Pi interoperability:** consumers that directly import
@@ -62,6 +84,12 @@ public-surface cleanup described in this guide.
 
 ## 0.10.x
 
+- Direct Codex normal runs introduced a fail-closed tool-policy gate: omitted
+  `allowedTools` or the explicit `["*"]` sentinel was accepted with no denied
+  tools, while named-only allowlists, `[]`, and deny lists were rejected before
+  provider startup. Version 0.15.2 preserves that safety boundary while
+  normalizing every wildcard-containing allowlist to the same effective
+  allow-all meaning.
 - `ReadSkill` returns complete skill instructions by default, including content
   beyond the former 12,000-character boundary. Programmatic callers of
   `formatSkillBodyWithPathNote()` opt into truncation by passing a positive

package/README.md

@@ -650,7 +650,7 @@ Per-call options (a non-exhaustive selection):
 | `cwd` | `string` | Working directory for the agent's tools. |
 | `allowedTools` | `string[]` | Built-in tool allowlist. Default: all. |
 | `disallowedTools` | `string[]` | Block list. |
-| `mcpServers` | `Record<string, McpServerConfig>` | Configured MCP servers (stdio / sse / http). |
+| `mcpServers` | `Record<string, McpServerConfig>` | Configured MCP servers (stdio / sse / http); on direct Codex, each forwarded server authorizes its own tool calls. |
 | `sandboxPolicy` | `SandboxPolicy` | Optional fail-closed sandbox policy for built-in tools and stdio MCP process startup. |
 | `maxTurns` | `number` | Hard cap on agent turns. |
 | `outputSchema` | `JSONSchema` | Requests structured JSON on capable bridges; see “Structured output” below for bridge-specific return behavior. |
@@ -664,6 +664,16 @@ Per-call options (a non-exhaustive selection):
 | `codexAppServerCommand` | `string` | Override the Codex CLI binary. |
 | `codexAppServerArgs` | `string[]` | Override the Codex CLI arguments. |
 
+`runtimeCapabilities()` and each descriptor returned by
+`listRuntimeBridges()` expose `tool_policy`. `"projected"` means the bridge can
+project restrictive `allowedTools` / `disallowedTools`; `"allow_all_only"`
+means it accepts only an effective unrestricted policy—`allowedTools` omitted
+or containing `"*"`, with no denied tools. A wildcard dominates named entries,
+so `["*", "Read"]` is allow-all. Named-only lists, `[]`, and any denylist remain
+unsupported on the direct Codex and direct OpenCode bridges and fail before
+provider startup. Built-in bridges always report this field; omission by a
+custom structural bridge means the capability is unknown.
+
 Live input is native on the Claude SDK, Codex app-server, and Pi bridges. The
 one-shot Claude CLI and direct OpenCode bridges advertise it as unsupported so
 routers skip them when a direct runtime call requires steering.
@@ -750,6 +760,17 @@ truncation is explicitly desired; omitting it is not a separate hidden limit.
 The standard 256 KiB tool-payload guard still applies to oversized tool results.
 
 Override or extend the tool surface by passing `mcpServers` for MCP-backed tools.
+On direct Codex normal runs, each valid server that survives translation into
+the app-server config is the authorization boundary for the tools it exposes.
+The bridge accepts Codex's synthesized `mcp_tool_call` elicitation for that exact
+server without persisting an approval. Inherited or otherwise unconfigured
+server names, genuine downstream MCP elicitations, and other app-server requests
+remain fail-closed.
+
+This also applies under direct Codex `permissionMode: "plan"`: the read-only
+sandbox constrains Codex-owned filesystem and command execution, but a declared
+MCP tool can still change state managed by its server. Do not declare a server
+whose complete tool surface is not authorized for the run.
 
 ### Structured output
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mono-agent/agent-runtime",
-  "version": "0.15.1",
+  "version": "0.15.3",
   "description": "Agent runtime supporting Claude SDK/CLI, Codex, OpenCode, and Pi SDK bridges out of the box",
   "type": "module",
   "license": "GPL-3.0-only",

package/src/ai/providers/claude-cli.js

@@ -11,6 +11,10 @@ import { createStderrTail } from "../failure.js";
 import { modelWithContextWindow } from "../runtime/context-windows.js";
 import { readRuntimeBrand } from "../../agent/tools/shared/runtime-context.js";
 import { buildCapabilitiesUsed } from "../runtime/capabilities-used.js";
+import {
+  isAllowAllToolPolicy,
+  TOOL_POLICY_PROJECTED,
+} from "../runtime/tool-policy.js";
 import {
   claudeNativeAgentDefinitions,
   resolveClaudeAllowedTools,
@@ -28,13 +32,9 @@ const CLAUDE_CLI_EMPTY_TOOL_POLICY_UNSUPPORTED =
   "Claude Code CLI cannot enforce an explicit empty allowedTools list: omitting --tools would restore Claude Code's default toolset. Use a specific non-empty allowlist, a denylist, or the Claude SDK for a no-tools run.";
 
 function codexCliToolPolicyProblem(options) {
-  const allowedTools = Array.isArray(options.allowedTools) ? options.allowedTools : null;
-  const disallowedTools = Array.isArray(options.disallowedTools) ? options.disallowedTools : [];
-  const exactAllowAll = allowedTools === null
-    || (allowedTools.length === 1 && allowedTools[0] === "*");
-  return exactAllowAll && disallowedTools.length === 0
+  return isAllowAllToolPolicy(options.allowedTools, options.disallowedTools)
     ? null
-    : "Direct Codex CLI cannot enforce allowedTools/disallowedTools. Use exact allow-all ([\"*\"] with no disallowedTools) or another runtime.";
+    : "Direct Codex CLI cannot enforce allowedTools/disallowedTools. Use allow-all-only (omit allowedTools or include \"*\", with no disallowedTools) or another runtime.";
 }
 
 function codexCliCapabilityMismatchResult(options, error, codexErrorCode, start) {
@@ -86,6 +86,7 @@ const DORMANT_CLI_CAPABILITIES = {
   // The one-shot CLI bridge cannot add stdin messages after process launch.
   supports_live_input: false,
   supports_native_subagents: true,
+  tool_policy: TOOL_POLICY_PROJECTED,
 };
 
 function promptFromMessages(messages) {
@@ -465,7 +466,7 @@ export function buildCliCommand({
       args.push("--tools", cliAllowedTools.join(","));
     }
     const autoAllowed = [
-      ...(Array.isArray(cliAllowedTools) ? cliAllowedTools : []),
+      ...(!cliAllowAll && Array.isArray(cliAllowedTools) ? cliAllowedTools : []),
       ...Object.keys(mcpServers || {}).map((name) => `mcp__${name}__*`),
     ];
     if (autoAllowed.length) args.push("--allowedTools", shellList(autoAllowed));

package/src/ai/providers/codex-app.js

@@ -10,6 +10,10 @@ import { buildCapabilitiesUsed } from "../runtime/capabilities-used.js";
 import { resolveSandboxPolicy } from "../../agent/tools/shared/tool-context.js";
 import { createSessionRegistry } from "../runtime/sessions.js";
 import { createSessionLiveness } from "../runtime/session-liveness.js";
+import {
+  isAllowAllToolPolicy,
+  TOOL_POLICY_ALLOW_ALL_ONLY,
+} from "../runtime/tool-policy.js";
 
 const DEFAULT_REQUEST_TIMEOUT_MS = 30_000;
 const DEFAULT_THREAD_START_ATTEMPTS = 2;
@@ -448,6 +452,7 @@ const CODEX_APP_CAPABILITIES = {
   supports_live_input: true,
   supports_native_subagents: true,
   supports_fast_mode: true,
+  tool_policy: TOOL_POLICY_ALLOW_ALL_ONLY,
 };
 
 function promptFromMessages(messages) {
@@ -558,14 +563,9 @@ function codexToolPolicyProblem(options) {
     }
     return "Codex no-tool probe mode requires an empty tool policy, no MCP servers, and a disposable session.";
   }
-  // `undefined` retains the public runtime's documented allow-all default.
-  // Once a caller specifies a policy, require the exact wildcard contract.
-  // Extra entries can conceal a caller's mistaken belief that Codex enforces a
-  // mixed allowlist, which the app-server cannot project.
-  const effectiveAllowAll = allowedTools === null || (allowedTools.length === 1 && allowedTools[0] === "*");
-  return effectiveAllowAll && disallowedTools.length === 0
+  return isAllowAllToolPolicy(allowedTools, disallowedTools)
     ? null
-    : "Direct Codex cannot enforce allowedTools/disallowedTools. Use exact allow-all ([\"*\"] with no disallowedTools) or another runtime.";
+    : "Direct Codex cannot enforce allowedTools/disallowedTools. Use allow-all-only (omit allowedTools or include \"*\", with no disallowedTools) or another runtime.";
 }
 
 const CODEX_NO_TOOL_ACTION_ITEMS = new Set([
@@ -617,6 +617,19 @@ function codexMcpConfig(mcpServers = {}) {
   return servers;
 }
 
+function codexConfiguredMcpApprovalResponse(request, configuredMcpServerNames) {
+  const params = request?.params;
+  if (
+    request?.method !== "mcpServer/elicitation/request"
+    || params?._meta?.codex_approval_kind !== "mcp_tool_call"
+    || typeof params?.serverName !== "string"
+    || !configuredMcpServerNames.has(params.serverName)
+  ) {
+    return null;
+  }
+  return { action: "accept", content: {}, _meta: null };
+}
+
 function codexErrorMessage(error) {
   if (!error) return "Codex app-server error";
   if (typeof error === "string") return error;
@@ -1109,6 +1122,7 @@ export async function generateCodexAppResponse(systemPrompt, options = {}) {
   const makeClient = options.codexClientFactory || createCodexAppServerClient;
   const keepAlive = options.sessionKeepAlive === true;
   const noToolsProbe = options.codexNoToolsProbe === true;
+  const configuredMcpServerNames = new Set(Object.keys(codexMcpConfig(options.mcpServers)));
   // The bridge TTL is a backstop behind the host's session policy; the grace
   // keeps the host's lazy expiry firing first so eviction stays host-driven.
   const sessionTtlMs = Number.isFinite(Number(options.sessionIdleTimeoutMs))
@@ -1446,6 +1460,10 @@ export async function generateCodexAppResponse(systemPrompt, options = {}) {
       ),
       onServerRequest: (request) => {
         const method = typeof request?.method === "string" ? request.method : "unknown";
+        const approval = noToolsProbe
+          ? null
+          : codexConfiguredMcpApprovalResponse(request, configuredMcpServerNames);
+        if (approval) return approval;
         failUnsupportedServerRequest(method);
         throw new Error(`Unsupported Codex app-server request: ${method}`);
       },

package/src/ai/providers/opencode-app.js

@@ -3,6 +3,10 @@ import { estimateCost } from "../cost.js";
 import { buildCapabilitiesUsed } from "../runtime/capabilities-used.js";
 import { createApprovalManager, RISK_TIERS } from "../../agent/approval.js";
 import { resolveSandboxPolicy } from "../../agent/tools/shared/tool-context.js";
+import {
+  isAllowAllToolPolicy,
+  TOOL_POLICY_ALLOW_ALL_ONLY,
+} from "../runtime/tool-policy.js";
 import { createIsolatedOpencode } from "./opencode-server.js";
 import {
   toolUseEvent,
@@ -37,6 +41,7 @@ const OPENCODE_APP_CAPABILITIES = {
   supports_live_input: false,
   supports_native_subagents: false,
   supports_fast_mode: false,
+  tool_policy: TOOL_POLICY_ALLOW_ALL_ONLY,
 };
 
 // How long to keep draining the event stream after session.prompt resolves, in
@@ -428,13 +433,9 @@ export function mapSpawnFailureKind(err) {
 }
 
 function opencodeToolPolicyProblem(options) {
-  const allowedTools = Array.isArray(options.allowedTools) ? options.allowedTools : null;
-  const disallowedTools = Array.isArray(options.disallowedTools) ? options.disallowedTools : [];
-  const exactAllowAll = allowedTools === null
-    || (allowedTools.length === 1 && allowedTools[0] === "*");
-  return exactAllowAll && disallowedTools.length === 0
+  return isAllowAllToolPolicy(options.allowedTools, options.disallowedTools)
     ? null
-    : "Direct OpenCode cannot enforce allowedTools/disallowedTools. Use exact allow-all ([\"*\"] with no disallowedTools) or a Pi runtime (including pi:opencode-go:*).";
+    : "Direct OpenCode cannot enforce allowedTools/disallowedTools. Use allow-all-only (omit allowedTools or include \"*\", with no disallowedTools) or a Pi runtime (including pi:opencode-go:*).";
 }
 
 function opencodeCapabilityMismatchResult({

package/src/ai/runtime/capabilities.js

@@ -1,3 +1,8 @@
+import {
+  TOOL_POLICY_ALLOW_ALL_ONLY,
+  TOOL_POLICY_PROJECTED,
+} from "./tool-policy.js";
+
 export const COMMON_CAPABILITIES = {
   streaming: true,
   structured_output: true,
@@ -9,6 +14,7 @@ export const COMMON_CAPABILITIES = {
   supports_live_input: true,
   supports_native_subagents: true,
   supports_fast_mode: false,
+  tool_policy: TOOL_POLICY_PROJECTED,
 };
 
 export const RUNTIME_CAPABILITIES = {
@@ -36,6 +42,7 @@ export const RUNTIME_CAPABILITIES = {
     // when options.sessionKeepAlive is set; resumed turns reuse the thread.
     supports_session_resume: true,
     supports_fast_mode: true,
+    tool_policy: TOOL_POLICY_ALLOW_ALL_ONLY,
   },
   opencode: {
     runtime: "cli",
@@ -46,6 +53,7 @@ export const RUNTIME_CAPABILITIES = {
     supports_skills: false,
     supports_live_input: false,
     supports_native_subagents: false,
+    tool_policy: TOOL_POLICY_ALLOW_ALL_ONLY,
   },
 };
 

package/src/ai/runtime/tool-policy.js

@@ -0,0 +1,22 @@
+// @ts-check
+
+/** @type {"projected"} */
+export const TOOL_POLICY_PROJECTED = "projected";
+/** @type {"allow_all_only"} */
+export const TOOL_POLICY_ALLOW_ALL_ONLY = "allow_all_only";
+
+/**
+ * True when a tool policy is semantically unrestricted.
+ *
+ * An omitted allowlist and any allowlist containing the global `"*"` sentinel
+ * both mean allow-all. A denylist still makes the policy restrictive.
+ *
+ * @param {*} allowedTools
+ * @param {*} disallowedTools
+ * @returns {boolean}
+ */
+export function isAllowAllToolPolicy(allowedTools, disallowedTools) {
+  const allowAll = !Array.isArray(allowedTools) || allowedTools.includes("*");
+  const hasDeniedTools = Array.isArray(disallowedTools) && disallowedTools.length > 0;
+  return allowAll && !hasDeniedTools;
+}

package/src/ai/types.js

@@ -56,7 +56,12 @@
  * branch ran for a particular command.
  */
 
-/** @typedef {"mono-agent-monotonic"|"mono-agent-policy"|"provider-representable"|"exact-allow-all"|"unsupported"} RuntimeRouteToolsContract */
+/**
+ * @typedef {"mono-agent-monotonic"|"mono-agent-policy"|"provider-representable"|"exact-allow-all"|"unsupported"} RuntimeRouteToolsContract
+ * `exact-allow-all` is a stable telemetry token. It describes an effective
+ * unrestricted contract, including mixed allowlists that contain `"*"`;
+ * it does not require the literal one-element array `["*"]`.
+ */
 
 /**
  * @typedef {Object} RuntimeRouteSafetyContract
@@ -223,6 +228,10 @@
  * @property {boolean} [supports_live_input]
  * @property {boolean} [supports_native_subagents]
  * @property {boolean} [supports_fast_mode]
+ * @property {"projected"|"allow_all_only"} [tool_policy] Whether the bridge can
+ *   project named allow/deny policies or accepts only a semantically unrestricted
+ *   policy. Built-in bridges always report this field; omission means unknown
+ *   for custom structural capability objects.
  */
 
 /**

package/types/ai/backend.d.ts

@@ -0,0 +1,57 @@
+export function backendCapabilities(sdkOrModel: any): any;
+export function backendUsesExecenvConfig(sdk: any): boolean;
+export function backendSupportsSessionResume(sdk: any): boolean;
+export const BACKEND_CAPABILITIES: {
+    claude: {
+        supports_session_resume: boolean;
+        streaming: boolean;
+        structured_output: boolean;
+        native_runtime_config: any;
+        supports_mcp: boolean;
+        supports_skills: boolean;
+        supports_builtin_tools: boolean;
+        supports_live_input: boolean;
+        supports_native_subagents: boolean;
+        supports_fast_mode: boolean;
+        runtime: string;
+    };
+    pi: {
+        supports_session_resume: boolean;
+        supports_native_subagents: boolean;
+        streaming: boolean;
+        structured_output: boolean;
+        native_runtime_config: any;
+        supports_mcp: boolean;
+        supports_skills: boolean;
+        supports_builtin_tools: boolean;
+        supports_live_input: boolean;
+        supports_fast_mode: boolean;
+        runtime: string;
+    };
+    codex: {
+        supports_session_resume: boolean;
+        supports_fast_mode: boolean;
+        streaming: boolean;
+        structured_output: boolean;
+        native_runtime_config: any;
+        supports_mcp: boolean;
+        supports_skills: boolean;
+        supports_builtin_tools: boolean;
+        supports_live_input: boolean;
+        supports_native_subagents: boolean;
+        runtime: string;
+    };
+    opencode: {
+        structured_output: boolean;
+        supports_session_resume: boolean;
+        supports_mcp: boolean;
+        supports_skills: boolean;
+        supports_live_input: boolean;
+        supports_native_subagents: boolean;
+        streaming: boolean;
+        native_runtime_config: any;
+        supports_builtin_tools: boolean;
+        supports_fast_mode: boolean;
+        runtime: string;
+    };
+};

package/types/ai/providers/claude-cli.d.ts

@@ -168,6 +168,7 @@ export namespace claudeCodeRuntimeBridge {
         export let supports_builtin_tools: boolean;
         export let supports_live_input: boolean;
         export let supports_native_subagents: boolean;
+        export { TOOL_POLICY_PROJECTED as tool_policy };
         let kind_1: string;
         export { kind_1 as kind };
         export let runtime: string;
@@ -301,3 +302,4 @@ export namespace claudeCodeRuntimeBridge {
         };
     }>;
 }
+import { TOOL_POLICY_PROJECTED } from "../runtime/tool-policy.js";

package/types/ai/providers/codex-app.d.ts

@@ -145,5 +145,7 @@ declare namespace CODEX_APP_CAPABILITIES {
     export let supports_live_input: boolean;
     export let supports_native_subagents: boolean;
     export let supports_fast_mode: boolean;
+    export { TOOL_POLICY_ALLOW_ALL_ONLY as tool_policy };
 }
+import { TOOL_POLICY_ALLOW_ALL_ONLY } from "../runtime/tool-policy.js";
 export {};

package/types/ai/providers/opencode-app.d.ts

@@ -27,6 +27,7 @@ declare namespace OPENCODE_APP_CAPABILITIES {
     export let supports_live_input: boolean;
     export let supports_native_subagents: boolean;
     export let supports_fast_mode: boolean;
+    export { TOOL_POLICY_ALLOW_ALL_ONLY as tool_policy };
 }
 declare function generateOpencodeAppResponse(systemPrompt: any, options?: {}): Promise<{
     text: any;
@@ -91,4 +92,5 @@ declare function generateOpencodeAppResponse(systemPrompt: any, options?: {}): P
         context_compaction_applied: any;
     };
 }>;
+import { TOOL_POLICY_ALLOW_ALL_ONLY } from "../runtime/tool-policy.js";
 export {};

package/types/ai/registry.d.ts

@@ -0,0 +1 @@
+export { listRuntimeBridges as listProviders, resolveRuntimeBridge as findProviderForModel, runtimeCapabilities } from "./runtime/registry.js";

package/types/ai/runtime/capabilities.d.ts

@@ -1,15 +1,16 @@
 export function runtimeCapabilities(sdkOrModel: any): any;
 export namespace COMMON_CAPABILITIES {
-    let streaming: boolean;
-    let structured_output: boolean;
-    let supports_session_resume: boolean;
-    let native_runtime_config: any;
-    let supports_mcp: boolean;
-    let supports_skills: boolean;
-    let supports_builtin_tools: boolean;
-    let supports_live_input: boolean;
-    let supports_native_subagents: boolean;
-    let supports_fast_mode: boolean;
+    export let streaming: boolean;
+    export let structured_output: boolean;
+    export let supports_session_resume: boolean;
+    export let native_runtime_config: any;
+    export let supports_mcp: boolean;
+    export let supports_skills: boolean;
+    export let supports_builtin_tools: boolean;
+    export let supports_live_input: boolean;
+    export let supports_native_subagents: boolean;
+    export let supports_fast_mode: boolean;
+    export { TOOL_POLICY_PROJECTED as tool_policy };
 }
 export namespace RUNTIME_CAPABILITIES {
     namespace claude {
@@ -30,6 +31,7 @@ export namespace RUNTIME_CAPABILITIES {
         export { supports_session_resume_3 as supports_session_resume };
         let supports_fast_mode_1: boolean;
         export { supports_fast_mode_1 as supports_fast_mode };
+        export { TOOL_POLICY_ALLOW_ALL_ONLY as tool_policy };
         let runtime_2: string;
         export { runtime_2 as runtime };
     }
@@ -46,7 +48,10 @@ export namespace RUNTIME_CAPABILITIES {
         export { supports_live_input_1 as supports_live_input };
         let supports_native_subagents_2: boolean;
         export { supports_native_subagents_2 as supports_native_subagents };
+        export { TOOL_POLICY_ALLOW_ALL_ONLY as tool_policy };
         let runtime_3: string;
         export { runtime_3 as runtime };
     }
 }
+import { TOOL_POLICY_PROJECTED } from "./tool-policy.js";
+import { TOOL_POLICY_ALLOW_ALL_ONLY } from "./tool-policy.js";

package/types/ai/runtime/tool-policy.d.ts

@@ -0,0 +1,15 @@
+/**
+ * True when a tool policy is semantically unrestricted.
+ *
+ * An omitted allowlist and any allowlist containing the global `"*"` sentinel
+ * both mean allow-all. A denylist still makes the policy restrictive.
+ *
+ * @param {*} allowedTools
+ * @param {*} disallowedTools
+ * @returns {boolean}
+ */
+export function isAllowAllToolPolicy(allowedTools: any, disallowedTools: any): boolean;
+/** @type {"projected"} */
+export const TOOL_POLICY_PROJECTED: "projected";
+/** @type {"allow_all_only"} */
+export const TOOL_POLICY_ALLOW_ALL_ONLY: "allow_all_only";

package/types/ai/types.d.ts

@@ -33,7 +33,12 @@
  * explicitly permits host execution if unavailable; it does not claim which
  * branch ran for a particular command.
  */
-/** @typedef {"mono-agent-monotonic"|"mono-agent-policy"|"provider-representable"|"exact-allow-all"|"unsupported"} RuntimeRouteToolsContract */
+/**
+ * @typedef {"mono-agent-monotonic"|"mono-agent-policy"|"provider-representable"|"exact-allow-all"|"unsupported"} RuntimeRouteToolsContract
+ * `exact-allow-all` is a stable telemetry token. It describes an effective
+ * unrestricted contract, including mixed allowlists that contain `"*"`;
+ * it does not require the literal one-element array `["*"]`.
+ */
 /**
  * @typedef {Object} RuntimeRouteSafetyContract
  * Bounded, credential-free description of the sandbox/tool contract applied
@@ -191,6 +196,10 @@
  * @property {boolean} [supports_live_input]
  * @property {boolean} [supports_native_subagents]
  * @property {boolean} [supports_fast_mode]
+ * @property {"projected"|"allow_all_only"} [tool_policy] Whether the bridge can
+ *   project named allow/deny policies or accepts only a semantically unrestricted
+ *   policy. Built-in bridges always report this field; omission means unknown
+ *   for custom structural capability objects.
  */
 /**
  * @typedef {Object} RuntimeBridge
@@ -341,6 +350,11 @@ export type RuntimeRouteSafetyMode = "uniform" | "per-route-native";
  * branch ran for a particular command.
  */
 export type RuntimeRouteSandboxContract = "mono-agent-monotonic" | "disabled" | "mono-agent-srt" | "mono-agent-srt-unsafe-host-fallback" | "provider-native" | "codex-native" | "unsupported";
+/**
+ * `exact-allow-all` is a stable telemetry token. It describes an effective
+ * unrestricted contract, including mixed allowlists that contain `"*"`;
+ * it does not require the literal one-element array `["*"]`.
+ */
 export type RuntimeRouteToolsContract = "mono-agent-monotonic" | "mono-agent-policy" | "provider-representable" | "exact-allow-all" | "unsupported";
 /**
  * Bounded, credential-free description of the sandbox/tool contract applied
@@ -654,6 +668,13 @@ export type RuntimeCapabilities = {
     supports_live_input?: boolean;
     supports_native_subagents?: boolean;
     supports_fast_mode?: boolean;
+    /**
+     * Whether the bridge can
+     * project named allow/deny policies or accepts only a semantically unrestricted
+     * policy. Built-in bridges always report this field; omission means unknown
+     * for custom structural capability objects.
+     */
+    tool_policy?: "projected" | "allow_all_only";
 };
 /**
  * A fully loaded bridge (registry.js's resolveRuntimeBridge result): the