@renseiai/agentfactory 0.8.18 → 0.8.20

package/dist/src/routing/observation-store.test.js

@@ -41,10 +41,16 @@ function createInMemoryStore() {
             if (opts.since) {
                 result = result.filter((o) => o.timestamp >= opts.since);
             }
+            if (opts.from) {
+                result = result.filter((o) => o.timestamp >= opts.from);
+            }
+            if (opts.to) {
+                result = result.filter((o) => o.timestamp <= opts.to);
+            }
             if (opts.limit) {
                 result = result.slice(0, opts.limit);
             }
-            return result;
+            return { observations: result };
         },
         async getRecentObservations(provider, workType, windowSize) {
             return observations
@@ -67,8 +73,8 @@ describe('ObservationStore interface', () => {
         const obs = makeObservation();
         await store.recordObservation(obs);
         const all = await store.getObservations({});
-        expect(all).toHaveLength(1);
-        expect(all[0]).toEqual(obs);
+        expect(all.observations).toHaveLength(1);
+        expect(all.observations[0]).toEqual(obs);
     });
     it('getObservations filters by provider', async () => {
         const store = createInMemoryStore();
@@ -76,16 +82,16 @@ describe('ObservationStore interface', () => {
         await store.recordObservation(makeObservation({ provider: 'codex' }));
         await store.recordObservation(makeObservation({ provider: 'claude' }));
         const result = await store.getObservations({ provider: 'claude' });
-        expect(result).toHaveLength(2);
-        expect(result.every((o) => o.provider === 'claude')).toBe(true);
+        expect(result.observations).toHaveLength(2);
+        expect(result.observations.every((o) => o.provider === 'claude')).toBe(true);
     });
     it('getObservations filters by workType', async () => {
         const store = createInMemoryStore();
         await store.recordObservation(makeObservation({ workType: 'development' }));
         await store.recordObservation(makeObservation({ workType: 'qa' }));
         const result = await store.getObservations({ workType: 'qa' });
-        expect(result).toHaveLength(1);
-        expect(result[0].workType).toBe('qa');
+        expect(result.observations).toHaveLength(1);
+        expect(result.observations[0].workType).toBe('qa');
     });
     it('getObservations filters by since', async () => {
         const store = createInMemoryStore();
@@ -93,8 +99,8 @@ describe('ObservationStore interface', () => {
         await store.recordObservation(makeObservation({ timestamp: 2000 }));
         await store.recordObservation(makeObservation({ timestamp: 3000 }));
         const result = await store.getObservations({ since: 2000 });
-        expect(result).toHaveLength(2);
-        expect(result.every((o) => o.timestamp >= 2000)).toBe(true);
+        expect(result.observations).toHaveLength(2);
+        expect(result.observations.every((o) => o.timestamp >= 2000)).toBe(true);
     });
     it('getObservations respects limit', async () => {
         const store = createInMemoryStore();
@@ -102,7 +108,7 @@ describe('ObservationStore interface', () => {
             await store.recordObservation(makeObservation({ timestamp: i }));
         }
         const result = await store.getObservations({ limit: 3 });
-        expect(result).toHaveLength(3);
+        expect(result.observations).toHaveLength(3);
     });
     it('getRecentObservations returns newest-first for a provider+workType pair', async () => {
         const store = createInMemoryStore();
@@ -128,7 +134,7 @@ describe('ObservationStore interface', () => {
         const store = createInMemoryStore();
         await store.recordObservation(makeObservation({ provider: 'claude' }));
         const result = await store.getObservations({ provider: 'codex' });
-        expect(result).toEqual([]);
+        expect(result.observations).toEqual([]);
     });
     it('getRecentObservations returns empty array when no observations match', async () => {
         const store = createInMemoryStore();

package/dist/src/routing/types.d.ts

@@ -49,8 +49,8 @@ export declare const RoutingObservationSchema: z.ZodObject<{
     prCreated: z.ZodBoolean;
     qaResult: z.ZodEnum<{
         failed: "failed";
-        passed: "passed";
         unknown: "unknown";
+        passed: "passed";
     }>;
     totalCostUsd: z.ZodNumber;
     wallClockMs: z.ZodNumber;

package/dist/src/templates/adapters.d.ts

@@ -5,6 +5,23 @@
  */
 import type { ToolPermission, ToolPermissionAdapter } from './types.js';
 import type { AgentProviderName } from '../providers/types.js';
+/**
+ * Structured permission config consumed by the Codex approval bridge.
+ * Produced by `CodexToolPermissionAdapter.buildPermissionConfig()`.
+ */
+export interface CodexPermissionConfig {
+    /** Allowed command patterns from `tools.allow` */
+    allowedCommandPatterns: RegExp[];
+    /** Denied command patterns from `tools.disallow` (additive to safety defaults) */
+    deniedCommandPatterns: Array<{
+        pattern: RegExp;
+        reason: string;
+    }>;
+    /** Whether file edits are allowed (default: true) */
+    allowFileEdits: boolean;
+    /** Whether file writes are allowed (default: true) */
+    allowFileWrites: boolean;
+}
 /**
  * Claude Code tool permission adapter.
  *
@@ -30,6 +47,14 @@ export declare class ClaudeToolPermissionAdapter implements ToolPermissionAdapte
  */
 export declare class CodexToolPermissionAdapter implements ToolPermissionAdapter {
     translatePermissions(permissions: ToolPermission[]): string[];
+    /**
+     * Build a structured permission config for the Codex approval bridge (SUP-1748).
+     *
+     * Translates abstract `tools.allow` and `tools.disallow` from templates
+     * into regex patterns consumed by `evaluateCommandApproval()` and
+     * `evaluateFileChangeApproval()` in the approval bridge.
+     */
+    buildPermissionConfig(allow: ToolPermission[], disallow: ToolPermission[]): CodexPermissionConfig;
     private translateOne;
 }
 /**

package/dist/src/templates/adapters.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"adapters.d.ts","sourceRoot":"","sources":["../../../src/templates/adapters.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAA;AACvE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAA;AAE9D;;;;;;;GAOG;AACH,qBAAa,2BAA4B,YAAW,qBAAqB;IACvE,oBAAoB,CAAC,WAAW,EAAE,cAAc,EAAE,GAAG,MAAM,EAAE;IAI7D,OAAO,CAAC,YAAY;CAwBrB;AAED;;;;;;;;;;GAUG;AACH,qBAAa,0BAA2B,YAAW,qBAAqB;IACtE,oBAAoB,CAAC,WAAW,EAAE,cAAc,EAAE,GAAG,MAAM,EAAE;IAI7D,OAAO,CAAC,YAAY;CAWrB;AAED;;;;;;;GAOG;AACH,qBAAa,6BAA8B,YAAW,qBAAqB;IACzE,oBAAoB,CAAC,WAAW,EAAE,cAAc,EAAE,GAAG,MAAM,EAAE;IAI7D,OAAO,CAAC,YAAY;CAWrB;AAED;;GAEG;AACH,wBAAgB,2BAA2B,CAAC,QAAQ,EAAE,iBAAiB,GAAG,qBAAqB,CAa9F"}
+{"version":3,"file":"adapters.d.ts","sourceRoot":"","sources":["../../../src/templates/adapters.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAA;AACvE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAA;AAM9D;;;GAGG;AACH,MAAM,WAAW,qBAAqB;IACpC,kDAAkD;IAClD,sBAAsB,EAAE,MAAM,EAAE,CAAA;IAChC,kFAAkF;IAClF,qBAAqB,EAAE,KAAK,CAAC;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IACjE,qDAAqD;IACrD,cAAc,EAAE,OAAO,CAAA;IACvB,sDAAsD;IACtD,eAAe,EAAE,OAAO,CAAA;CACzB;AAED;;;;;;;GAOG;AACH,qBAAa,2BAA4B,YAAW,qBAAqB;IACvE,oBAAoB,CAAC,WAAW,EAAE,cAAc,EAAE,GAAG,MAAM,EAAE;IAI7D,OAAO,CAAC,YAAY;CAwBrB;AAED;;;;;;;;;;GAUG;AACH,qBAAa,0BAA2B,YAAW,qBAAqB;IACtE,oBAAoB,CAAC,WAAW,EAAE,cAAc,EAAE,GAAG,MAAM,EAAE;IAI7D;;;;;;OAMG;IACH,qBAAqB,CACnB,KAAK,EAAE,cAAc,EAAE,EACvB,QAAQ,EAAE,cAAc,EAAE,GACzB,qBAAqB;IAsCxB,OAAO,CAAC,YAAY;CAWrB;AAkCD;;;;;;;GAOG;AACH,qBAAa,6BAA8B,YAAW,qBAAqB;IACzE,oBAAoB,CAAC,WAAW,EAAE,cAAc,EAAE,GAAG,MAAM,EAAE;IAI7D,OAAO,CAAC,YAAY;CAWrB;AAED;;GAEG;AACH,wBAAgB,2BAA2B,CAAC,QAAQ,EAAE,iBAAiB,GAAG,qBAAqB,CAa9F"}

package/dist/src/templates/adapters.js

@@ -53,6 +53,49 @@ export class CodexToolPermissionAdapter {
     translatePermissions(permissions) {
         return permissions.map(p => this.translateOne(p));
     }
+    /**
+     * Build a structured permission config for the Codex approval bridge (SUP-1748).
+     *
+     * Translates abstract `tools.allow` and `tools.disallow` from templates
+     * into regex patterns consumed by `evaluateCommandApproval()` and
+     * `evaluateFileChangeApproval()` in the approval bridge.
+     */
+    buildPermissionConfig(allow, disallow) {
+        const allowedCommandPatterns = [];
+        const deniedCommandPatterns = [];
+        let allowFileEdits = true;
+        let allowFileWrites = true;
+        // Process allow list → allowed command patterns
+        for (const permission of allow) {
+            if (typeof permission !== 'string' && 'shell' in permission) {
+                allowedCommandPatterns.push(shellGlobToRegex(permission.shell));
+            }
+        }
+        // Process disallow list → denied patterns + file permission flags
+        for (const permission of disallow) {
+            if (typeof permission === 'string') {
+                if (permission === 'file-edit') {
+                    allowFileEdits = false;
+                }
+                else if (permission === 'file-write') {
+                    allowFileWrites = false;
+                }
+                // 'user-input' is a no-op for Codex (non-interactive)
+            }
+            else if ('shell' in permission) {
+                deniedCommandPatterns.push({
+                    pattern: shellGlobToRegex(permission.shell),
+                    reason: `${permission.shell} blocked by template`,
+                });
+            }
+        }
+        return {
+            allowedCommandPatterns,
+            deniedCommandPatterns,
+            allowFileEdits,
+            allowFileWrites,
+        };
+    }
     translateOne(permission) {
         if (typeof permission === 'string') {
             return permission;
@@ -63,6 +106,33 @@ export class CodexToolPermissionAdapter {
         return String(permission);
     }
 }
+/**
+ * Convert a shell glob pattern (e.g., "pnpm *", "git commit *") to a regex.
+ *
+ * The pattern "pnpm *" matches any command starting with "pnpm".
+ * The pattern "git commit *" matches "git commit" followed by anything.
+ */
+function shellGlobToRegex(glob) {
+    // Split on the last space to separate command from glob
+    const lastSpace = glob.lastIndexOf(' ');
+    if (lastSpace === -1) {
+        // No glob part — match command prefix (e.g., "pnpm" matches "pnpm install")
+        return new RegExp(`^${escapeRegex(glob)}\\b`);
+    }
+    const command = glob.substring(0, lastSpace);
+    const globPart = glob.substring(lastSpace + 1);
+    if (globPart === '*') {
+        // "git commit *" → matches "git commit" followed by anything
+        return new RegExp(`^${escapeRegex(command)}\\b`);
+    }
+    // More specific globs: escape and convert * to .*
+    const escapedCommand = escapeRegex(command);
+    const regexGlob = escapeRegex(globPart).replace(/\\\*/g, '.*');
+    return new RegExp(`^${escapedCommand}\\s+${regexGlob}`);
+}
+function escapeRegex(str) {
+    return str.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+}
 /**
  * Spring AI tool permission adapter.
  *

package/dist/src/templates/adapters.test.js

@@ -77,6 +77,55 @@ describe('CodexToolPermissionAdapter', () => {
         const result = adapter.translatePermissions([]);
         expect(result).toEqual([]);
     });
+    describe('buildPermissionConfig (SUP-1748)', () => {
+        it('builds permission config from allow and disallow lists', () => {
+            const config = adapter.buildPermissionConfig([{ shell: 'pnpm *' }, { shell: 'git commit *' }], [{ shell: 'git checkout *' }, 'user-input']);
+            expect(config.allowedCommandPatterns).toHaveLength(2);
+            expect(config.deniedCommandPatterns).toHaveLength(1);
+            expect(config.allowFileEdits).toBe(true);
+            expect(config.allowFileWrites).toBe(true);
+        });
+        it('allowed patterns match expected commands', () => {
+            const config = adapter.buildPermissionConfig([{ shell: 'pnpm *' }], []);
+            expect(config.allowedCommandPatterns[0].test('pnpm install')).toBe(true);
+            expect(config.allowedCommandPatterns[0].test('pnpm run build')).toBe(true);
+            expect(config.allowedCommandPatterns[0].test('npm install')).toBe(false);
+        });
+        it('denied patterns match expected commands', () => {
+            const config = adapter.buildPermissionConfig([], [{ shell: 'git *' }]);
+            expect(config.deniedCommandPatterns[0].pattern.test('git push')).toBe(true);
+            expect(config.deniedCommandPatterns[0].pattern.test('git commit')).toBe(true);
+            expect(config.deniedCommandPatterns[0].reason).toContain('blocked by template');
+        });
+        it('sets allowFileEdits to false when file-edit is in disallow', () => {
+            const config = adapter.buildPermissionConfig([], ['file-edit']);
+            expect(config.allowFileEdits).toBe(false);
+            expect(config.allowFileWrites).toBe(true);
+        });
+        it('sets allowFileWrites to false when file-write is in disallow', () => {
+            const config = adapter.buildPermissionConfig([], ['file-write']);
+            expect(config.allowFileEdits).toBe(true);
+            expect(config.allowFileWrites).toBe(false);
+        });
+        it('ignores user-input in disallow (non-interactive)', () => {
+            const config = adapter.buildPermissionConfig([], ['user-input']);
+            expect(config.deniedCommandPatterns).toHaveLength(0);
+            expect(config.allowFileEdits).toBe(true);
+            expect(config.allowFileWrites).toBe(true);
+        });
+        it('handles empty allow and disallow lists', () => {
+            const config = adapter.buildPermissionConfig([], []);
+            expect(config.allowedCommandPatterns).toHaveLength(0);
+            expect(config.deniedCommandPatterns).toHaveLength(0);
+            expect(config.allowFileEdits).toBe(true);
+            expect(config.allowFileWrites).toBe(true);
+        });
+        it('multi-word commands create correct regex', () => {
+            const config = adapter.buildPermissionConfig([{ shell: 'git commit *' }], []);
+            expect(config.allowedCommandPatterns[0].test('git commit -m "message"')).toBe(true);
+            expect(config.allowedCommandPatterns[0].test('git push origin main')).toBe(false);
+        });
+    });
 });
 describe('SpringAiToolPermissionAdapter', () => {
     const adapter = new SpringAiToolPermissionAdapter();

package/dist/src/templates/index.d.ts

@@ -5,9 +5,11 @@
  */
 export type { WorkflowTemplate, PartialTemplate, TemplateContext, ToolPermission, ToolPermissionAdapter, TemplateRegistryConfig, } from './types.js';
 export { WorkflowTemplateSchema, PartialTemplateSchema, TemplateContextSchema, AgentWorkTypeSchema, ToolPermissionSchema, validateWorkflowTemplate, validatePartialTemplate, } from './types.js';
-export { TemplateRegistry } from './registry.js';
+export { TemplateRegistry, type TemplateValidationResult } from './registry.js';
+export { generateTemplateSchema, extractTemplateVariables, type TemplateSchemaOptions } from './schema.js';
 export { loadTemplatesFromDir, loadTemplateFile, loadPartialsFromDir, getBuiltinDefaultsDir, getBuiltinPartialsDir, } from './loader.js';
 export { ClaudeToolPermissionAdapter, CodexToolPermissionAdapter, createToolPermissionAdapter } from './adapters.js';
+export type { CodexPermissionConfig } from './adapters.js';
 export { renderPromptWithFallback } from './renderer.js';
 export type { AgentDefinition, AgentDefinitionFrontmatter } from './agent-definition.js';
 export { parseAgentDefinition, parseAgentDefinitionFile, AgentDefinitionFrontmatterSchema } from './agent-definition.js';

package/dist/src/templates/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/templates/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,YAAY,EACV,gBAAgB,EAChB,eAAe,EACf,eAAe,EACf,cAAc,EACd,qBAAqB,EACrB,sBAAsB,GACvB,MAAM,YAAY,CAAA;AAEnB,OAAO,EACL,sBAAsB,EACtB,qBAAqB,EACrB,qBAAqB,EACrB,mBAAmB,EACnB,oBAAoB,EACpB,wBAAwB,EACxB,uBAAuB,GACxB,MAAM,YAAY,CAAA;AAEnB,OAAO,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAA;AAEhD,OAAO,EACL,oBAAoB,EACpB,gBAAgB,EAChB,mBAAmB,EACnB,qBAAqB,EACrB,qBAAqB,GACtB,MAAM,aAAa,CAAA;AAEpB,OAAO,EAAE,2BAA2B,EAAE,0BAA0B,EAAE,2BAA2B,EAAE,MAAM,eAAe,CAAA;AAEpH,OAAO,EAAE,wBAAwB,EAAE,MAAM,eAAe,CAAA;AAExD,YAAY,EAAE,eAAe,EAAE,0BAA0B,EAAE,MAAM,uBAAuB,CAAA;AACxF,OAAO,EAAE,oBAAoB,EAAE,wBAAwB,EAAE,gCAAgC,EAAE,MAAM,uBAAuB,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/templates/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,YAAY,EACV,gBAAgB,EAChB,eAAe,EACf,eAAe,EACf,cAAc,EACd,qBAAqB,EACrB,sBAAsB,GACvB,MAAM,YAAY,CAAA;AAEnB,OAAO,EACL,sBAAsB,EACtB,qBAAqB,EACrB,qBAAqB,EACrB,mBAAmB,EACnB,oBAAoB,EACpB,wBAAwB,EACxB,uBAAuB,GACxB,MAAM,YAAY,CAAA;AAEnB,OAAO,EAAE,gBAAgB,EAAE,KAAK,wBAAwB,EAAE,MAAM,eAAe,CAAA;AAE/E,OAAO,EAAE,sBAAsB,EAAE,wBAAwB,EAAE,KAAK,qBAAqB,EAAE,MAAM,aAAa,CAAA;AAE1G,OAAO,EACL,oBAAoB,EACpB,gBAAgB,EAChB,mBAAmB,EACnB,qBAAqB,EACrB,qBAAqB,GACtB,MAAM,aAAa,CAAA;AAEpB,OAAO,EAAE,2BAA2B,EAAE,0BAA0B,EAAE,2BAA2B,EAAE,MAAM,eAAe,CAAA;AACpH,YAAY,EAAE,qBAAqB,EAAE,MAAM,eAAe,CAAA;AAE1D,OAAO,EAAE,wBAAwB,EAAE,MAAM,eAAe,CAAA;AAExD,YAAY,EAAE,eAAe,EAAE,0BAA0B,EAAE,MAAM,uBAAuB,CAAA;AACxF,OAAO,EAAE,oBAAoB,EAAE,wBAAwB,EAAE,gCAAgC,EAAE,MAAM,uBAAuB,CAAA"}

package/dist/src/templates/index.js

@@ -5,6 +5,7 @@
  */
 export { WorkflowTemplateSchema, PartialTemplateSchema, TemplateContextSchema, AgentWorkTypeSchema, ToolPermissionSchema, validateWorkflowTemplate, validatePartialTemplate, } from './types.js';
 export { TemplateRegistry } from './registry.js';
+export { generateTemplateSchema, extractTemplateVariables } from './schema.js';
 export { loadTemplatesFromDir, loadTemplateFile, loadPartialsFromDir, getBuiltinDefaultsDir, getBuiltinPartialsDir, } from './loader.js';
 export { ClaudeToolPermissionAdapter, CodexToolPermissionAdapter, createToolPermissionAdapter } from './adapters.js';
 export { renderPromptWithFallback } from './renderer.js';

package/dist/src/templates/registry.d.ts

@@ -5,8 +5,10 @@
  * Supports layered resolution with built-in defaults, project overrides,
  * and inline config overrides.
  */
+import type { JSONSchema7 } from 'json-schema';
 import type { AgentWorkType } from '../orchestrator/work-types.js';
 import type { WorkflowTemplate, TemplateContext, TemplateRegistryConfig, ToolPermission, ToolPermissionAdapter } from './types.js';
+import { type TemplateSchemaOptions } from './schema.js';
 /**
  * Template Registry manages workflow templates and renders prompts.
  *
@@ -72,9 +74,38 @@ export declare class TemplateRegistry {
      * Get disallowed tools for a work type (optionally with strategy).
      */
     getDisallowedTools(workType: AgentWorkType, strategy?: string): ToolPermission[] | undefined;
+    /**
+     * Get the raw allow and disallow permission arrays for a work type (SUP-1748).
+     * Used by the orchestrator to build Codex permission configs via the adapter.
+     */
+    getRawToolPermissions(workType: AgentWorkType, strategy?: string): {
+        allow: ToolPermission[];
+        disallow: ToolPermission[];
+    };
     /**
      * Register a partial template for use in Handlebars rendering.
      */
     registerPartial(name: string, content: string): void;
+    /**
+     * Get JSON Schema 7 for a template's parameters.
+     *
+     * The schema is derived from the template's prompt by extracting
+     * Handlebars expression references and mapping them to the known
+     * TemplateContext fields. Returns null if no template is registered.
+     */
+    getSchema(templateName: string, options?: TemplateSchemaOptions): JSONSchema7 | null;
+    /**
+     * Validate a config object against a template's JSON Schema.
+     *
+     * Template expressions ({{ }}) in string values are treated as valid
+     * placeholders and are not validated against the schema type.
+     *
+     * Returns a validation result with `valid` boolean and any `errors`.
+     */
+    validateConfig(templateName: string, config: Record<string, unknown>): TemplateValidationResult;
+}
+export interface TemplateValidationResult {
+    valid: boolean;
+    errors: string[];
 }
 //# sourceMappingURL=registry.d.ts.map

package/dist/src/templates/registry.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"registry.d.ts","sourceRoot":"","sources":["../../../src/templates/registry.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAGH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,+BAA+B,CAAA;AAClE,OAAO,KAAK,EACV,gBAAgB,EAChB,eAAe,EACf,sBAAsB,EACtB,cAAc,EACd,qBAAqB,EACtB,MAAM,YAAY,CAAA;AAQnB;;;;;;GAMG;AACH,qBAAa,gBAAgB;IAC3B;;;OAGG;IACH,OAAO,CAAC,SAAS,CAAsC;IACvD,OAAO,CAAC,UAAU,CAAmB;IACrC,OAAO,CAAC,qBAAqB,CAAC,CAAuB;;IAcrD;;OAEG;IACH,MAAM,CAAC,MAAM,CAAC,MAAM,GAAE,sBAA2B,GAAG,gBAAgB;IAMpE;;;;;;OAMG;IACH,UAAU,CAAC,MAAM,GAAE,sBAA2B,GAAG,IAAI;IA4CrD;;OAEG;IACH,wBAAwB,CAAC,OAAO,EAAE,qBAAqB,GAAG,IAAI;IAI9D;;;;;;;;OAQG;IACH,WAAW,CAAC,QAAQ,EAAE,aAAa,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,gBAAgB,GAAG,SAAS;IASrF;;OAEG;IACH,WAAW,CAAC,QAAQ,EAAE,aAAa,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO;IAQhE;;OAEG;IACH,sBAAsB,IAAI,MAAM,EAAE;IAIlC;;;;OAIG;IACH,YAAY,CAAC,QAAQ,EAAE,aAAa,EAAE,OAAO,EAAE,eAAe,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI;IAkBjG;;;OAGG;IACH,kBAAkB,CAAC,QAAQ,EAAE,aAAa,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS;IAgBpF;;OAEG;IACH,kBAAkB,CAAC,QAAQ,EAAE,aAAa,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,cAAc,EAAE,GAAG,SAAS;IAK5F;;OAEG;IACH,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,IAAI;CAGrD"}
+{"version":3,"file":"registry.d.ts","sourceRoot":"","sources":["../../../src/templates/registry.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAGH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AAC9C,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,+BAA+B,CAAA;AAClE,OAAO,KAAK,EACV,gBAAgB,EAChB,eAAe,EACf,sBAAsB,EACtB,cAAc,EACd,qBAAqB,EACtB,MAAM,YAAY,CAAA;AAOnB,OAAO,EAA0B,KAAK,qBAAqB,EAAE,MAAM,aAAa,CAAA;AAEhF;;;;;;GAMG;AACH,qBAAa,gBAAgB;IAC3B;;;OAGG;IACH,OAAO,CAAC,SAAS,CAAsC;IACvD,OAAO,CAAC,UAAU,CAAmB;IACrC,OAAO,CAAC,qBAAqB,CAAC,CAAuB;;IAcrD;;OAEG;IACH,MAAM,CAAC,MAAM,CAAC,MAAM,GAAE,sBAA2B,GAAG,gBAAgB;IAMpE;;;;;;OAMG;IACH,UAAU,CAAC,MAAM,GAAE,sBAA2B,GAAG,IAAI;IA4CrD;;OAEG;IACH,wBAAwB,CAAC,OAAO,EAAE,qBAAqB,GAAG,IAAI;IAI9D;;;;;;;;OAQG;IACH,WAAW,CAAC,QAAQ,EAAE,aAAa,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,gBAAgB,GAAG,SAAS;IASrF;;OAEG;IACH,WAAW,CAAC,QAAQ,EAAE,aAAa,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO;IAQhE;;OAEG;IACH,sBAAsB,IAAI,MAAM,EAAE;IAIlC;;;;OAIG;IACH,YAAY,CAAC,QAAQ,EAAE,aAAa,EAAE,OAAO,EAAE,eAAe,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI;IAkBjG;;;OAGG;IACH,kBAAkB,CAAC,QAAQ,EAAE,aAAa,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS;IAgBpF;;OAEG;IACH,kBAAkB,CAAC,QAAQ,EAAE,aAAa,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,cAAc,EAAE,GAAG,SAAS;IAK5F;;;OAGG;IACH,qBAAqB,CAAC,QAAQ,EAAE,aAAa,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG;QACjE,KAAK,EAAE,cAAc,EAAE,CAAA;QACvB,QAAQ,EAAE,cAAc,EAAE,CAAA;KAC3B;IAQD;;OAEG;IACH,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,IAAI;IAIpD;;;;;;OAMG;IACH,SAAS,CAAC,YAAY,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,qBAAqB,GAAG,WAAW,GAAG,IAAI;IAMpF;;;;;;;OAOG;IACH,cAAc,CACZ,YAAY,EAAE,MAAM,EACpB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC9B,wBAAwB;CAS5B;AAMD,MAAM,WAAW,wBAAwB;IACvC,KAAK,EAAE,OAAO,CAAA;IACd,MAAM,EAAE,MAAM,EAAE,CAAA;CACjB"}

package/dist/src/templates/registry.js

@@ -7,6 +7,7 @@
  */
 import Handlebars from 'handlebars';
 import { loadTemplatesFromDir, loadPartialsFromDir, getBuiltinDefaultsDir, getBuiltinPartialsDir, } from './loader.js';
+import { generateTemplateSchema } from './schema.js';
 /**
  * Template Registry manages workflow templates and renders prompts.
  *
@@ -168,10 +169,100 @@ export class TemplateRegistry {
         const template = this.getTemplate(workType, strategy);
         return template?.tools?.disallow;
     }
+    /**
+     * Get the raw allow and disallow permission arrays for a work type (SUP-1748).
+     * Used by the orchestrator to build Codex permission configs via the adapter.
+     */
+    getRawToolPermissions(workType, strategy) {
+        const template = this.getTemplate(workType, strategy);
+        return {
+            allow: template?.tools?.allow ?? [],
+            disallow: template?.tools?.disallow ?? [],
+        };
+    }
     /**
      * Register a partial template for use in Handlebars rendering.
      */
     registerPartial(name, content) {
         this.handlebars.registerPartial(name, content);
     }
+    /**
+     * Get JSON Schema 7 for a template's parameters.
+     *
+     * The schema is derived from the template's prompt by extracting
+     * Handlebars expression references and mapping them to the known
+     * TemplateContext fields. Returns null if no template is registered.
+     */
+    getSchema(templateName, options) {
+        const template = this.templates.get(templateName);
+        if (!template)
+            return null;
+        return generateTemplateSchema(template, options);
+    }
+    /**
+     * Validate a config object against a template's JSON Schema.
+     *
+     * Template expressions ({{ }}) in string values are treated as valid
+     * placeholders and are not validated against the schema type.
+     *
+     * Returns a validation result with `valid` boolean and any `errors`.
+     */
+    validateConfig(templateName, config) {
+        const template = this.templates.get(templateName);
+        if (!template) {
+            return { valid: false, errors: [`Template "${templateName}" not found`] };
+        }
+        const schema = generateTemplateSchema(template);
+        return validateConfigAgainstSchema(config, schema);
+    }
+}
+/** Handlebars expression pattern: {{ ... }} */
+const TEMPLATE_EXPRESSION_RE = /^\{\{.*\}\}$/s;
+/**
+ * Validate a config object against a JSON Schema 7.
+ * Template expressions ({{ }}) are treated as valid for any field.
+ */
+function validateConfigAgainstSchema(config, schema) {
+    const errors = [];
+    const properties = schema.properties ?? {};
+    const required = schema.required ?? [];
+    // Check required fields
+    for (const field of required) {
+        if (!(field in config)) {
+            errors.push(`Missing required field: "${field}"`);
+        }
+    }
+    // Type-check provided fields
+    for (const [key, value] of Object.entries(config)) {
+        const fieldSchema = properties[key];
+        if (!fieldSchema || typeof fieldSchema === 'boolean')
+            continue;
+        // Template expressions are always valid
+        if (typeof value === 'string' && TEMPLATE_EXPRESSION_RE.test(value.trim())) {
+            continue;
+        }
+        const typeError = checkType(key, value, fieldSchema);
+        if (typeError)
+            errors.push(typeError);
+    }
+    return { valid: errors.length === 0, errors };
+}
+function checkType(key, value, schema) {
+    const schemaType = schema.type;
+    if (!schemaType)
+        return null;
+    // Normalize to array of type strings
+    const types = Array.isArray(schemaType) ? schemaType : [schemaType];
+    const valueType = Array.isArray(value) ? 'array' : typeof value;
+    // null is a valid JSON Schema type
+    if (value === null && types.includes('null'))
+        return null;
+    if (value === null)
+        return `Field "${key}" is null but expected ${types.join(' | ')}`;
+    // 'integer' matches typeof 'number' in JS
+    const effectiveTypes = types.map(t => t === 'integer' ? 'number' : t);
+    if (!effectiveTypes.includes(valueType)) {
+        return `Field "${key}" has type "${valueType}" but expected ${types.join(' | ')}`;
+    }
+    return null;
 }

package/dist/src/templates/schema.d.ts

@@ -0,0 +1,31 @@
+/**
+ * Template JSON Schema Generation
+ *
+ * Generates JSON Schema 7 definitions from WorkflowTemplate objects.
+ * Schema is derived from TemplateContext fields referenced in the template's
+ * prompt via Handlebars expressions.
+ *
+ * @see SUP-1758
+ */
+import type { JSONSchema7 } from 'json-schema';
+import type { WorkflowTemplate } from './types.js';
+export interface TemplateSchemaOptions {
+    /** Include all TemplateContext fields, not just those referenced in the prompt */
+    includeAllFields?: boolean;
+}
+/**
+ * Extract Handlebars variable references from a template prompt.
+ * Matches {{ varName }}, {{ varName.property }}, and handles
+ * conditionals like {{#if varName}} and {{#unless varName}}.
+ *
+ * Returns the set of top-level variable names referenced.
+ */
+export declare function extractTemplateVariables(prompt: string): Set<string>;
+/**
+ * Generate a JSON Schema 7 definition for a WorkflowTemplate's parameters.
+ *
+ * By default, only includes fields that are referenced in the template's
+ * prompt. Set `includeAllFields: true` to include all known TemplateContext fields.
+ */
+export declare function generateTemplateSchema(template: WorkflowTemplate, options?: TemplateSchemaOptions): JSONSchema7;
+//# sourceMappingURL=schema.d.ts.map

package/dist/src/templates/schema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../src/templates/schema.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAyB,MAAM,aAAa,CAAA;AACrE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAA;AAMlD,MAAM,WAAW,qBAAqB;IACpC,kFAAkF;IAClF,gBAAgB,CAAC,EAAE,OAAO,CAAA;CAC3B;AA4DD;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,CA2BpE;AAMD;;;;;GAKG;AACH,wBAAgB,sBAAsB,CACpC,QAAQ,EAAE,gBAAgB,EAC1B,OAAO,CAAC,EAAE,qBAAqB,GAC9B,WAAW,CAqCb"}

package/dist/src/templates/schema.js

@@ -0,0 +1,139 @@
+/**
+ * Template JSON Schema Generation
+ *
+ * Generates JSON Schema 7 definitions from WorkflowTemplate objects.
+ * Schema is derived from TemplateContext fields referenced in the template's
+ * prompt via Handlebars expressions.
+ *
+ * @see SUP-1758
+ */
+// ---------------------------------------------------------------------------
+// Known TemplateContext field definitions
+// ---------------------------------------------------------------------------
+/**
+ * Maps TemplateContext field names to their JSON Schema 7 definitions.
+ * This is the source of truth for schema generation.
+ */
+const CONTEXT_FIELD_SCHEMAS = {
+    identifier: { type: 'string', description: 'Issue identifier, e.g., "SUP-123"' },
+    mentionContext: { type: 'string', description: 'Optional user mention text providing additional context' },
+    startStatus: { type: 'string', description: 'Status to show when agent starts, e.g., "Started"' },
+    completeStatus: { type: 'string', description: 'Status to show when agent completes, e.g., "Finished"' },
+    parentContext: { type: 'string', description: 'Pre-built enriched prompt for parent issues with sub-issues' },
+    subIssueList: { type: 'string', description: 'Formatted list of sub-issues with statuses' },
+    cycleCount: { type: 'integer', description: 'Current escalation cycle count' },
+    strategy: { type: 'string', description: 'Current escalation strategy' },
+    failureSummary: { type: 'string', description: 'Accumulated failure summary across cycles' },
+    attemptNumber: { type: 'integer', description: 'Attempt number within current phase' },
+    previousFailureReasons: {
+        type: 'array',
+        items: { type: 'string' },
+        description: 'List of previous failure reasons',
+    },
+    totalCostUsd: { type: 'number', description: 'Total cost in USD across all attempts' },
+    blockerIdentifier: { type: 'string', description: 'Blocker issue identifier' },
+    team: { type: 'string', description: 'Team name' },
+    repository: { type: 'string', description: 'Git repository URL pattern' },
+    projectPath: { type: 'string', description: 'Root directory for this project within the repo' },
+    sharedPaths: {
+        type: 'array',
+        items: { type: 'string' },
+        description: 'Shared directories that any project agent may modify',
+    },
+    useToolPlugins: { type: 'boolean', description: 'When true, agents use in-process tools instead of CLI' },
+    linearCli: { type: 'string', description: 'Command to invoke the Linear CLI (default: "pnpm af-linear")' },
+    packageManager: { type: 'string', description: 'Package manager used by the project (default: "pnpm")' },
+    buildCommand: { type: 'string', description: 'Build command override' },
+    testCommand: { type: 'string', description: 'Test command override' },
+    validateCommand: { type: 'string', description: 'Validation command override' },
+    phaseOutputs: {
+        type: 'object',
+        additionalProperties: {
+            type: 'object',
+            additionalProperties: true,
+        },
+        description: 'Collected outputs from upstream phases',
+    },
+    agentBugBacklog: { type: 'string', description: 'Linear project name for agent-improvement issues' },
+};
+/** Fields that are always required in a template config */
+const ALWAYS_REQUIRED = ['identifier'];
+// ---------------------------------------------------------------------------
+// Handlebars expression extraction
+// ---------------------------------------------------------------------------
+/**
+ * Extract Handlebars variable references from a template prompt.
+ * Matches {{ varName }}, {{ varName.property }}, and handles
+ * conditionals like {{#if varName}} and {{#unless varName}}.
+ *
+ * Returns the set of top-level variable names referenced.
+ */
+export function extractTemplateVariables(prompt) {
+    const vars = new Set();
+    // Match {{ expr }}, {{#if expr}}, {{#unless expr}}, {{> partial}}, etc.
+    const patterns = [
+        /\{\{\s*([a-zA-Z_][a-zA-Z0-9_.]*)\s*\}\}/g, // {{ varName }} or {{ var.prop }}
+        /\{\{#(?:if|unless)\s+([a-zA-Z_][a-zA-Z0-9_.]*)/g, // {{#if varName}}
+        /\{\{#(?:each)\s+([a-zA-Z_][a-zA-Z0-9_.]*)/g, // {{#each varName}}
+        /\{\{#(?:with)\s+([a-zA-Z_][a-zA-Z0-9_.]*)/g, // {{#with varName}}
+        /\{\{\s*(?:eq|neq)\s+([a-zA-Z_][a-zA-Z0-9_.]*)/g, // {{ eq varName "value" }}
+        /\((?:eq|neq)\s+([a-zA-Z_][a-zA-Z0-9_.]*)/g, // (eq varName "value") — subexpression
+    ];
+    for (const pattern of patterns) {
+        let match;
+        while ((match = pattern.exec(prompt)) !== null) {
+            const varName = match[1];
+            // Extract the top-level variable name (before any dot)
+            const topLevel = varName.split('.')[0];
+            // Skip Handlebars built-ins and partials
+            if (topLevel !== 'this' && topLevel !== 'else') {
+                vars.add(topLevel);
+            }
+        }
+    }
+    return vars;
+}
+// ---------------------------------------------------------------------------
+// Schema generation
+// ---------------------------------------------------------------------------
+/**
+ * Generate a JSON Schema 7 definition for a WorkflowTemplate's parameters.
+ *
+ * By default, only includes fields that are referenced in the template's
+ * prompt. Set `includeAllFields: true` to include all known TemplateContext fields.
+ */
+export function generateTemplateSchema(template, options) {
+    const includeAll = options?.includeAllFields ?? false;
+    const properties = {};
+    const required = [];
+    if (includeAll) {
+        // Include all known fields
+        for (const [field, schemaDef] of Object.entries(CONTEXT_FIELD_SCHEMAS)) {
+            properties[field] = schemaDef;
+        }
+    }
+    else {
+        // Only include fields referenced in the template prompt
+        const referencedVars = extractTemplateVariables(template.prompt);
+        for (const varName of referencedVars) {
+            if (varName in CONTEXT_FIELD_SCHEMAS) {
+                properties[varName] = CONTEXT_FIELD_SCHEMAS[varName];
+            }
+        }
+    }
+    // Always include 'identifier' as required
+    for (const field of ALWAYS_REQUIRED) {
+        if (field in properties && !required.includes(field)) {
+            required.push(field);
+        }
+    }
+    return {
+        $schema: 'http://json-schema.org/draft-07/schema#',
+        type: 'object',
+        title: `${template.metadata.name} config`,
+        description: template.metadata.description ?? `Configuration schema for ${template.metadata.name} template`,
+        properties,
+        required: required.length > 0 ? required : undefined,
+        additionalProperties: true,
+    };
+}

package/dist/src/templates/schema.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=schema.test.d.ts.map

package/dist/src/templates/schema.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.test.d.ts","sourceRoot":"","sources":["../../../src/templates/schema.test.ts"],"names":[],"mappings":""}