npm - agent-tower - Versions diffs - 0.7.1-beta.3 → 0.7.1 - Mend

agent-tower 0.7.1-beta.3 → 0.7.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (373) hide show

package/dist/pipeline/agent-pipeline.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"agent-pipeline.js","sourceRoot":"","sources":["../../src/pipeline/agent-pipeline.ts"],"names":[],"mappings":"~~AAIA~~,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAStD;;GAEG;AACH,MAAM,OAAO,aAAa;~~IAaL~~;IACA;IACA;IACA;IACA;~~IAhBX~~,SAAS,GAAG,KAAK,CAAC;IAClB,cAAc,GAAG,KAAK,CAAC;IACvB,OAAO,CAAuB;IAC9B,OAAO,CAAuB;IAC9B,QAAQ,CAAc;IACtB,YAAY,CAAc;IAC1B,gBAAgB,CAAc;IAC9B,aAAa,CAAc;IAC3B,wBAAwB,GAAG,KAAK,CAAC;IACjC,qBAAqB,GAAG,KAAK,CAAC;IAC9B,aAAa,GAAG,KAAK,CAAC;~~IAC9B~~,YACmB,SAAiB,EACjB,GAAS,EACT,MAA2B,EAC3B,QAAkB,EAClB,QAAkB,EACnC,WAA6B;~~QALZ~~,cAAS,GAAT,SAAS,CAAQ;QACjB,QAAG,GAAH,GAAG,CAAM;QACT,WAAM,GAAN,MAAM,CAAqB;QAC3B,aAAQ,GAAR,QAAQ,CAAU;QAClB,aAAQ,GAAR,QAAQ,CAAU;~~QAGnC~~,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;YACnD,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,eAAe,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;QACjF,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,cAAc,EAAE,EAAE;YAC/D,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,mBAAmB,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,cAAc,EAAE,CAAC,CAAC;QACzF,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,gBAAgB,GAAG,IAAI,CAAC,MAAM,EAAE,eAAe,EAAE,CAAC,GAAG,EAAE;YAC1D,IAAI,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,wBAAwB,IAAI,IAAI,CAAC,qBAAqB;gBAAE,OAAO;YAC1F,IAAI,CAAC,wBAAwB,GAAG,IAAI,CAAC;YACrC,IAAI,CAAC,iBAAiB,EAAE,CAAC;YACzB,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,wBAAwB,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;QAC9E,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC,MAAM,EAAE,YAAY,EAAE,CAAC,GAAG,EAAE;YACpD,IAAI,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,wBAAwB,IAAI,IAAI,CAAC,qBAAqB;gBAAE,OAAO;YAC1F,IAAI,CAAC,qBAAqB,GAAG,IAAI,CAAC;YAClC,IAAI,CAAC,iBAAiB,EAAE,CAAC;YACzB,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,qBAAqB,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;QAC3E,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,~~MAAM~~,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;QAChE,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC;QAE5E,sEAAsE;QACtE,wEAAwE;QACxE,uEAAuE;QACvE,yDAAyD;QACzD,IAAI,WAAW,EAAE,CAAC;YAChB,KAAK,MAAM,KAAK,IAAI,WAAW,EAAE,CAAC;gBAChC,IAAI,IAAI,CAAC,SAAS;oBAAE,MAAM;gBAC1B,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;oBAC1B,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;gBAC9B,CAAC;qBAAM,CAAC;oBACN,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;gBAClC,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAEO,UAAU,CAAC,IAAY;QAC7B,IAAI,IAAI,CAAC,SAAS;YAAE,OAAO;QAC3B,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;~~QAC~~/B,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,gBAAgB,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;~~QAC1E~~,IAAI,CAAC;YACH,IAAI,CAAC,MAAM,EAAE,WAAW,CAAC,IAAI,CAAC,CAAC;QACjC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,uEAAuE;YACvE,uEAAuE;YACvE,kEAAkE;YAClE,aAAa,CAAC;gBACZ,KAAK,EAAE,OAAO;gBACd,MAAM,EAAE,kCAAkC;gBAC1C,OAAO,EAAE,0CAA0C,IAAI,CAAC,SAAS,SAAS;gBAC1E,KAAK;gBACL,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE;aACxC,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAEO,UAAU,CAAC,QAAgB;QACjC,IAAI,IAAI,CAAC,SAAS;YAAE,OAAO;QAC3B,kEAAkE;QAClE,oEAAoE;QACpE,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;QAC5B,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzB,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,cAAc,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,QAAQ,EAAE,CAAC,CAAC;QAC5E,gFAAgF;QAChF,6EAA6E;QAC7E,yEAAyE;QACzE,IAAI,CAAC,OAAO,EAAE,CAAC;IACjB,CAAC;IAED;;;;OAIG;IACK,YAAY,CAAC,QAAiB;QACpC,IAAI,IAAI,CAAC,cAAc;YAAE,OAAO;QAChC,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC;QAC3B,IAAI,CAAC;YACH,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;QAChC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,aAAa,CAAC;gBACZ,KAAK,EAAE,OAAO;gBACd,MAAM,EAAE,6BAA6B;gBACrC,OAAO,EAAE,yCAAyC,IAAI,CAAC,SAAS,EAAE;gBAClE,KAAK;gBACL,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,QAAQ,EAAE;aAClD,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAEO,iBAAiB;QACvB,IAAI,IAAI,CAAC,aAAa;YAAE,OAAO;QAC/B,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC;QAC1B,IAAI,CAAC,QAAQ,CAAC,YAAY,EAAE,CAAC;IAC/B,CAAC;IAED,IAAI,OAAO;QACT,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC;IACzB,CAAC;IAED,KAAK,CAAC,IAAY;QAChB,IAAI,IAAI,CAAC,SAAS;YAAE,OAAO;QAC3B,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACvB,CAAC;IAED,MAAM,CAAC,IAAY,EAAE,IAAY;QAC/B,IAAI,IAAI,CAAC,SAAS;YAAE,OAAO;QAC3B,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAC9B,CAAC;IAED,OAAO;QACL,IAAI,IAAI,CAAC,SAAS;YAAE,OAAO;QAC3B,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC;QACtB,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,CAAC;QACxB,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,CAAC;QACxB,wEAAwE;QACxE,sEAAsE;QACtE,0EAA0E;QAC1E,IAAI,CAAC,YAAY,EAAE,CAAC;QACpB,IAAI,CAAC,QAAQ,EAAE,EAAE,CAAC;QAClB,IAAI,CAAC,YAAY,EAAE,EAAE,CAAC;QACtB,IAAI,CAAC,gBAAgB,EAAE,EAAE,CAAC;QAC1B,IAAI,CAAC,aAAa,EAAE,EAAE,CAAC;QACvB,IAAI,CAAC;YACH,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;QAClB,CAAC;QAAC,MAAM,CAAC;YACP,kDAAkD;QACpD,CAAC;IACH,CAAC;CACF"}
1	+ {"version":3,"file":"agent-pipeline.js","sourceRoot":"","sources":["../../src/pipeline/agent-pipeline.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAStD;;GAEG;AACH,MAAM,OAAO,aAAa;IAgBL;IACA;IACA;IACA;IACA;IAEA;IArBX,SAAS,GAAG,KAAK,CAAC;IAClB,cAAc,GAAG,KAAK,CAAC;IACvB,OAAO,CAAuB;IAC9B,OAAO,CAAuB;IAC9B,QAAQ,CAAc;IACtB,YAAY,CAAc;IAC1B,gBAAgB,CAAc;IAC9B,aAAa,CAAc;IAC3B,wBAAwB,GAAG,KAAK,CAAC;IACjC,qBAAqB,GAAG,KAAK,CAAC;IAC9B,aAAa,GAAG,KAAK,CAAC;IACtB,WAAW,GAAG,KAAK,CAAC;IACpB,eAAe,CAAU;IACzB,cAAc,CAAkB;IACxC,YACmB,SAAiB,EACjB,GAAS,EACT,MAA2B,EAC3B,QAAkB,EAClB,QAAkB,EACnC,WAA6B,EACZ,MAAoB,EACrC,aAA+C;QAP9B,cAAS,GAAT,SAAS,CAAQ;QACjB,QAAG,GAAH,GAAG,CAAM;QACT,WAAM,GAAN,MAAM,CAAqB;QAC3B,aAAQ,GAAR,QAAQ,CAAU;QAClB,aAAQ,GAAR,QAAQ,CAAU;QAElB,WAAM,GAAN,MAAM,CAAc;QAGrC,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;YACnD,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,eAAe,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;QACjF,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,cAAc,EAAE,EAAE;YAC/D,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,mBAAmB,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,cAAc,EAAE,CAAC,CAAC;QACzF,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,gBAAgB,GAAG,IAAI,CAAC,MAAM,EAAE,eAAe,EAAE,CAAC,GAAG,EAAE;YAC1D,IAAI,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,wBAAwB,IAAI,IAAI,CAAC,qBAAqB;gBAAE,OAAO;YAC1F,IAAI,CAAC,wBAAwB,GAAG,IAAI,CAAC;YACrC,IAAI,CAAC,iBAAiB,EAAE,CAAC;YACzB,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,wBAAwB,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;QAC9E,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC,MAAM,EAAE,YAAY,EAAE,CAAC,GAAG,EAAE;YACpD,IAAI,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,wBAAwB,IAAI,IAAI,CAAC,qBAAqB;gBAAE,OAAO;YAC1F,IAAI,CAAC,qBAAqB,GAAG,IAAI,CAAC;YAClC,IAAI,CAAC,iBAAiB,EAAE,CAAC;YACzB,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,qBAAqB,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;QAC3E,CAAC,CAAC,CAAC;QAEH,IAAI,MAAM,EAAE,CAAC;YACX,IAAI,CAAC,OAAO,GAAG,EAAE,OAAO,EAAE,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE;oBACjD,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ;wBAAE,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;yBACpD,CAAC;wBACJ,IAAI,KAAK,CAAC,IAAI,KAAK,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,cAAc;4BAAE,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC;wBACnF,IAAI,KAAK,CAAC,IAAI,KAAK,KAAK;4BAAE,IAAI,CAAC,YAAY,EAAE,CAAC;wBAC9C,aAAa,EAAE,CAAC,KAAK,CAAC,CAAC;wBACvB,IAAI,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,eAAe,KAAK,SAAS;4BAAE,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;oBACpG,CAAC;gBACH,CAAC,CAAC,EAAE,CAAC;QACP,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;QAChE,CAAC;QACD,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC;QAE5E,sEAAsE;QACtE,wEAAwE;QACxE,uEAAuE;QACvE,yDAAyD;QACzD,IAAI,WAAW,EAAE,CAAC;YAChB,KAAK,MAAM,KAAK,IAAI,WAAW,EAAE,CAAC;gBAChC,IAAI,IAAI,CAAC,SAAS;oBAAE,MAAM;gBAC1B,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;oBAC1B,IAAI,MAAM;wBAAE,SAAS;oBACrB,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;gBAC9B,CAAC;qBAAM,CAAC;oBACN,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;gBAClC,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAEO,UAAU,CAAC,IAAY;QAC7B,IAAI,IAAI,CAAC,SAAS;YAAE,OAAO;QAC3B,oFAAoF;QACpF,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;YACjB,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;YAC/B,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,gBAAgB,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC5E,CAAC;QACD,IAAI,CAAC;YACH,IAAI,CAAC,MAAM,EAAE,WAAW,CAAC,IAAI,CAAC,CAAC;QACjC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,uEAAuE;YACvE,uEAAuE;YACvE,kEAAkE;YAClE,aAAa,CAAC;gBACZ,KAAK,EAAE,OAAO;gBACd,MAAM,EAAE,kCAAkC;gBAC1C,OAAO,EAAE,0CAA0C,IAAI,CAAC,SAAS,SAAS;gBAC1E,KAAK;gBACL,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE;aACxC,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAEO,UAAU,CAAC,QAAgB;QACjC,IAAI,IAAI,CAAC,SAAS;YAAE,OAAO;QAC3B,2EAA2E;QAC3E,0EAA0E;QAC1E,IAAI,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;YACrC,IAAI,CAAC,eAAe,GAAG,QAAQ,CAAC;YAChC,IAAI,CAAC,cAAc,KAAK,UAAU,CAAC,GAAG,EAAE;gBACtC,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,qDAAqD;YAC7E,CAAC,EAAE,MAAM,CAAC,CAAC;YACX,OAAO;QACT,CAAC;QACD,kEAAkE;QAClE,oEAAoE;QACpE,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;QAC5B,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzB,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,cAAc,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,QAAQ,EAAE,CAAC,CAAC;QAC5E,gFAAgF;QAChF,6EAA6E;QAC7E,yEAAyE;QACzE,IAAI,CAAC,OAAO,EAAE,CAAC;IACjB,CAAC;IAED;;;;OAIG;IACK,YAAY,CAAC,QAAiB;QACpC,IAAI,IAAI,CAAC,cAAc;YAAE,OAAO;QAChC,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC;QAC3B,IAAI,CAAC;YACH,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;QAChC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,aAAa,CAAC;gBACZ,KAAK,EAAE,OAAO;gBACd,MAAM,EAAE,6BAA6B;gBACrC,OAAO,EAAE,yCAAyC,IAAI,CAAC,SAAS,EAAE;gBAClE,KAAK;gBACL,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,QAAQ,EAAE;aAClD,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAEO,iBAAiB;QACvB,IAAI,IAAI,CAAC,aAAa;YAAE,OAAO;QAC/B,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC;QAC1B,IAAI,CAAC,QAAQ,CAAC,YAAY,EAAE,CAAC;IAC/B,CAAC;IAED,IAAI,OAAO;QACT,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC;IACzB,CAAC;IAED,KAAK,CAAC,IAAY;QAChB,IAAI,IAAI,CAAC,SAAS;YAAE,OAAO;QAC3B,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACvB,CAAC;IAED,MAAM,CAAC,IAAY,EAAE,IAAY;QAC/B,IAAI,IAAI,CAAC,SAAS;YAAE,OAAO;QAC3B,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAC9B,CAAC;IAED,OAAO;QACL,IAAI,IAAI,CAAC,SAAS;YAAE,OAAO;QAC3B,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC;QACtB,IAAI,IAAI,CAAC,cAAc;YAAE,YAAY,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QAC3D,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,CAAC;QACxB,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,CAAC;QACxB,wEAAwE;QACxE,sEAAsE;QACtE,0EAA0E;QAC1E,IAAI,CAAC,YAAY,EAAE,CAAC;QACpB,IAAI,CAAC,QAAQ,EAAE,EAAE,CAAC;QAClB,IAAI,CAAC,YAAY,EAAE,EAAE,CAAC;QACtB,IAAI,CAAC,gBAAgB,EAAE,EAAE,CAAC;QAC1B,IAAI,CAAC,aAAa,EAAE,EAAE,CAAC;QACvB,IAAI,CAAC;YACH,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;QAClB,CAAC;QAAC,MAAM,CAAC;YACP,kDAAkD;QACpD,CAAC;IACH,CAAC;CACF"}

package/dist/routes/__tests__/providers.test.js CHANGED Viewed

@@ -3,10 +3,14 @@ import * as fs from 'node:fs';
 import * as os from 'node:os';
 import * as path from 'node:path';
 import { createServer } from 'node:http';
-import { afterEach, beforeEach, describe, expect, it } from 'vitest';
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
 import { AgentType, CODEX_NATIVE_MODEL_PROVIDER_IDS, RuntimeType, } from '@agent-tower/shared';
 import { providerRoutes } from '../providers.js';
 import { getAllProviders, getProviderById, reloadProviders } from '../../executors/providers.js';
+import { resetCodexModelCatalogForTests } from '../../services/codex-model-capabilities.service.js';
+import { ExecutionPermissionService } from '../../services/execution-permission.service.js';
+import * as claudeCapabilities from '../../services/claude-cli-capabilities.service.js';
+import * as codexCapabilities from '../../services/codex-cli-capabilities.service.js';
 import { AGENT_SUBPROCESS_BLOCKED_ENV_KEYS, AGENT_TOWER_MCP_IDENTITY_ENV_KEYS, AGENT_TOWER_MCP_SERVICE_ENV_KEYS, } from '../../executors/execution-env.js';
 const originalDataDir = process.env.AGENT_TOWER_DATA_DIR;
 const originalPath = process.env.PATH;
@@ -54,6 +58,189 @@ async function startLoopback(handler) {
     };
 }
 describe('provider routes', () => {
+    it('resolves the current draft and lets an ASK-only deployment repair an imported invalid ASK Provider', async () => {
+        const nativeSupport = claudeCapabilities.cachedClaudeCliAskSupport;
+        // Host-build verification is covered separately; retain the real override check.
+        const refresh = vi.spyOn(claudeCapabilities, 'refreshClaudeCliAskSupport').mockResolvedValue({ supported: true });
+        const support = vi.spyOn(claudeCapabilities, 'cachedClaudeCliAskSupport').mockImplementation(provider => {
+            const actual = nativeSupport(provider);
+            return actual.message?.startsWith('Claude router,') ? actual : { supported: true };
+        });
+        const app = Fastify();
+        await app.register(providerRoutes, { prefix: '/api', executionPermissions: new ExecutionPermissionService({ getAllowedModes: () => ['ASK'] }) });
+        const providerId = 'imported-claude-router';
+        const secret = 'private-capability-sentinel';
+        try {
+            const imported = await app.inject({ method: 'POST', url: '/api/providers/import', payload: {
+                    version: 2, kind: 'provider-backup', mode: 'full', exportedAt: new Date().toISOString(),
+                    providers: [{ id: providerId, name: 'Imported ASK', agentType: AgentType.CLAUDE_CODE, runtimeType: RuntimeType.CLI, executionPermission: 'ASK', config: { claudeCodeRouter: true }, env: { ANTHROPIC_API_KEY: secret } }],
+                } });
+            expect(imported.statusCode).toBe(200);
+            const ask = (response) => response.json().CLAUDE_CODE.executionPermissionOptions.CLI.find((option) => option.mode === 'ASK');
+            const saved = await app.inject({ method: 'GET', url: `/api/providers/capabilities?providerId=${providerId}` });
+            expect(ask(saved).selectable).toBe(false);
+            for (const config of [{}, { claudeCodeRouter: true }, { cmd: { baseCommandOverride: 'wrapper' } }, { cmd: { additionalParams: ['--extra'] } }, {}]) {
+                const response = await app.inject({ method: 'POST', url: '/api/providers/capabilities', payload: { providerId, agentType: AgentType.CLAUDE_CODE, runtimeType: RuntimeType.CLI, config } });
+                expect(response.statusCode).toBe(200);
+                expect(ask(response)).toMatchObject({ selectable: Object.keys(config).length === 0, authorized: true });
+                expect(response.json().CLAUDE_CODE.executionPermissionOptions.CLI.find((option) => option.mode === 'FULL_ACCESS')).toMatchObject({ authorized: false, selectable: false });
+                expect(response.body).not.toContain(secret);
+                expect(response.json().CLAUDE_CODE).not.toHaveProperty('env');
+                expect(response.json().CLAUDE_CODE).not.toHaveProperty('config');
+                expect(response.json().CLAUDE_CODE).not.toHaveProperty('settings');
+            }
+            // Capability resolution is read-only; persisted invalid state remains until save.
+            expect(ask(await app.inject({ method: 'GET', url: `/api/providers/capabilities?providerId=${providerId}` })).selectable).toBe(false);
+            const fixed = await app.inject({ method: 'PUT', url: `/api/providers/${providerId}`, payload: { config: {}, executionPermission: 'ASK' } });
+            expect(fixed.statusCode).toBe(200);
+            expect(fixed.json().executionPermission).toBe('ASK');
+            const rejected = await app.inject({ method: 'PUT', url: `/api/providers/${providerId}`, payload: { config: { cmd: { baseCommandOverride: 'wrapper' } }, executionPermission: 'ASK' } });
+            expect(rejected.statusCode).toBe(400);
+            expect(rejected.json().diagnostics).toEqual(expect.arrayContaining([expect.objectContaining({ code: 'CAPABILITY_UNVERIFIED' })]));
+        }
+        finally {
+            await app.close();
+            refresh.mockRestore();
+            support.mockRestore();
+        }
+    });
+    it('uses the injected allowed-mode policy for capability UI, save and test', async () => {
+        const app = Fastify();
+        const executionPermissions = new ExecutionPermissionService({ getAllowedModes: () => ['ASK', 'AUTO_SANDBOX'] });
+        await app.register(providerRoutes, { prefix: '/api', executionPermissions });
+        const capabilities = (await app.inject({ method: 'GET', url: '/api/providers/capabilities' })).json();
+        expect(capabilities.CODEX.executionPermissionOptions.ACP).toEqual(expect.arrayContaining([
+            expect.objectContaining({ mode: 'FULL_ACCESS', supported: true, authorized: false, selectable: false }),
+        ]));
+        expect(capabilities.PI_CODING_AGENT.executionPermissionOptions.ACP.every((option) => !option.selectable)).toBe(true);
+        for (const url of ['/api/providers', '/api/providers/test']) {
+            const response = await app.inject({ method: 'POST', url, payload: {
+                    name: 'Restricted', agentType: AgentType.CODEX, runtimeType: RuntimeType.ACP, executionPermission: 'FULL_ACCESS',
+                } });
+            expect(response.statusCode).toBe(403);
+            expect(response.json().diagnostics).toEqual(expect.arrayContaining([expect.objectContaining({ code: 'POLICY_MODE_DENIED' })]));
+        }
+        await app.close();
+    });
+    it('keeps the deployment boundary for Codex CLI auto-review across draft models', async () => {
+        const refresh = vi.spyOn(codexCapabilities, 'refreshCodexCliSupport').mockResolvedValue({ supported: true });
+        const support = vi.spyOn(codexCapabilities, 'cachedCodexCliSupport').mockReturnValue({ supported: true });
+        const app = Fastify();
+        await app.register(providerRoutes, { prefix: '/api', executionPermissions: new ExecutionPermissionService({ getAllowedModes: () => ['ASK', 'AUTO_SANDBOX'] }) });
+        try {
+            const option = (response) => response.json().CODEX.executionPermissionOptions.CLI.find((item) => item.mode === 'AUTO_SANDBOX');
+            for (const config of [{}, { model: 'gpt-6.1-sol' }]) {
+                const restricted = await app.inject({ method: 'POST', url: '/api/providers/capabilities', payload: { agentType: AgentType.CODEX, runtimeType: RuntimeType.CLI, config } });
+                expect(option(restricted)).toMatchObject({ supported: true, authorized: false, selectable: false, reasons: [{ code: 'POLICY_ENFORCEMENT_UNAVAILABLE' }] });
+                expect(restricted.body).not.toContain('model_providers');
+                for (const url of ['/api/providers', '/api/providers/test']) {
+                    const response = await app.inject({ method: 'POST', url, payload: {
+                            name: 'Restricted auto-review', agentType: AgentType.CODEX, runtimeType: RuntimeType.CLI,
+                            executionPermission: 'AUTO_SANDBOX', config,
+                        } });
+                    expect(response.statusCode, response.body).toBe(403);
+                    expect(response.json().diagnostics).toEqual(expect.arrayContaining([expect.objectContaining({ code: 'POLICY_ENFORCEMENT_UNAVAILABLE' })]));
+                }
+            }
+            const backup = { version: 2, kind: 'provider-backup', mode: 'full', exportedAt: new Date().toISOString(), providers: [{
+                        id: 'restricted-auto-review', name: 'Restricted auto-review', agentType: AgentType.CODEX,
+                        runtimeType: RuntimeType.CLI, executionPermission: 'AUTO_SANDBOX', config: { model: 'gpt-6-sol' }, env: {},
+                    }] };
+            for (const url of ['/api/providers/import/preview', '/api/providers/import']) {
+                const response = await app.inject({ method: 'POST', url, payload: backup });
+                expect(response.statusCode, response.body).toBe(403);
+                expect(response.json().diagnostics).toEqual(expect.arrayContaining([expect.objectContaining({ code: 'POLICY_ENFORCEMENT_UNAVAILABLE' })]));
+            }
+        }
+        finally {
+            await app.close();
+            refresh.mockRestore();
+            support.mockRestore();
+        }
+    });
+    it.each([{}, { model: 'gpt-6.1-sol' }])('accepts Codex CLI AUTO_SANDBOX drafts, saves and tests with config %j', async (config) => {
+        const refresh = vi.spyOn(codexCapabilities, 'refreshCodexCliSupport').mockResolvedValue({ supported: true });
+        const support = vi.spyOn(codexCapabilities, 'cachedCodexCliSupport').mockReturnValue({ supported: true });
+        const app = await createApp();
+        try {
+            const draft = { name: 'Codex AUTO', agentType: AgentType.CODEX, runtimeType: RuntimeType.CLI,
+                executionPermission: 'AUTO_SANDBOX', config };
+            const capabilities = await app.inject({ method: 'POST', url: '/api/providers/capabilities', payload: draft });
+            expect(capabilities.json().CODEX.executionPermissionOptions.CLI.find((option) => option.mode === 'AUTO_SANDBOX'))
+                .toMatchObject({ supported: true, authorized: true, selectable: true, reasons: [] });
+            const created = await app.inject({ method: 'POST', url: '/api/providers', payload: draft });
+            expect(created.statusCode, created.body).toBe(201);
+            expect(created.json().executionPermission).toBe('AUTO_SANDBOX');
+            const saved = await app.inject({ method: 'GET', url: `/api/providers/capabilities?providerId=${created.json().id}` });
+            expect(saved.json().CODEX.executionPermissionOptions.CLI.find((option) => option.mode === 'AUTO_SANDBOX'))
+                .toMatchObject({ supported: true, authorized: true, selectable: true, reasons: [] });
+            const tested = await app.inject({ method: 'POST', url: '/api/providers/test', payload: draft });
+            expect(tested.statusCode, tested.body).toBe(200);
+            expect(tested.json().diagnostics ?? []).not.toEqual(expect.arrayContaining([expect.objectContaining({ field: 'executionPermission' })]));
+        }
+        finally {
+            await app.close();
+            refresh.mockRestore();
+            support.mockRestore();
+        }
+    });
+    it('rejects Codex CLI AUTO_SANDBOX advanced sandbox overrides in draft, save, test and import', async () => {
+        const refresh = vi.spyOn(codexCapabilities, 'refreshCodexCliSupport').mockResolvedValue({ supported: true });
+        const support = vi.spyOn(codexCapabilities, 'cachedCodexCliSupport').mockReturnValue({ supported: true });
+        const app = await createApp();
+        const providerId = 'codex-auto-safe';
+        const settings = '[sandbox_workspace_write]\nwritable_roots=["/outside"]\nnetwork_access=true';
+        try {
+            const draft = { name: 'Codex AUTO', agentType: AgentType.CODEX, runtimeType: RuntimeType.CLI,
+                executionPermission: 'AUTO_SANDBOX', config: { model: 'gpt-6-sol' }, settings };
+            const option = (response) => response.json().CODEX.executionPermissionOptions.CLI.find((item) => item.mode === 'AUTO_SANDBOX');
+            const capabilities = await app.inject({ method: 'POST', url: '/api/providers/capabilities', payload: { ...draft, model: 'gpt-6-sol' } });
+            expect(option(capabilities)).toMatchObject({ supported: false, selectable: false, reasons: [{ code: 'CONFLICT' }] });
+            expect(option(await app.inject({ method: 'POST', url: '/api/providers/capabilities', payload: { ...draft, model: 'gpt-6-sol', settings: '' } })))
+                .toMatchObject({ supported: true, selectable: true });
+            for (const url of ['/api/providers', '/api/providers/test']) {
+                const response = await app.inject({ method: 'POST', url, payload: draft });
+                expect(response.statusCode, response.body).toBe(url === '/api/providers/test' ? 200 : 400);
+                if (url === '/api/providers/test')
+                    expect(response.json()).toMatchObject({ ok: false, stage: 'validation' });
+                expect(response.json().diagnostics).toEqual(expect.arrayContaining([expect.objectContaining({ code: 'CONFLICT' })]));
+            }
+            const created = await app.inject({ method: 'POST', url: '/api/providers', payload: { ...draft, settings: '' } });
+            expect(created.statusCode, created.body).toBe(201);
+            const savedId = created.json().id;
+            const update = await app.inject({ method: 'PUT', url: `/api/providers/${savedId}`, payload: { settings } });
+            expect(update.statusCode, update.body).toBe(400);
+            expect(update.json().diagnostics).toEqual(expect.arrayContaining([expect.objectContaining({ code: 'CONFLICT' })]));
+            const backup = { version: 2, kind: 'provider-backup', mode: 'full', exportedAt: new Date().toISOString(),
+                providers: [{ ...draft, id: providerId, env: {}, isDefault: false }] };
+            for (const url of ['/api/providers/import/preview', '/api/providers/import']) {
+                const response = await app.inject({ method: 'POST', url, payload: backup });
+                expect(response.statusCode, response.body).toBe(400);
+                expect(response.json().diagnostics).toEqual(expect.arrayContaining([expect.objectContaining({ code: 'CONFLICT' })]));
+            }
+            expect(getProviderById(providerId)).toBeNull();
+        }
+        finally {
+            await app.close();
+            refresh.mockRestore();
+            support.mockRestore();
+        }
+    });
+    it('defaults fresh Providers to ASK, blocks unsupported selections and never upgrades them', async () => {
+        const app = Fastify();
+        await app.register(providerRoutes, { prefix: '/api' });
+        const created = await app.inject({ method: 'POST', url: '/api/providers', payload: {
+                name: 'New Codex ACP', agentType: AgentType.CODEX, runtimeType: RuntimeType.ACP,
+            } });
+        expect(created.statusCode).toBe(201);
+        expect(created.json().executionPermission).toBe('ASK');
+        const blocked = await app.inject({ method: 'POST', url: '/api/providers', payload: {
+                name: 'New Pi', agentType: AgentType.PI_CODING_AGENT, runtimeType: RuntimeType.ACP,
+            } });
+        expect(blocked.statusCode).toBe(400);
+        expect(blocked.json().diagnostics).toEqual(expect.arrayContaining([expect.objectContaining({ code: 'AGENT_MODE_UNSUPPORTED' })]));
+        await app.close();
+    });
     beforeEach(() => {
         dataDir = fs.mkdtempSync(path.join(os.tmpdir(), 'agent-tower-provider-routes-'));
         process.env.AGENT_TOWER_DATA_DIR = dataDir;
@@ -64,6 +251,7 @@ describe('provider routes', () => {
         process.env.PATH = `${binDir}${path.delimiter}${originalPath ?? ''}`;
     });
     afterEach(() => {
+        resetCodexModelCatalogForTests();
         if (originalDataDir === undefined)
             delete process.env.AGENT_TOWER_DATA_DIR;
         else
@@ -107,6 +295,63 @@ describe('provider routes', () => {
         expect(response.json()[AgentType.MINION_CODE]).toBeUndefined();
         await app.close();
     });
+    it('offers the documented GPT-6 effort ceiling for both Codex runtimes', async () => {
+        const catalog = {
+            models: [
+                { slug: 'gpt-6-sol', supported_reasoning_levels: [{ effort: 'low' }] },
+                { slug: 'gpt-6-luna', supported_reasoning_levels: [{ effort: 'low' }, { effort: 'ultra' }] },
+            ],
+        };
+        fs.writeFileSync(path.join(dataDir, 'bin', 'codex'), `#!/bin/sh\nprintf '%s\\n' '${JSON.stringify(catalog)}'\n`, { mode: 0o755 });
+        resetCodexModelCatalogForTests();
+        const app = await createApp();
+        for (const [model, effort] of [['gpt-6-sol', 'ultra'], ['gpt-6-luna', 'max']]) {
+            const capabilities = await app.inject({
+                method: 'GET',
+                url: `/api/providers/capabilities?agentType=CODEX&model=${model}`,
+            });
+            expect(capabilities.statusCode).toBe(200);
+            const options = capabilities.json()[AgentType.CODEX].reasoningEffort.options;
+            expect(options).toContain(effort);
+            if (model === 'gpt-6-luna')
+                expect(options).not.toContain('ultra');
+            for (const runtimeType of [RuntimeType.CLI, RuntimeType.ACP]) {
+                const created = await app.inject({
+                    method: 'POST',
+                    url: '/api/providers',
+                    payload: {
+                        name: `${model} ${runtimeType}`,
+                        agentType: AgentType.CODEX,
+                        executionPermission: 'FULL_ACCESS',
+                        runtimeType,
+                        simplified: { model, reasoningEffort: effort },
+                    },
+                });
+                expect(created.statusCode).toBe(201);
+                expect(created.json()).toMatchObject({
+                    runtimeType,
+                    config: { model },
+                    settings: `model_reasoning_effort = "${effort}"`,
+                });
+            }
+        }
+        const unsupported = await app.inject({
+            method: 'POST',
+            url: '/api/providers',
+            payload: {
+                name: 'Luna Ultra',
+                agentType: AgentType.CODEX,
+                executionPermission: 'FULL_ACCESS',
+                runtimeType: RuntimeType.ACP,
+                simplified: { model: 'gpt-6-luna', reasoningEffort: 'ultra' },
+            },
+        });
+        expect(unsupported.statusCode).toBe(400);
+        expect(unsupported.json()).toMatchObject({
+            diagnostics: [{ field: 'reasoningEffort', code: 'INVALID_ENUM' }],
+        });
+        await app.close();
+    });
     it('rejects creating a hidden Minion Code provider', async () => {
         const app = await createApp();
         const response = await app.inject({
@@ -130,9 +375,10 @@ describe('provider routes', () => {
             payload: {
                 name: 'Codex ACP Custom',
                 agentType: AgentType.CODEX,
+                executionPermission: 'ASK',
                 runtimeType: RuntimeType.ACP,
                 env: { OPENAI_API_KEY: { action: 'replace', value: 'acp-route-secret' } },
-                config: { permissionMode: 'ASK' },
+                config: {},
                 simplified: {
                     apiBaseUrl: 'https://proxy.example/v1',
                     model: 'gpt-acp',
@@ -144,7 +390,8 @@ describe('provider routes', () => {
         expect(created.json()).toMatchObject({
             agentType: AgentType.CODEX,
             runtimeType: RuntimeType.ACP,
-            config: { model: 'gpt-acp', permissionMode: 'ASK' },
+            executionPermission: 'ASK',
+            config: { model: 'gpt-acp' },
             redactedEnv: { OPENAI_API_KEY: { configured: true, sensitive: true } },
         });
         const providerId = created.json().id;
@@ -165,6 +412,7 @@ describe('provider routes', () => {
         {
             name: 'Claude Code ACP Custom',
             agentType: AgentType.CLAUDE_CODE,
+            executionPermission: 'FULL_ACCESS',
             secretKey: 'ANTHROPIC_API_KEY',
             secret: 'claude-acp-route-secret',
             apiBaseUrl: 'https://anthropic-gateway.example/v1',
@@ -199,7 +447,8 @@ describe('provider routes', () => {
         expect(created.json()).toMatchObject({
             agentType,
             runtimeType: RuntimeType.ACP,
-            config: { model, permissionMode: 'UNRESTRICTED' },
+            executionPermission: 'FULL_ACCESS',
+            config: { model },
             redactedEnv: { [secretKey]: { configured: true, sensitive: true } },
             simplified: {
                 apiBaseUrl,
@@ -210,7 +459,7 @@ describe('provider routes', () => {
         expect(getProviderById(created.json().id)?.runtimeType).toBe(RuntimeType.ACP);
         await app.close();
     });
-    it('migrates the legacy ACP AUTO_APPROVE value to UNRESTRICTED', async () => {
+    it('migrates the legacy ACP AUTO_APPROVE value to FULL_ACCESS', async () => {
         const app = await createApp();
         const created = await app.inject({
             method: 'POST',
@@ -224,11 +473,12 @@ describe('provider routes', () => {
         });
         expect(created.statusCode).toBe(201);
         expect(created.json()).toMatchObject({
-            config: { permissionMode: 'UNRESTRICTED' },
+            executionPermission: 'FULL_ACCESS',
+            config: {},
         });
         await app.close();
     });
-    it('migrates legacy Agent permission flags without overriding an explicit ASK mode', async () => {
+    it('migrates dangerous flags and rejects conflicting legacy ASK fields', async () => {
         const app = await createApp();
         const legacyFlag = await app.inject({
             method: 'POST',
@@ -241,7 +491,8 @@ describe('provider routes', () => {
             },
         });
         expect(legacyFlag.statusCode).toBe(201);
-        expect(legacyFlag.json().config).toEqual({ permissionMode: 'UNRESTRICTED' });
+        expect(legacyFlag.json().config).toEqual({});
+        expect(legacyFlag.json().executionPermission).toBe('FULL_ACCESS');
         const explicitAsk = await app.inject({
             method: 'POST',
             url: '/api/providers',
@@ -252,8 +503,8 @@ describe('provider routes', () => {
                 config: { permissionMode: 'ASK', yolo: true },
             },
         });
-        expect(explicitAsk.statusCode).toBe(201);
-        expect(explicitAsk.json().config).toEqual({ permissionMode: 'ASK' });
+        expect(explicitAsk.statusCode).toBe(400);
+        expect(explicitAsk.json().diagnostics).toEqual(expect.arrayContaining([expect.objectContaining({ field: 'executionPermission', code: 'CONFLICT' })]));
         await app.close();
     });
     it('rejects unsupported Runtime choices and invalid ACP permission values', async () => {
@@ -293,6 +544,7 @@ describe('provider routes', () => {
             const payload = {
                 name: `Invalid URL ${index}`,
                 agentType: AgentType.CODEX,
+                executionPermission: 'FULL_ACCESS',
                 simplified: { apiBaseUrl },
             };
             const created = await app.inject({ method: 'POST', url: '/api/providers', payload });
@@ -315,6 +567,7 @@ describe('provider routes', () => {
                 payload: {
                     name: `Valid URL ${index}`,
                     agentType: AgentType.CODEX,
+                    executionPermission: 'FULL_ACCESS',
                     simplified: { apiBaseUrl },
                 },
             });
@@ -330,6 +583,7 @@ describe('provider routes', () => {
             payload: {
                 name: 'Gemini Custom',
                 agentType: AgentType.GEMINI_CLI,
+                executionPermission: 'FULL_ACCESS',
                 env: { GEMINI_API_KEY: { action: 'replace', value: 'gemini-route-secret' } },
                 simplified: { model: 'gemini-test' },
             },
@@ -377,6 +631,7 @@ describe('provider routes', () => {
             payload: {
                 name: 'Codex Proxy',
                 agentType: AgentType.CODEX,
+                executionPermission: 'FULL_ACCESS',
                 env: { OPENAI_API_KEY: { action: 'replace', value: secret } },
                 simplified: {
                     apiBaseUrl: 'https://proxy.example/v1',
@@ -420,6 +675,7 @@ describe('provider routes', () => {
             payload: {
                 name: 'Codex Dynamic Credential',
                 agentType: AgentType.CODEX,
+                executionPermission: 'FULL_ACCESS',
                 env: { PROXY_ACCESS: { action: 'replace', value: secret } },
                 settings: [
                     'model_provider = "proxy"',
@@ -462,6 +718,7 @@ describe('provider routes', () => {
                     id: providerId,
                     name: 'Imported Spaced Credential',
                     agentType: AgentType.CODEX,
+                    executionPermission: 'FULL_ACCESS',
                     env: Object.fromEntries([
                         ...aliasKeys.map((key, index) => [key, importedSentinels[index]]),
                         ['UNKNOWN_ENV', unknownSentinel],
@@ -559,6 +816,7 @@ describe('provider routes', () => {
         const payload = {
             name: 'Codex Protected Credential',
             agentType: AgentType.CODEX,
+            executionPermission: 'FULL_ACCESS',
             env: { [envKey]: { action: 'replace', value: secret } },
             settings: [
                 'model_provider = "proxy"',
@@ -597,6 +855,7 @@ describe('provider routes', () => {
             payload: {
                 name: 'Unsaved Claude',
                 agentType: AgentType.CLAUDE_CODE,
+                executionPermission: 'FULL_ACCESS',
                 env: { ANTHROPIC_API_KEY: { action: 'replace', value: secret } },
                 config: {},
                 settings: '{"env":{"ANTHROPIC_API_KEY":"settings-secret"}}',
@@ -613,6 +872,7 @@ describe('provider routes', () => {
         const payload = {
             name: `Native ${modelProviderId}`,
             agentType: AgentType.CODEX,
+            executionPermission: 'FULL_ACCESS',
             env: { NATIVE_PROVIDER_OPTION: { action: 'replace', value: 'native-value' } },
             settings: `model_provider = "${modelProviderId}"\n`,
         };
@@ -651,6 +911,7 @@ describe('provider routes', () => {
                 payload: {
                     name: 'Unsaved Codex A',
                     agentType: AgentType.CODEX,
+                    executionPermission: 'FULL_ACCESS',
                     env: { OPENAI_API_KEY: { action: 'replace', value: expectedKey } },
                     simplified: { apiBaseUrl: `${loopback.baseUrl}/draft-a` },
                 },
@@ -664,6 +925,7 @@ describe('provider routes', () => {
                 payload: {
                     name: 'Unsaved Codex B',
                     agentType: AgentType.CODEX,
+                    executionPermission: 'FULL_ACCESS',
                     env: { OPENAI_API_KEY: { action: 'replace', value: expectedKey } },
                     simplified: { apiBaseUrl: `${loopback.baseUrl}/draft-b` },
                 },
@@ -685,6 +947,7 @@ describe('provider routes', () => {
         {
             name: 'Claude ACP gateway',
             agentType: AgentType.CLAUDE_CODE,
+            executionPermission: 'FULL_ACCESS',
             secretKey: 'ANTHROPIC_API_KEY',
             expectedHeader: 'x-api-key',
         },
@@ -749,6 +1012,7 @@ describe('provider routes', () => {
                 payload: {
                     name: 'Codex without CLI',
                     agentType: AgentType.CODEX,
+                    executionPermission: 'FULL_ACCESS',
                     simplified: { apiBaseUrl: loopback.baseUrl },
                 },
             });
@@ -791,6 +1055,7 @@ describe('provider routes', () => {
                 payload: {
                     name: 'Saved Codex',
                     agentType: AgentType.CODEX,
+                    executionPermission: 'FULL_ACCESS',
                     env: { OPENAI_API_KEY: { action: 'replace', value: expectedKey } },
                     simplified: { apiBaseUrl: `${loopback.baseUrl}/saved-a` },
                 },
@@ -803,6 +1068,7 @@ describe('provider routes', () => {
                     providerId,
                     name: 'Saved Codex',
                     agentType: AgentType.CODEX,
+                    executionPermission: 'FULL_ACCESS',
                     env: { OPENAI_API_KEY: { action: 'keep' } },
                 },
             });
@@ -814,6 +1080,7 @@ describe('provider routes', () => {
                     providerId,
                     name: 'Saved Codex',
                     agentType: AgentType.CODEX,
+                    executionPermission: 'FULL_ACCESS',
                     env: { OPENAI_API_KEY: { action: 'keep' } },
                     simplified: { apiBaseUrl: `${loopback.baseUrl}/saved-b` },
                 },
@@ -827,6 +1094,7 @@ describe('provider routes', () => {
                     providerId,
                     name: 'Saved Codex',
                     agentType: AgentType.CODEX,
+                    executionPermission: 'FULL_ACCESS',
                     env: { OPENAI_API_KEY: { action: 'replace', value: expectedKey } },
                 },
             });
@@ -865,6 +1133,7 @@ describe('provider routes', () => {
                 payload: {
                     name: `Codex ${status}`,
                     agentType: AgentType.CODEX,
+                    executionPermission: 'FULL_ACCESS',
                     env: { OPENAI_API_KEY: { action: 'replace', value: secret } },
                     simplified: { apiBaseUrl: loopback.baseUrl },
                 },
@@ -887,6 +1156,7 @@ describe('provider routes', () => {
                 payload: {
                     name: 'Codex timeout',
                     agentType: AgentType.CODEX,
+                    executionPermission: 'FULL_ACCESS',
                     simplified: { apiBaseUrl: loopback.baseUrl },
                 },
             });
@@ -906,6 +1176,7 @@ describe('provider routes', () => {
             payload: {
                 name: 'Broken Codex',
                 agentType: AgentType.CODEX,
+                executionPermission: 'FULL_ACCESS',
                 settings: `api_key = "${secret}"\nbroken = [toml`,
             },
         });
@@ -981,6 +1252,7 @@ describe('provider routes', () => {
             payload: {
                 name: 'Codex HTTP transport',
                 agentType: AgentType.CODEX,
+                executionPermission: 'FULL_ACCESS',
                 config: { disableResponsesWebsocket: true, unknown: { keep: true } },
             },
         });
@@ -1003,6 +1275,7 @@ describe('provider routes', () => {
         const payload = {
             name: 'Codex reserved alias collision',
             agentType: AgentType.CODEX,
+            executionPermission: 'FULL_ACCESS',
             config: { disableResponsesWebsocket: true },
             settings: [
                 'model_provider = "openai"',
@@ -1049,6 +1322,7 @@ describe('provider routes', () => {
                     id: providerId,
                     name: 'Invalid imported permission',
                     agentType: AgentType.CODEX,
+                    executionPermission: 'FULL_ACCESS',
                     env: { OPENAI_API_KEY: secret },
                     config: { dangerouslyBypassApprovalsAndSandbox: invalidValue },
                     isDefault: false,
@@ -1095,7 +1369,7 @@ describe('provider routes', () => {
             payload: backup,
         });
         expect(preview.statusCode).toBe(200);
-        expect(preview.json().items.map((item) => (item.incoming.config.dangerouslyBypassApprovalsAndSandbox))).toEqual([true, false]);
+        expect(preview.json().items.map((item) => (item.incoming.executionPermission))).toEqual(['FULL_ACCESS', 'ASK']);
         const imported = await app.inject({
             method: 'POST',
             url: '/api/providers/import',
@@ -1103,7 +1377,7 @@ describe('provider routes', () => {
         });
         expect(imported.statusCode).toBe(200);
         reloadProviders();
-        expect(backup.providers.map(item => (getProviderById(item.id)?.config.dangerouslyBypassApprovalsAndSandbox))).toEqual([true, false]);
+        expect(backup.providers.map(item => (getProviderById(item.id)?.executionPermission))).toEqual(['FULL_ACCESS', 'ASK']);
         for (const response of [preview, imported]) {
             for (const secret of secrets)
                 expect(response.body).not.toContain(secret);
@@ -1128,6 +1402,7 @@ describe('provider routes', () => {
                     id: 'structured-secret-provider',
                     name: 'Structured Secret Provider',
                     agentType: AgentType.CLAUDE_CODE,
+                    executionPermission: 'FULL_ACCESS',
                     env: { ANTHROPIC_API_KEY: secrets[0] },
                     config: { auth_token: { nested: secrets[1] } },
                     settings: JSON.stringify({