airlock-bot 0.2.19 → 0.2.21

package/dist/config/schema.d.ts

@@ -97,15 +97,304 @@ export type ProviderConfig = z.infer<typeof ProviderConfig>;
 export declare function getMcpConfigs(providers: Record<string, ProviderConfig>): Record<string, McpServerConfig>;
 /** Extract the set of builtin provider names (e.g. "exec", "http") */
 export declare function getBuiltinProviders(providers: Record<string, ProviderConfig>): Set<string>;
+export declare const SandboxFilesystemConfig: z.ZodObject<{
+    allow_write: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+    deny_read: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+    deny_write: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+    allow_read: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+}, "strip", z.ZodTypeAny, {
+    allow_write: string[];
+    deny_read: string[];
+    deny_write: string[];
+    allow_read?: string[] | undefined;
+}, {
+    allow_write?: string[] | undefined;
+    deny_read?: string[] | undefined;
+    deny_write?: string[] | undefined;
+    allow_read?: string[] | undefined;
+}>;
+export type SandboxFilesystemConfig = z.infer<typeof SandboxFilesystemConfig>;
+export declare const SandboxNetworkConfig: z.ZodObject<{
+    allowed_domains: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+    denied_domains: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+}, "strip", z.ZodTypeAny, {
+    allowed_domains: string[];
+    denied_domains: string[];
+}, {
+    allowed_domains?: string[] | undefined;
+    denied_domains?: string[] | undefined;
+}>;
+export type SandboxNetworkConfig = z.infer<typeof SandboxNetworkConfig>;
+export declare const SandboxOverrideConfig: z.ZodObject<{
+    filesystem: z.ZodOptional<z.ZodObject<{
+        allow_write: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+        deny_read: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+        deny_write: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+        allow_read: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    }, "strip", z.ZodTypeAny, {
+        allow_write: string[];
+        deny_read: string[];
+        deny_write: string[];
+        allow_read?: string[] | undefined;
+    }, {
+        allow_write?: string[] | undefined;
+        deny_read?: string[] | undefined;
+        deny_write?: string[] | undefined;
+        allow_read?: string[] | undefined;
+    }>>;
+    network: z.ZodOptional<z.ZodObject<{
+        allowed_domains: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+        denied_domains: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+    }, "strip", z.ZodTypeAny, {
+        allowed_domains: string[];
+        denied_domains: string[];
+    }, {
+        allowed_domains?: string[] | undefined;
+        denied_domains?: string[] | undefined;
+    }>>;
+}, "strip", z.ZodTypeAny, {
+    filesystem?: {
+        allow_write: string[];
+        deny_read: string[];
+        deny_write: string[];
+        allow_read?: string[] | undefined;
+    } | undefined;
+    network?: {
+        allowed_domains: string[];
+        denied_domains: string[];
+    } | undefined;
+}, {
+    filesystem?: {
+        allow_write?: string[] | undefined;
+        deny_read?: string[] | undefined;
+        deny_write?: string[] | undefined;
+        allow_read?: string[] | undefined;
+    } | undefined;
+    network?: {
+        allowed_domains?: string[] | undefined;
+        denied_domains?: string[] | undefined;
+    } | undefined;
+}>;
+export type SandboxOverrideConfig = z.infer<typeof SandboxOverrideConfig>;
+export declare const SandboxPresetRef: z.ZodEffects<z.ZodUnion<[z.ZodString, z.ZodArray<z.ZodString, "many">]>, string[], string | string[]>;
+export type SandboxPresetRef = z.infer<typeof SandboxPresetRef>;
+export declare const SandboxConfig: z.ZodObject<{
+    enabled: z.ZodDefault<z.ZodBoolean>;
+    presets: z.ZodDefault<z.ZodEffects<z.ZodUnion<[z.ZodString, z.ZodArray<z.ZodString, "many">]>, string[], string | string[]>>;
+    filesystem: z.ZodDefault<z.ZodObject<{
+        allow_write: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+        deny_read: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+        deny_write: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+        allow_read: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    }, "strip", z.ZodTypeAny, {
+        allow_write: string[];
+        deny_read: string[];
+        deny_write: string[];
+        allow_read?: string[] | undefined;
+    }, {
+        allow_write?: string[] | undefined;
+        deny_read?: string[] | undefined;
+        deny_write?: string[] | undefined;
+        allow_read?: string[] | undefined;
+    }>>;
+    network: z.ZodDefault<z.ZodObject<{
+        allowed_domains: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+        denied_domains: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+    }, "strip", z.ZodTypeAny, {
+        allowed_domains: string[];
+        denied_domains: string[];
+    }, {
+        allowed_domains?: string[] | undefined;
+        denied_domains?: string[] | undefined;
+    }>>;
+    overrides: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodObject<{
+        filesystem: z.ZodOptional<z.ZodObject<{
+            allow_write: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+            deny_read: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+            deny_write: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+            allow_read: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        }, "strip", z.ZodTypeAny, {
+            allow_write: string[];
+            deny_read: string[];
+            deny_write: string[];
+            allow_read?: string[] | undefined;
+        }, {
+            allow_write?: string[] | undefined;
+            deny_read?: string[] | undefined;
+            deny_write?: string[] | undefined;
+            allow_read?: string[] | undefined;
+        }>>;
+        network: z.ZodOptional<z.ZodObject<{
+            allowed_domains: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+            denied_domains: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+        }, "strip", z.ZodTypeAny, {
+            allowed_domains: string[];
+            denied_domains: string[];
+        }, {
+            allowed_domains?: string[] | undefined;
+            denied_domains?: string[] | undefined;
+        }>>;
+    }, "strip", z.ZodTypeAny, {
+        filesystem?: {
+            allow_write: string[];
+            deny_read: string[];
+            deny_write: string[];
+            allow_read?: string[] | undefined;
+        } | undefined;
+        network?: {
+            allowed_domains: string[];
+            denied_domains: string[];
+        } | undefined;
+    }, {
+        filesystem?: {
+            allow_write?: string[] | undefined;
+            deny_read?: string[] | undefined;
+            deny_write?: string[] | undefined;
+            allow_read?: string[] | undefined;
+        } | undefined;
+        network?: {
+            allowed_domains?: string[] | undefined;
+            denied_domains?: string[] | undefined;
+        } | undefined;
+    }>>>;
+}, "strip", z.ZodTypeAny, {
+    filesystem: {
+        allow_write: string[];
+        deny_read: string[];
+        deny_write: string[];
+        allow_read?: string[] | undefined;
+    };
+    network: {
+        allowed_domains: string[];
+        denied_domains: string[];
+    };
+    enabled: boolean;
+    presets: string[];
+    overrides: Record<string, {
+        filesystem?: {
+            allow_write: string[];
+            deny_read: string[];
+            deny_write: string[];
+            allow_read?: string[] | undefined;
+        } | undefined;
+        network?: {
+            allowed_domains: string[];
+            denied_domains: string[];
+        } | undefined;
+    }>;
+}, {
+    filesystem?: {
+        allow_write?: string[] | undefined;
+        deny_read?: string[] | undefined;
+        deny_write?: string[] | undefined;
+        allow_read?: string[] | undefined;
+    } | undefined;
+    network?: {
+        allowed_domains?: string[] | undefined;
+        denied_domains?: string[] | undefined;
+    } | undefined;
+    enabled?: boolean | undefined;
+    presets?: string | string[] | undefined;
+    overrides?: Record<string, {
+        filesystem?: {
+            allow_write?: string[] | undefined;
+            deny_read?: string[] | undefined;
+            deny_write?: string[] | undefined;
+            allow_read?: string[] | undefined;
+        } | undefined;
+        network?: {
+            allowed_domains?: string[] | undefined;
+            denied_domains?: string[] | undefined;
+        } | undefined;
+    }> | undefined;
+}>;
+export type SandboxConfig = z.infer<typeof SandboxConfig>;
 export declare const ToolOverride: z.ZodObject<{
     description: z.ZodOptional<z.ZodString>;
-    trusted: z.ZodDefault<z.ZodBoolean>;
+    alias_of: z.ZodOptional<z.ZodString>;
+    sandbox_presets: z.ZodDefault<z.ZodEffects<z.ZodUnion<[z.ZodString, z.ZodArray<z.ZodString, "many">]>, string[], string | string[]>>;
+    sandbox: z.ZodOptional<z.ZodObject<{
+        filesystem: z.ZodOptional<z.ZodObject<{
+            allow_write: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+            deny_read: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+            deny_write: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+            allow_read: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        }, "strip", z.ZodTypeAny, {
+            allow_write: string[];
+            deny_read: string[];
+            deny_write: string[];
+            allow_read?: string[] | undefined;
+        }, {
+            allow_write?: string[] | undefined;
+            deny_read?: string[] | undefined;
+            deny_write?: string[] | undefined;
+            allow_read?: string[] | undefined;
+        }>>;
+        network: z.ZodOptional<z.ZodObject<{
+            allowed_domains: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+            denied_domains: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+        }, "strip", z.ZodTypeAny, {
+            allowed_domains: string[];
+            denied_domains: string[];
+        }, {
+            allowed_domains?: string[] | undefined;
+            denied_domains?: string[] | undefined;
+        }>>;
+    }, "strip", z.ZodTypeAny, {
+        filesystem?: {
+            allow_write: string[];
+            deny_read: string[];
+            deny_write: string[];
+            allow_read?: string[] | undefined;
+        } | undefined;
+        network?: {
+            allowed_domains: string[];
+            denied_domains: string[];
+        } | undefined;
+    }, {
+        filesystem?: {
+            allow_write?: string[] | undefined;
+            deny_read?: string[] | undefined;
+            deny_write?: string[] | undefined;
+            allow_read?: string[] | undefined;
+        } | undefined;
+        network?: {
+            allowed_domains?: string[] | undefined;
+            denied_domains?: string[] | undefined;
+        } | undefined;
+    }>>;
 }, "strip", z.ZodTypeAny, {
-    trusted: boolean;
+    sandbox_presets: string[];
     description?: string | undefined;
+    alias_of?: string | undefined;
+    sandbox?: {
+        filesystem?: {
+            allow_write: string[];
+            deny_read: string[];
+            deny_write: string[];
+            allow_read?: string[] | undefined;
+        } | undefined;
+        network?: {
+            allowed_domains: string[];
+            denied_domains: string[];
+        } | undefined;
+    } | undefined;
 }, {
     description?: string | undefined;
-    trusted?: boolean | undefined;
+    alias_of?: string | undefined;
+    sandbox_presets?: string | string[] | undefined;
+    sandbox?: {
+        filesystem?: {
+            allow_write?: string[] | undefined;
+            deny_read?: string[] | undefined;
+            deny_write?: string[] | undefined;
+            allow_read?: string[] | undefined;
+        } | undefined;
+        network?: {
+            allowed_domains?: string[] | undefined;
+            denied_domains?: string[] | undefined;
+        } | undefined;
+    } | undefined;
 }>;
 export declare const AgentExecConfig: z.ZodObject<{
     allow: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
@@ -199,13 +488,90 @@ export declare const AgentConfig: z.ZodObject<{
     deny: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
     tool_overrides: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodObject<{
         description: z.ZodOptional<z.ZodString>;
-        trusted: z.ZodDefault<z.ZodBoolean>;
+        alias_of: z.ZodOptional<z.ZodString>;
+        sandbox_presets: z.ZodDefault<z.ZodEffects<z.ZodUnion<[z.ZodString, z.ZodArray<z.ZodString, "many">]>, string[], string | string[]>>;
+        sandbox: z.ZodOptional<z.ZodObject<{
+            filesystem: z.ZodOptional<z.ZodObject<{
+                allow_write: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+                deny_read: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+                deny_write: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+                allow_read: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+            }, "strip", z.ZodTypeAny, {
+                allow_write: string[];
+                deny_read: string[];
+                deny_write: string[];
+                allow_read?: string[] | undefined;
+            }, {
+                allow_write?: string[] | undefined;
+                deny_read?: string[] | undefined;
+                deny_write?: string[] | undefined;
+                allow_read?: string[] | undefined;
+            }>>;
+            network: z.ZodOptional<z.ZodObject<{
+                allowed_domains: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+                denied_domains: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+            }, "strip", z.ZodTypeAny, {
+                allowed_domains: string[];
+                denied_domains: string[];
+            }, {
+                allowed_domains?: string[] | undefined;
+                denied_domains?: string[] | undefined;
+            }>>;
+        }, "strip", z.ZodTypeAny, {
+            filesystem?: {
+                allow_write: string[];
+                deny_read: string[];
+                deny_write: string[];
+                allow_read?: string[] | undefined;
+            } | undefined;
+            network?: {
+                allowed_domains: string[];
+                denied_domains: string[];
+            } | undefined;
+        }, {
+            filesystem?: {
+                allow_write?: string[] | undefined;
+                deny_read?: string[] | undefined;
+                deny_write?: string[] | undefined;
+                allow_read?: string[] | undefined;
+            } | undefined;
+            network?: {
+                allowed_domains?: string[] | undefined;
+                denied_domains?: string[] | undefined;
+            } | undefined;
+        }>>;
     }, "strip", z.ZodTypeAny, {
-        trusted: boolean;
+        sandbox_presets: string[];
         description?: string | undefined;
+        alias_of?: string | undefined;
+        sandbox?: {
+            filesystem?: {
+                allow_write: string[];
+                deny_read: string[];
+                deny_write: string[];
+                allow_read?: string[] | undefined;
+            } | undefined;
+            network?: {
+                allowed_domains: string[];
+                denied_domains: string[];
+            } | undefined;
+        } | undefined;
     }, {
         description?: string | undefined;
-        trusted?: boolean | undefined;
+        alias_of?: string | undefined;
+        sandbox_presets?: string | string[] | undefined;
+        sandbox?: {
+            filesystem?: {
+                allow_write?: string[] | undefined;
+                deny_read?: string[] | undefined;
+                deny_write?: string[] | undefined;
+                allow_read?: string[] | undefined;
+            } | undefined;
+            network?: {
+                allowed_domains?: string[] | undefined;
+                denied_domains?: string[] | undefined;
+            } | undefined;
+        } | undefined;
     }>>>;
     exec: z.ZodDefault<z.ZodObject<{
         allow: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
@@ -239,6 +605,136 @@ export declare const AgentConfig: z.ZodObject<{
         max_response_bytes?: number | undefined;
         timeout_ms?: number | undefined;
     }>>;
+    sandbox: z.ZodDefault<z.ZodObject<{
+        enabled: z.ZodDefault<z.ZodBoolean>;
+        presets: z.ZodDefault<z.ZodEffects<z.ZodUnion<[z.ZodString, z.ZodArray<z.ZodString, "many">]>, string[], string | string[]>>;
+        filesystem: z.ZodDefault<z.ZodObject<{
+            allow_write: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+            deny_read: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+            deny_write: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+            allow_read: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        }, "strip", z.ZodTypeAny, {
+            allow_write: string[];
+            deny_read: string[];
+            deny_write: string[];
+            allow_read?: string[] | undefined;
+        }, {
+            allow_write?: string[] | undefined;
+            deny_read?: string[] | undefined;
+            deny_write?: string[] | undefined;
+            allow_read?: string[] | undefined;
+        }>>;
+        network: z.ZodDefault<z.ZodObject<{
+            allowed_domains: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+            denied_domains: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+        }, "strip", z.ZodTypeAny, {
+            allowed_domains: string[];
+            denied_domains: string[];
+        }, {
+            allowed_domains?: string[] | undefined;
+            denied_domains?: string[] | undefined;
+        }>>;
+        overrides: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodObject<{
+            filesystem: z.ZodOptional<z.ZodObject<{
+                allow_write: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+                deny_read: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+                deny_write: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+                allow_read: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+            }, "strip", z.ZodTypeAny, {
+                allow_write: string[];
+                deny_read: string[];
+                deny_write: string[];
+                allow_read?: string[] | undefined;
+            }, {
+                allow_write?: string[] | undefined;
+                deny_read?: string[] | undefined;
+                deny_write?: string[] | undefined;
+                allow_read?: string[] | undefined;
+            }>>;
+            network: z.ZodOptional<z.ZodObject<{
+                allowed_domains: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+                denied_domains: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+            }, "strip", z.ZodTypeAny, {
+                allowed_domains: string[];
+                denied_domains: string[];
+            }, {
+                allowed_domains?: string[] | undefined;
+                denied_domains?: string[] | undefined;
+            }>>;
+        }, "strip", z.ZodTypeAny, {
+            filesystem?: {
+                allow_write: string[];
+                deny_read: string[];
+                deny_write: string[];
+                allow_read?: string[] | undefined;
+            } | undefined;
+            network?: {
+                allowed_domains: string[];
+                denied_domains: string[];
+            } | undefined;
+        }, {
+            filesystem?: {
+                allow_write?: string[] | undefined;
+                deny_read?: string[] | undefined;
+                deny_write?: string[] | undefined;
+                allow_read?: string[] | undefined;
+            } | undefined;
+            network?: {
+                allowed_domains?: string[] | undefined;
+                denied_domains?: string[] | undefined;
+            } | undefined;
+        }>>>;
+    }, "strip", z.ZodTypeAny, {
+        filesystem: {
+            allow_write: string[];
+            deny_read: string[];
+            deny_write: string[];
+            allow_read?: string[] | undefined;
+        };
+        network: {
+            allowed_domains: string[];
+            denied_domains: string[];
+        };
+        enabled: boolean;
+        presets: string[];
+        overrides: Record<string, {
+            filesystem?: {
+                allow_write: string[];
+                deny_read: string[];
+                deny_write: string[];
+                allow_read?: string[] | undefined;
+            } | undefined;
+            network?: {
+                allowed_domains: string[];
+                denied_domains: string[];
+            } | undefined;
+        }>;
+    }, {
+        filesystem?: {
+            allow_write?: string[] | undefined;
+            deny_read?: string[] | undefined;
+            deny_write?: string[] | undefined;
+            allow_read?: string[] | undefined;
+        } | undefined;
+        network?: {
+            allowed_domains?: string[] | undefined;
+            denied_domains?: string[] | undefined;
+        } | undefined;
+        enabled?: boolean | undefined;
+        presets?: string | string[] | undefined;
+        overrides?: Record<string, {
+            filesystem?: {
+                allow_write?: string[] | undefined;
+                deny_read?: string[] | undefined;
+                deny_write?: string[] | undefined;
+                allow_read?: string[] | undefined;
+            } | undefined;
+            network?: {
+                allowed_domains?: string[] | undefined;
+                denied_domains?: string[] | undefined;
+            } | undefined;
+        }> | undefined;
+    }>>;
     middleware: z.ZodOptional<z.ZodArray<z.ZodObject<{
         name: z.ZodEnum<["schema-validator", "rate-limiter", "untrusted-envelope", "strip-query-params", "output-injection-detector", "canary-token-injector", "output-size-limiter", "output-summarizer", "injection-detector", "sensitivity-classifier"]>;
         enabled: z.ZodDefault<z.ZodBoolean>;
@@ -294,13 +790,52 @@ export declare const AgentConfig: z.ZodObject<{
         max_response_bytes: number;
         timeout_ms: number;
     };
+    sandbox: {
+        filesystem: {
+            allow_write: string[];
+            deny_read: string[];
+            deny_write: string[];
+            allow_read?: string[] | undefined;
+        };
+        network: {
+            allowed_domains: string[];
+            denied_domains: string[];
+        };
+        enabled: boolean;
+        presets: string[];
+        overrides: Record<string, {
+            filesystem?: {
+                allow_write: string[];
+                deny_read: string[];
+                deny_write: string[];
+                allow_read?: string[] | undefined;
+            } | undefined;
+            network?: {
+                allowed_domains: string[];
+                denied_domains: string[];
+            } | undefined;
+        }>;
+    };
     allow: string[];
     ask: string[];
     deny: string[];
     extends: string[];
     tool_overrides: Record<string, {
-        trusted: boolean;
+        sandbox_presets: string[];
         description?: string | undefined;
+        alias_of?: string | undefined;
+        sandbox?: {
+            filesystem?: {
+                allow_write: string[];
+                deny_read: string[];
+                deny_write: string[];
+                allow_read?: string[] | undefined;
+            } | undefined;
+            network?: {
+                allowed_domains: string[];
+                denied_domains: string[];
+            } | undefined;
+        } | undefined;
     }>;
     exec: {
         env: Record<string, string>;
@@ -333,6 +868,32 @@ export declare const AgentConfig: z.ZodObject<{
         max_response_bytes?: number | undefined;
         timeout_ms?: number | undefined;
     } | undefined;
+    sandbox?: {
+        filesystem?: {
+            allow_write?: string[] | undefined;
+            deny_read?: string[] | undefined;
+            deny_write?: string[] | undefined;
+            allow_read?: string[] | undefined;
+        } | undefined;
+        network?: {
+            allowed_domains?: string[] | undefined;
+            denied_domains?: string[] | undefined;
+        } | undefined;
+        enabled?: boolean | undefined;
+        presets?: string | string[] | undefined;
+        overrides?: Record<string, {
+            filesystem?: {
+                allow_write?: string[] | undefined;
+                deny_read?: string[] | undefined;
+                deny_write?: string[] | undefined;
+                allow_read?: string[] | undefined;
+            } | undefined;
+            network?: {
+                allowed_domains?: string[] | undefined;
+                denied_domains?: string[] | undefined;
+            } | undefined;
+        }> | undefined;
+    } | undefined;
     allow?: string[] | undefined;
     ask?: string[] | undefined;
     deny?: string[] | undefined;
@@ -340,7 +901,20 @@ export declare const AgentConfig: z.ZodObject<{
     extends?: string[] | undefined;
     tool_overrides?: Record<string, {
         description?: string | undefined;
-        trusted?: boolean | undefined;
+        alias_of?: string | undefined;
+        sandbox_presets?: string | string[] | undefined;
+        sandbox?: {
+            filesystem?: {
+                allow_write?: string[] | undefined;
+                deny_read?: string[] | undefined;
+                deny_write?: string[] | undefined;
+                allow_read?: string[] | undefined;
+            } | undefined;
+            network?: {
+                allowed_domains?: string[] | undefined;
+                denied_domains?: string[] | undefined;
+            } | undefined;
+        } | undefined;
     }> | undefined;
     exec?: {
         env?: Record<string, string> | undefined;
@@ -1035,7 +1609,58 @@ export declare const ApiConfig: z.ZodObject<{
     include?: string[] | undefined;
 }>;
 export type ApiConfig = z.infer<typeof ApiConfig>;
-export declare const GatewayConfig: z.ZodObject<{
+export declare const SandboxPresetConfig: z.ZodObject<{
+    filesystem: z.ZodOptional<z.ZodObject<{
+        allow_write: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+        deny_read: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+        deny_write: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+        allow_read: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    }, "strip", z.ZodTypeAny, {
+        allow_write: string[];
+        deny_read: string[];
+        deny_write: string[];
+        allow_read?: string[] | undefined;
+    }, {
+        allow_write?: string[] | undefined;
+        deny_read?: string[] | undefined;
+        deny_write?: string[] | undefined;
+        allow_read?: string[] | undefined;
+    }>>;
+    network: z.ZodOptional<z.ZodObject<{
+        allowed_domains: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+        denied_domains: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+    }, "strip", z.ZodTypeAny, {
+        allowed_domains: string[];
+        denied_domains: string[];
+    }, {
+        allowed_domains?: string[] | undefined;
+        denied_domains?: string[] | undefined;
+    }>>;
+}, "strip", z.ZodTypeAny, {
+    filesystem?: {
+        allow_write: string[];
+        deny_read: string[];
+        deny_write: string[];
+        allow_read?: string[] | undefined;
+    } | undefined;
+    network?: {
+        allowed_domains: string[];
+        denied_domains: string[];
+    } | undefined;
+}, {
+    filesystem?: {
+        allow_write?: string[] | undefined;
+        deny_read?: string[] | undefined;
+        deny_write?: string[] | undefined;
+        allow_read?: string[] | undefined;
+    } | undefined;
+    network?: {
+        allowed_domains?: string[] | undefined;
+        denied_domains?: string[] | undefined;
+    } | undefined;
+}>;
+export type SandboxPresetConfig = z.infer<typeof SandboxPresetConfig>;
+export declare const GatewayConfig: z.ZodEffects<z.ZodObject<{
     providers: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodUnion<[z.ZodLiteral<"builtin">, z.ZodDiscriminatedUnion<"type", [z.ZodObject<{
         type: z.ZodLiteral<"stdio">;
         command: z.ZodString;
@@ -1092,6 +1717,56 @@ export declare const GatewayConfig: z.ZodObject<{
         allow?: string[] | undefined;
         ask?: string[] | undefined;
     }>>>;
+    sandbox_presets: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodObject<{
+        filesystem: z.ZodOptional<z.ZodObject<{
+            allow_write: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+            deny_read: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+            deny_write: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+            allow_read: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        }, "strip", z.ZodTypeAny, {
+            allow_write: string[];
+            deny_read: string[];
+            deny_write: string[];
+            allow_read?: string[] | undefined;
+        }, {
+            allow_write?: string[] | undefined;
+            deny_read?: string[] | undefined;
+            deny_write?: string[] | undefined;
+            allow_read?: string[] | undefined;
+        }>>;
+        network: z.ZodOptional<z.ZodObject<{
+            allowed_domains: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+            denied_domains: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+        }, "strip", z.ZodTypeAny, {
+            allowed_domains: string[];
+            denied_domains: string[];
+        }, {
+            allowed_domains?: string[] | undefined;
+            denied_domains?: string[] | undefined;
+        }>>;
+    }, "strip", z.ZodTypeAny, {
+        filesystem?: {
+            allow_write: string[];
+            deny_read: string[];
+            deny_write: string[];
+            allow_read?: string[] | undefined;
+        } | undefined;
+        network?: {
+            allowed_domains: string[];
+            denied_domains: string[];
+        } | undefined;
+    }, {
+        filesystem?: {
+            allow_write?: string[] | undefined;
+            deny_read?: string[] | undefined;
+            deny_write?: string[] | undefined;
+            allow_read?: string[] | undefined;
+        } | undefined;
+        network?: {
+            allowed_domains?: string[] | undefined;
+            denied_domains?: string[] | undefined;
+        } | undefined;
+    }>>>;
     clis: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodObject<{
         discovered: z.ZodOptional<z.ZodEffects<z.ZodString, string, string>>;
         shell: z.ZodOptional<z.ZodEffects<z.ZodString, string, string>>;
@@ -1258,13 +1933,90 @@ export declare const GatewayConfig: z.ZodObject<{
         deny: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
         tool_overrides: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodObject<{
             description: z.ZodOptional<z.ZodString>;
-            trusted: z.ZodDefault<z.ZodBoolean>;
+            alias_of: z.ZodOptional<z.ZodString>;
+            sandbox_presets: z.ZodDefault<z.ZodEffects<z.ZodUnion<[z.ZodString, z.ZodArray<z.ZodString, "many">]>, string[], string | string[]>>;
+            sandbox: z.ZodOptional<z.ZodObject<{
+                filesystem: z.ZodOptional<z.ZodObject<{
+                    allow_write: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+                    deny_read: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+                    deny_write: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+                    allow_read: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+                }, "strip", z.ZodTypeAny, {
+                    allow_write: string[];
+                    deny_read: string[];
+                    deny_write: string[];
+                    allow_read?: string[] | undefined;
+                }, {
+                    allow_write?: string[] | undefined;
+                    deny_read?: string[] | undefined;
+                    deny_write?: string[] | undefined;
+                    allow_read?: string[] | undefined;
+                }>>;
+                network: z.ZodOptional<z.ZodObject<{
+                    allowed_domains: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+                    denied_domains: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+                }, "strip", z.ZodTypeAny, {
+                    allowed_domains: string[];
+                    denied_domains: string[];
+                }, {
+                    allowed_domains?: string[] | undefined;
+                    denied_domains?: string[] | undefined;
+                }>>;
+            }, "strip", z.ZodTypeAny, {
+                filesystem?: {
+                    allow_write: string[];
+                    deny_read: string[];
+                    deny_write: string[];
+                    allow_read?: string[] | undefined;
+                } | undefined;
+                network?: {
+                    allowed_domains: string[];
+                    denied_domains: string[];
+                } | undefined;
+            }, {
+                filesystem?: {
+                    allow_write?: string[] | undefined;
+                    deny_read?: string[] | undefined;
+                    deny_write?: string[] | undefined;
+                    allow_read?: string[] | undefined;
+                } | undefined;
+                network?: {
+                    allowed_domains?: string[] | undefined;
+                    denied_domains?: string[] | undefined;
+                } | undefined;
+            }>>;
         }, "strip", z.ZodTypeAny, {
-            trusted: boolean;
+            sandbox_presets: string[];
             description?: string | undefined;
+            alias_of?: string | undefined;
+            sandbox?: {
+                filesystem?: {
+                    allow_write: string[];
+                    deny_read: string[];
+                    deny_write: string[];
+                    allow_read?: string[] | undefined;
+                } | undefined;
+                network?: {
+                    allowed_domains: string[];
+                    denied_domains: string[];
+                } | undefined;
+            } | undefined;
         }, {
             description?: string | undefined;
-            trusted?: boolean | undefined;
+            alias_of?: string | undefined;
+            sandbox_presets?: string | string[] | undefined;
+            sandbox?: {
+                filesystem?: {
+                    allow_write?: string[] | undefined;
+                    deny_read?: string[] | undefined;
+                    deny_write?: string[] | undefined;
+                    allow_read?: string[] | undefined;
+                } | undefined;
+                network?: {
+                    allowed_domains?: string[] | undefined;
+                    denied_domains?: string[] | undefined;
+                } | undefined;
+            } | undefined;
         }>>>;
         exec: z.ZodDefault<z.ZodObject<{
             allow: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
@@ -1298,6 +2050,136 @@ export declare const GatewayConfig: z.ZodObject<{
             max_response_bytes?: number | undefined;
             timeout_ms?: number | undefined;
         }>>;
+        sandbox: z.ZodDefault<z.ZodObject<{
+            enabled: z.ZodDefault<z.ZodBoolean>;
+            presets: z.ZodDefault<z.ZodEffects<z.ZodUnion<[z.ZodString, z.ZodArray<z.ZodString, "many">]>, string[], string | string[]>>;
+            filesystem: z.ZodDefault<z.ZodObject<{
+                allow_write: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+                deny_read: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+                deny_write: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+                allow_read: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+            }, "strip", z.ZodTypeAny, {
+                allow_write: string[];
+                deny_read: string[];
+                deny_write: string[];
+                allow_read?: string[] | undefined;
+            }, {
+                allow_write?: string[] | undefined;
+                deny_read?: string[] | undefined;
+                deny_write?: string[] | undefined;
+                allow_read?: string[] | undefined;
+            }>>;
+            network: z.ZodDefault<z.ZodObject<{
+                allowed_domains: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+                denied_domains: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+            }, "strip", z.ZodTypeAny, {
+                allowed_domains: string[];
+                denied_domains: string[];
+            }, {
+                allowed_domains?: string[] | undefined;
+                denied_domains?: string[] | undefined;
+            }>>;
+            overrides: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodObject<{
+                filesystem: z.ZodOptional<z.ZodObject<{
+                    allow_write: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+                    deny_read: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+                    deny_write: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+                    allow_read: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+                }, "strip", z.ZodTypeAny, {
+                    allow_write: string[];
+                    deny_read: string[];
+                    deny_write: string[];
+                    allow_read?: string[] | undefined;
+                }, {
+                    allow_write?: string[] | undefined;
+                    deny_read?: string[] | undefined;
+                    deny_write?: string[] | undefined;
+                    allow_read?: string[] | undefined;
+                }>>;
+                network: z.ZodOptional<z.ZodObject<{
+                    allowed_domains: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+                    denied_domains: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+                }, "strip", z.ZodTypeAny, {
+                    allowed_domains: string[];
+                    denied_domains: string[];
+                }, {
+                    allowed_domains?: string[] | undefined;
+                    denied_domains?: string[] | undefined;
+                }>>;
+            }, "strip", z.ZodTypeAny, {
+                filesystem?: {
+                    allow_write: string[];
+                    deny_read: string[];
+                    deny_write: string[];
+                    allow_read?: string[] | undefined;
+                } | undefined;
+                network?: {
+                    allowed_domains: string[];
+                    denied_domains: string[];
+                } | undefined;
+            }, {
+                filesystem?: {
+                    allow_write?: string[] | undefined;
+                    deny_read?: string[] | undefined;
+                    deny_write?: string[] | undefined;
+                    allow_read?: string[] | undefined;
+                } | undefined;
+                network?: {
+                    allowed_domains?: string[] | undefined;
+                    denied_domains?: string[] | undefined;
+                } | undefined;
+            }>>>;
+        }, "strip", z.ZodTypeAny, {
+            filesystem: {
+                allow_write: string[];
+                deny_read: string[];
+                deny_write: string[];
+                allow_read?: string[] | undefined;
+            };
+            network: {
+                allowed_domains: string[];
+                denied_domains: string[];
+            };
+            enabled: boolean;
+            presets: string[];
+            overrides: Record<string, {
+                filesystem?: {
+                    allow_write: string[];
+                    deny_read: string[];
+                    deny_write: string[];
+                    allow_read?: string[] | undefined;
+                } | undefined;
+                network?: {
+                    allowed_domains: string[];
+                    denied_domains: string[];
+                } | undefined;
+            }>;
+        }, {
+            filesystem?: {
+                allow_write?: string[] | undefined;
+                deny_read?: string[] | undefined;
+                deny_write?: string[] | undefined;
+                allow_read?: string[] | undefined;
+            } | undefined;
+            network?: {
+                allowed_domains?: string[] | undefined;
+                denied_domains?: string[] | undefined;
+            } | undefined;
+            enabled?: boolean | undefined;
+            presets?: string | string[] | undefined;
+            overrides?: Record<string, {
+                filesystem?: {
+                    allow_write?: string[] | undefined;
+                    deny_read?: string[] | undefined;
+                    deny_write?: string[] | undefined;
+                    allow_read?: string[] | undefined;
+                } | undefined;
+                network?: {
+                    allowed_domains?: string[] | undefined;
+                    denied_domains?: string[] | undefined;
+                } | undefined;
+            }> | undefined;
+        }>>;
         middleware: z.ZodOptional<z.ZodArray<z.ZodObject<{
             name: z.ZodEnum<["schema-validator", "rate-limiter", "untrusted-envelope", "strip-query-params", "output-injection-detector", "canary-token-injector", "output-size-limiter", "output-summarizer", "injection-detector", "sensitivity-classifier"]>;
             enabled: z.ZodDefault<z.ZodBoolean>;
@@ -1353,13 +2235,52 @@ export declare const GatewayConfig: z.ZodObject<{
             max_response_bytes: number;
             timeout_ms: number;
         };
+        sandbox: {
+            filesystem: {
+                allow_write: string[];
+                deny_read: string[];
+                deny_write: string[];
+                allow_read?: string[] | undefined;
+            };
+            network: {
+                allowed_domains: string[];
+                denied_domains: string[];
+            };
+            enabled: boolean;
+            presets: string[];
+            overrides: Record<string, {
+                filesystem?: {
+                    allow_write: string[];
+                    deny_read: string[];
+                    deny_write: string[];
+                    allow_read?: string[] | undefined;
+                } | undefined;
+                network?: {
+                    allowed_domains: string[];
+                    denied_domains: string[];
+                } | undefined;
+            }>;
+        };
         allow: string[];
         ask: string[];
         deny: string[];
         extends: string[];
         tool_overrides: Record<string, {
-            trusted: boolean;
+            sandbox_presets: string[];
             description?: string | undefined;
+            alias_of?: string | undefined;
+            sandbox?: {
+                filesystem?: {
+                    allow_write: string[];
+                    deny_read: string[];
+                    deny_write: string[];
+                    allow_read?: string[] | undefined;
+                } | undefined;
+                network?: {
+                    allowed_domains: string[];
+                    denied_domains: string[];
+                } | undefined;
+            } | undefined;
         }>;
         exec: {
             env: Record<string, string>;
@@ -1392,6 +2313,32 @@ export declare const GatewayConfig: z.ZodObject<{
             max_response_bytes?: number | undefined;
             timeout_ms?: number | undefined;
         } | undefined;
+        sandbox?: {
+            filesystem?: {
+                allow_write?: string[] | undefined;
+                deny_read?: string[] | undefined;
+                deny_write?: string[] | undefined;
+                allow_read?: string[] | undefined;
+            } | undefined;
+            network?: {
+                allowed_domains?: string[] | undefined;
+                denied_domains?: string[] | undefined;
+            } | undefined;
+            enabled?: boolean | undefined;
+            presets?: string | string[] | undefined;
+            overrides?: Record<string, {
+                filesystem?: {
+                    allow_write?: string[] | undefined;
+                    deny_read?: string[] | undefined;
+                    deny_write?: string[] | undefined;
+                    allow_read?: string[] | undefined;
+                } | undefined;
+                network?: {
+                    allowed_domains?: string[] | undefined;
+                    denied_domains?: string[] | undefined;
+                } | undefined;
+            }> | undefined;
+        } | undefined;
         allow?: string[] | undefined;
         ask?: string[] | undefined;
         deny?: string[] | undefined;
@@ -1399,7 +2346,20 @@ export declare const GatewayConfig: z.ZodObject<{
         extends?: string[] | undefined;
         tool_overrides?: Record<string, {
             description?: string | undefined;
-            trusted?: boolean | undefined;
+            alias_of?: string | undefined;
+            sandbox_presets?: string | string[] | undefined;
+            sandbox?: {
+                filesystem?: {
+                    allow_write?: string[] | undefined;
+                    deny_read?: string[] | undefined;
+                    deny_write?: string[] | undefined;
+                    allow_read?: string[] | undefined;
+                } | undefined;
+                network?: {
+                    allowed_domains?: string[] | undefined;
+                    denied_domains?: string[] | undefined;
+                } | undefined;
+            } | undefined;
         }> | undefined;
         exec?: {
             env?: Record<string, string> | undefined;
@@ -1736,6 +2696,18 @@ export declare const GatewayConfig: z.ZodObject<{
         api_secret?: string | undefined;
     }>>;
 }, "strip", z.ZodTypeAny, {
+    sandbox_presets: Record<string, {
+        filesystem?: {
+            allow_write: string[];
+            deny_read: string[];
+            deny_write: string[];
+            allow_read?: string[] | undefined;
+        } | undefined;
+        network?: {
+            allowed_domains: string[];
+            denied_domains: string[];
+        } | undefined;
+    }>;
     providers: Record<string, {
         type: "stdio";
         command: string;
@@ -1798,13 +2770,52 @@ export declare const GatewayConfig: z.ZodObject<{
             max_response_bytes: number;
             timeout_ms: number;
         };
+        sandbox: {
+            filesystem: {
+                allow_write: string[];
+                deny_read: string[];
+                deny_write: string[];
+                allow_read?: string[] | undefined;
+            };
+            network: {
+                allowed_domains: string[];
+                denied_domains: string[];
+            };
+            enabled: boolean;
+            presets: string[];
+            overrides: Record<string, {
+                filesystem?: {
+                    allow_write: string[];
+                    deny_read: string[];
+                    deny_write: string[];
+                    allow_read?: string[] | undefined;
+                } | undefined;
+                network?: {
+                    allowed_domains: string[];
+                    denied_domains: string[];
+                } | undefined;
+            }>;
+        };
         allow: string[];
         ask: string[];
         deny: string[];
         extends: string[];
         tool_overrides: Record<string, {
-            trusted: boolean;
+            sandbox_presets: string[];
             description?: string | undefined;
+            alias_of?: string | undefined;
+            sandbox?: {
+                filesystem?: {
+                    allow_write: string[];
+                    deny_read: string[];
+                    deny_write: string[];
+                    allow_read?: string[] | undefined;
+                } | undefined;
+                network?: {
+                    allowed_domains: string[];
+                    denied_domains: string[];
+                } | undefined;
+            } | undefined;
         }>;
         exec: {
             env: Record<string, string>;
@@ -1904,6 +2915,458 @@ export declare const GatewayConfig: z.ZodObject<{
         api_secret?: string | undefined;
     };
 }, {
+    sandbox_presets?: Record<string, {
+        filesystem?: {
+            allow_write?: string[] | undefined;
+            deny_read?: string[] | undefined;
+            deny_write?: string[] | undefined;
+            allow_read?: string[] | undefined;
+        } | undefined;
+        network?: {
+            allowed_domains?: string[] | undefined;
+            denied_domains?: string[] | undefined;
+        } | undefined;
+    }> | undefined;
+    providers?: Record<string, {
+        type: "stdio";
+        command: string;
+        args?: string[] | undefined;
+        env?: Record<string, string> | undefined;
+    } | {
+        url: string;
+        type: "sse";
+        headers?: Record<string, string> | undefined;
+    } | {
+        url: string;
+        type: "http";
+        oauth?: boolean | undefined;
+        headers?: Record<string, string> | undefined;
+        oauth_callback_port?: number | undefined;
+    } | "builtin"> | undefined;
+    profiles?: Record<string, {
+        allow?: string[] | undefined;
+        ask?: string[] | undefined;
+    }> | undefined;
+    clis?: Record<string, {
+        cwd?: string | undefined;
+        discovered?: string | undefined;
+        shell?: string | undefined;
+        max_output_bytes?: number | undefined;
+        commands?: Record<string, {
+            exec: string;
+            params?: Record<string, {
+                type: "string" | "number" | "boolean";
+                default?: string | number | boolean | undefined;
+                description?: string | undefined;
+                required?: boolean | undefined;
+                flag?: string | undefined;
+                positional?: boolean | undefined;
+            }> | undefined;
+            description?: string | undefined;
+            timeout?: number | undefined;
+            cwd?: string | undefined;
+        }> | undefined;
+    }> | undefined;
+    apis?: Record<string, {
+        spec: string;
+        max_response_bytes?: number | undefined;
+        timeout_ms?: number | undefined;
+        exclude?: string[] | undefined;
+        base_url?: string | undefined;
+        auth?: {
+            type: "bearer";
+            token: string;
+        } | {
+            name: string;
+            type: "header";
+            value: string;
+        } | undefined;
+        include?: string[] | undefined;
+    }> | undefined;
+    agents?: Record<string, {
+        http?: {
+            domain_allowlist?: string[] | undefined;
+            max_response_bytes?: number | undefined;
+            timeout_ms?: number | undefined;
+        } | undefined;
+        sandbox?: {
+            filesystem?: {
+                allow_write?: string[] | undefined;
+                deny_read?: string[] | undefined;
+                deny_write?: string[] | undefined;
+                allow_read?: string[] | undefined;
+            } | undefined;
+            network?: {
+                allowed_domains?: string[] | undefined;
+                denied_domains?: string[] | undefined;
+            } | undefined;
+            enabled?: boolean | undefined;
+            presets?: string | string[] | undefined;
+            overrides?: Record<string, {
+                filesystem?: {
+                    allow_write?: string[] | undefined;
+                    deny_read?: string[] | undefined;
+                    deny_write?: string[] | undefined;
+                    allow_read?: string[] | undefined;
+                } | undefined;
+                network?: {
+                    allowed_domains?: string[] | undefined;
+                    denied_domains?: string[] | undefined;
+                } | undefined;
+            }> | undefined;
+        } | undefined;
+        allow?: string[] | undefined;
+        ask?: string[] | undefined;
+        deny?: string[] | undefined;
+        token?: string | undefined;
+        extends?: string[] | undefined;
+        tool_overrides?: Record<string, {
+            description?: string | undefined;
+            alias_of?: string | undefined;
+            sandbox_presets?: string | string[] | undefined;
+            sandbox?: {
+                filesystem?: {
+                    allow_write?: string[] | undefined;
+                    deny_read?: string[] | undefined;
+                    deny_write?: string[] | undefined;
+                    allow_read?: string[] | undefined;
+                } | undefined;
+                network?: {
+                    allowed_domains?: string[] | undefined;
+                    denied_domains?: string[] | undefined;
+                } | undefined;
+            } | undefined;
+        }> | undefined;
+        exec?: {
+            env?: Record<string, string> | undefined;
+            allow?: string[] | undefined;
+            ask?: string[] | undefined;
+            deny?: string[] | undefined;
+            default_timeout_ms?: number | undefined;
+        } | undefined;
+        middleware?: {
+            name: "schema-validator" | "rate-limiter" | "untrusted-envelope" | "strip-query-params" | "output-injection-detector" | "canary-token-injector" | "output-size-limiter" | "output-summarizer" | "injection-detector" | "sensitivity-classifier";
+            model?: string | undefined;
+            tools?: string[] | undefined;
+            enabled?: boolean | undefined;
+            exclude?: string[] | undefined;
+            max_requests?: number | undefined;
+            window_ms?: number | undefined;
+            per?: "agent" | "tool" | undefined;
+            mode?: "detect" | "mangle" | "escalate" | undefined;
+            backend?: "regex" | "deberta" | "heuristic" | "llm" | undefined;
+            inference_url?: string | undefined;
+            threshold?: number | undefined;
+            max_lines?: number | undefined;
+            max_chars?: number | undefined;
+            threshold_chars?: number | undefined;
+        }[] | undefined;
+    }> | undefined;
+    approvals?: {
+        timeout_ms?: number | undefined;
+        provider?: {
+            type: "telegram";
+            bot_token: string;
+            chat_id: string;
+        } | {
+            type: "openclaw";
+            token: string;
+            gateway_url?: string | undefined;
+            session_key?: string | undefined;
+        } | {
+            type: "slack";
+            webhook_url: string;
+        } | {
+            url: string;
+            type: "webhook";
+            headers?: Record<string, string> | undefined;
+        } | {
+            type: "tui";
+        } | {
+            type: "macos";
+            sound?: string | undefined;
+        } | {
+            type: "dashboard";
+            port?: number | undefined;
+        } | {
+            type: "stdio";
+        } | ({
+            type: "telegram";
+            bot_token: string;
+            chat_id: string;
+        } | {
+            type: "openclaw";
+            token: string;
+            gateway_url?: string | undefined;
+            session_key?: string | undefined;
+        } | {
+            type: "slack";
+            webhook_url: string;
+        } | {
+            url: string;
+            type: "webhook";
+            headers?: Record<string, string> | undefined;
+        } | {
+            type: "tui";
+        } | {
+            type: "macos";
+            sound?: string | undefined;
+        } | {
+            type: "dashboard";
+            port?: number | undefined;
+        } | {
+            type: "stdio";
+        })[] | undefined;
+        batch_window_ms?: number | undefined;
+    } | undefined;
+    security?: {
+        blocked_hosts?: string[] | undefined;
+        allowed_local?: string[] | undefined;
+    } | undefined;
+    audit?: {
+        db_path?: string | undefined;
+        retention_days?: number | undefined;
+        redact_fields?: string[] | undefined;
+    } | undefined;
+    server?: {
+        port?: number | undefined;
+        host?: string | undefined;
+        api_secret?: string | undefined;
+    } | undefined;
+}>, {
+    agents: {
+        [k: string]: {
+            http: {
+                domain_allowlist: string[];
+                max_response_bytes: number;
+                timeout_ms: number;
+            };
+            sandbox: {
+                filesystem: {
+                    allow_write: string[];
+                    deny_read: string[];
+                    deny_write: string[];
+                    allow_read?: string[] | undefined;
+                };
+                network: {
+                    allowed_domains: string[];
+                    denied_domains: string[];
+                };
+                enabled: boolean;
+                presets: string[];
+                overrides: Record<string, {
+                    filesystem?: {
+                        allow_write: string[];
+                        deny_read: string[];
+                        deny_write: string[];
+                        allow_read?: string[] | undefined;
+                    } | undefined;
+                    network?: {
+                        allowed_domains: string[];
+                        denied_domains: string[];
+                    } | undefined;
+                }>;
+            };
+            allow: string[];
+            ask: string[];
+            deny: string[];
+            extends: string[];
+            tool_overrides: Record<string, {
+                sandbox_presets: string[];
+                description?: string | undefined;
+                alias_of?: string | undefined;
+                sandbox?: {
+                    filesystem?: {
+                        allow_write: string[];
+                        deny_read: string[];
+                        deny_write: string[];
+                        allow_read?: string[] | undefined;
+                    } | undefined;
+                    network?: {
+                        allowed_domains: string[];
+                        denied_domains: string[];
+                    } | undefined;
+                } | undefined;
+            }>;
+            exec: {
+                env: Record<string, string>;
+                allow: string[];
+                ask: string[];
+                deny: string[];
+                default_timeout_ms: number;
+            };
+            token?: string | undefined;
+            middleware?: {
+                name: "schema-validator" | "rate-limiter" | "untrusted-envelope" | "strip-query-params" | "output-injection-detector" | "canary-token-injector" | "output-size-limiter" | "output-summarizer" | "injection-detector" | "sensitivity-classifier";
+                enabled: boolean;
+                model?: string | undefined;
+                tools?: string[] | undefined;
+                exclude?: string[] | undefined;
+                max_requests?: number | undefined;
+                window_ms?: number | undefined;
+                per?: "agent" | "tool" | undefined;
+                mode?: "detect" | "mangle" | "escalate" | undefined;
+                backend?: "regex" | "deberta" | "heuristic" | "llm" | undefined;
+                inference_url?: string | undefined;
+                threshold?: number | undefined;
+                max_lines?: number | undefined;
+                max_chars?: number | undefined;
+                threshold_chars?: number | undefined;
+            }[] | undefined;
+        };
+    };
+    sandbox_presets: Record<string, {
+        filesystem?: {
+            allow_write: string[];
+            deny_read: string[];
+            deny_write: string[];
+            allow_read?: string[] | undefined;
+        } | undefined;
+        network?: {
+            allowed_domains: string[];
+            denied_domains: string[];
+        } | undefined;
+    }>;
+    providers: Record<string, {
+        type: "stdio";
+        command: string;
+        args: string[];
+        env?: Record<string, string> | undefined;
+    } | {
+        url: string;
+        type: "sse";
+        headers?: Record<string, string> | undefined;
+    } | {
+        url: string;
+        type: "http";
+        oauth: boolean;
+        oauth_callback_port: number;
+        headers?: Record<string, string> | undefined;
+    } | "builtin">;
+    profiles: Record<string, {
+        allow: string[];
+        ask: string[];
+    }>;
+    clis: Record<string, {
+        max_output_bytes: number;
+        commands: Record<string, {
+            params: Record<string, {
+                type: "string" | "number" | "boolean";
+                required: boolean;
+                positional: boolean;
+                default?: string | number | boolean | undefined;
+                description?: string | undefined;
+                flag?: string | undefined;
+            }>;
+            timeout: number;
+            exec: string;
+            description?: string | undefined;
+            cwd?: string | undefined;
+        }>;
+        cwd?: string | undefined;
+        discovered?: string | undefined;
+        shell?: string | undefined;
+    }>;
+    apis: Record<string, {
+        max_response_bytes: number;
+        timeout_ms: number;
+        spec: string;
+        exclude?: string[] | undefined;
+        base_url?: string | undefined;
+        auth?: {
+            type: "bearer";
+            token: string;
+        } | {
+            name: string;
+            type: "header";
+            value: string;
+        } | undefined;
+        include?: string[] | undefined;
+    }>;
+    approvals: {
+        timeout_ms: number;
+        provider: {
+            type: "telegram";
+            bot_token: string;
+            chat_id: string;
+        } | {
+            type: "openclaw";
+            token: string;
+            gateway_url: string;
+            session_key: string;
+        } | {
+            type: "slack";
+            webhook_url: string;
+        } | {
+            url: string;
+            type: "webhook";
+            headers: Record<string, string>;
+        } | {
+            type: "tui";
+        } | {
+            type: "macos";
+            sound?: string | undefined;
+        } | {
+            type: "dashboard";
+            port: number;
+        } | {
+            type: "stdio";
+        } | ({
+            type: "telegram";
+            bot_token: string;
+            chat_id: string;
+        } | {
+            type: "openclaw";
+            token: string;
+            gateway_url: string;
+            session_key: string;
+        } | {
+            type: "slack";
+            webhook_url: string;
+        } | {
+            url: string;
+            type: "webhook";
+            headers: Record<string, string>;
+        } | {
+            type: "tui";
+        } | {
+            type: "macos";
+            sound?: string | undefined;
+        } | {
+            type: "dashboard";
+            port: number;
+        } | {
+            type: "stdio";
+        })[];
+        batch_window_ms: number;
+    };
+    security: {
+        blocked_hosts: string[];
+        allowed_local: string[];
+    };
+    audit: {
+        db_path: string;
+        retention_days: number;
+        redact_fields: string[];
+    };
+    server: {
+        port: number;
+        host: string;
+        api_secret?: string | undefined;
+    };
+}, {
+    sandbox_presets?: Record<string, {
+        filesystem?: {
+            allow_write?: string[] | undefined;
+            deny_read?: string[] | undefined;
+            deny_write?: string[] | undefined;
+            allow_read?: string[] | undefined;
+        } | undefined;
+        network?: {
+            allowed_domains?: string[] | undefined;
+            denied_domains?: string[] | undefined;
+        } | undefined;
+    }> | undefined;
     providers?: Record<string, {
         type: "stdio";
         command: string;
@@ -1966,6 +3429,32 @@ export declare const GatewayConfig: z.ZodObject<{
             max_response_bytes?: number | undefined;
             timeout_ms?: number | undefined;
         } | undefined;
+        sandbox?: {
+            filesystem?: {
+                allow_write?: string[] | undefined;
+                deny_read?: string[] | undefined;
+                deny_write?: string[] | undefined;
+                allow_read?: string[] | undefined;
+            } | undefined;
+            network?: {
+                allowed_domains?: string[] | undefined;
+                denied_domains?: string[] | undefined;
+            } | undefined;
+            enabled?: boolean | undefined;
+            presets?: string | string[] | undefined;
+            overrides?: Record<string, {
+                filesystem?: {
+                    allow_write?: string[] | undefined;
+                    deny_read?: string[] | undefined;
+                    deny_write?: string[] | undefined;
+                    allow_read?: string[] | undefined;
+                } | undefined;
+                network?: {
+                    allowed_domains?: string[] | undefined;
+                    denied_domains?: string[] | undefined;
+                } | undefined;
+            }> | undefined;
+        } | undefined;
         allow?: string[] | undefined;
         ask?: string[] | undefined;
         deny?: string[] | undefined;
@@ -1973,7 +3462,20 @@ export declare const GatewayConfig: z.ZodObject<{
         extends?: string[] | undefined;
         tool_overrides?: Record<string, {
             description?: string | undefined;
-            trusted?: boolean | undefined;
+            alias_of?: string | undefined;
+            sandbox_presets?: string | string[] | undefined;
+            sandbox?: {
+                filesystem?: {
+                    allow_write?: string[] | undefined;
+                    deny_read?: string[] | undefined;
+                    deny_write?: string[] | undefined;
+                    allow_read?: string[] | undefined;
+                } | undefined;
+                network?: {
+                    allowed_domains?: string[] | undefined;
+                    denied_domains?: string[] | undefined;
+                } | undefined;
+            } | undefined;
         }> | undefined;
         exec?: {
             env?: Record<string, string> | undefined;