airlock-bot 0.2.36 → 0.2.38

package/dist/config/loader.js

@@ -1,19 +1,92 @@
 import { readFileSync } from 'fs';
+import { isIP } from 'net';
 import { parse as parseYaml } from 'yaml';
-import { GatewayConfig, getBuiltinProviders } from './schema.js';
+import { GatewayConfig, getBuiltinProviders, withEnvVarResolution } from './schema.js';
 import { applyProfiles } from './profiles.js';
 import { matches } from '../allowlist/pattern.js';
+import { AIRLOCK_NON_ASK_TOOLS } from '../airlock/tools.js';
 import { childLogger } from '../util/logger.js';
 const log = childLogger('config');
-export function loadConfig(path) {
-    const raw = readFileSync(path, 'utf-8');
-    const parsed = parseYaml(raw);
-    const result = GatewayConfig.safeParse(parsed);
+export function loadConfigDetailed(path, options = {}) {
+    let raw;
+    try {
+        raw = readFileSync(path, 'utf-8');
+    }
+    catch (err) {
+        return {
+            diagnostics: [
+                {
+                    level: 'error',
+                    message: `Could not read config at ${path}: ${err instanceof Error ? err.message : String(err)}`,
+                },
+            ],
+        };
+    }
+    let parsed;
+    try {
+        parsed = parseYaml(raw);
+    }
+    catch (err) {
+        return {
+            diagnostics: [
+                {
+                    level: 'error',
+                    message: `Invalid YAML at ${path}: ${err instanceof Error ? err.message : String(err)}`,
+                },
+            ],
+        };
+    }
+    const diagnostics = findUnknownKeys(parsed);
+    const resolveEnv = options.resolveEnv ?? true;
+    let result;
+    try {
+        result = withEnvVarResolution(resolveEnv, () => GatewayConfig.safeParse(parsed));
+    }
+    catch (err) {
+        diagnostics.push({
+            level: 'error',
+            message: `Invalid config at ${path}:\n${err instanceof Error ? err.message : String(err)}`,
+            suggestion: resolveEnv
+                ? 'Set the referenced environment variable, or run config check with --no-resolve for structural validation without secrets.'
+                : undefined,
+        });
+        return { diagnostics: dedupeDiagnostics(diagnostics) };
+    }
     if (!result.success) {
-        throw new Error(`Invalid config at ${path}:\n${result.error.toString()}`);
+        diagnostics.push({
+            level: 'error',
+            message: `Invalid config at ${path}:\n${result.error.toString()}`,
+        });
+        return { diagnostics: dedupeDiagnostics(diagnostics) };
+    }
+    const rawConfig = structuredClone(result.data);
+    diagnostics.push(...validateConfig(result.data));
+    diagnostics.push(...validateRawArgDimensionUsage(result.data));
+    diagnostics.push(...validateYamlScalarFootguns(result.data));
+    if (!diagnostics.some((diagnostic) => diagnostic.level === 'error')) {
+        try {
+            applyProfiles(result.data);
+        }
+        catch (err) {
+            diagnostics.push({
+                level: 'error',
+                message: err instanceof Error ? err.message : String(err),
+            });
+        }
+    }
+    if (!diagnostics.some((diagnostic) => diagnostic.level === 'error')) {
+        diagnostics.push(...validateConfig(result.data));
+        diagnostics.push(...validateEffectiveArgRestrictions(rawConfig, result.data));
     }
-    const diagnostics = validateConfig(result.data);
-    for (const d of diagnostics) {
+    return {
+        config: result.data,
+        rawConfig,
+        diagnostics: dedupeDiagnostics(diagnostics),
+    };
+}
+export function loadConfig(path, options = {}) {
+    const result = loadConfigDetailed(path, options);
+    for (const d of result.diagnostics) {
         const ctx = d.agent ? { agent: d.agent } : {};
         const msg = d.suggestion ? `${d.message}\n  → ${d.suggestion}` : d.message;
         if (d.level === 'error') {
@@ -26,13 +99,15 @@ export function loadConfig(path) {
             log.info(ctx, msg);
         }
     }
-    const errors = diagnostics.filter((d) => d.level === 'error');
+    const errors = result.diagnostics.filter((d) => d.level === 'error');
     if (errors.length > 0) {
         throw new Error(`Config validation failed with ${errors.length} error(s):\n` +
             errors.map((e) => `  - ${e.agent ? `[${e.agent}] ` : ''}${e.message}`).join('\n'));
     }
-    applyProfiles(result.data);
-    return result.data;
+    if (!result.config) {
+        throw new Error(`Config validation failed without a parsed config.`);
+    }
+    return result.config;
 }
 export function validateConfig(config) {
     const diagnostics = [];
@@ -41,15 +116,27 @@ export function validateConfig(config) {
     const profileNames = new Set(Object.keys(config.profiles));
     const sandboxPresetNames = new Set(Object.keys(config.sandbox_presets ?? {}));
     const serverHost = config.server.host;
-    const loopbackHosts = new Set(['127.0.0.1', 'localhost', '::1']);
-    const isLoopback = loopbackHosts.has(serverHost);
-    const exposesNonMcpRoutes = config.server.expose_management_api ||
-        config.server.expose_tools_api ||
-        config.server.expose_hook_api;
+    const isLoopback = isLoopbackHost(serverHost);
+    const managementApiEnabled = config.server.management_api.enabled;
+    const managementApiSecret = config.server.management_api.api_secret;
     const agentsWithoutTokens = Object.entries(config.agents)
         .filter(([, agent]) => !agent.token)
         .map(([agentId]) => agentId);
-    const requireAgentTokens = config.server.require_agent_tokens || !isLoopback;
+    const requireAgentTokens = config.server.require_agent_tokens || !isLoopback || managementApiEnabled;
+    if (config.server.expose_management_api !== undefined) {
+        diagnostics.push({
+            level: 'warn',
+            message: 'server.expose_management_api is deprecated.',
+            suggestion: 'Use server.management_api.enabled instead.',
+        });
+    }
+    if (config.server.expose_hook_api !== undefined) {
+        diagnostics.push({
+            level: 'warn',
+            message: 'server.expose_hook_api is deprecated.',
+            suggestion: 'Use server.management_api.expose_hook_api instead.',
+        });
+    }
     if (!isLoopback && !config.server.auth_required) {
         diagnostics.push({
             level: 'error',
@@ -61,7 +148,7 @@ export function validateConfig(config) {
         diagnostics.push({
             level: 'error',
             message: 'Per-agent tokens are required, but some agents have no token.',
-            suggestion: `Add token to agents: ${agentsWithoutTokens.join(', ')}. For reverse-proxy exposure on loopback, set server.require_agent_tokens: true to keep this check enabled.`,
+            suggestion: `Add token to agents: ${agentsWithoutTokens.join(', ')}. Per-agent tokens are required for non-loopback data-plane binds, explicit server.require_agent_tokens, and split management API mode.`,
         });
     }
     if (config.server.auth_required) {
@@ -72,26 +159,69 @@ export function validateConfig(config) {
                 suggestion: `Set server.api_secret or add token to agents: ${agentsWithoutTokens.join(', ')}.`,
             });
         }
-        if (!config.server.api_secret && exposesNonMcpRoutes) {
+        if (!managementApiSecret && !config.server.api_secret && managementApiEnabled) {
             diagnostics.push({
                 level: 'error',
-                message: 'server.auth_required is true, but non-MCP APIs are exposed without server.api_secret.',
-                suggestion: 'Set server.api_secret, or disable expose_management_api, expose_tools_api, and expose_hook_api.',
+                message: 'server.auth_required is true, but the control-plane management API is enabled without a credential.',
+                suggestion: 'Set server.management_api.api_secret, set server.api_secret as a temporary fallback, or disable server.management_api.enabled.',
             });
         }
     }
+    if (managementApiEnabled && !managementApiSecret && !config.server.api_secret) {
+        diagnostics.push({
+            level: 'error',
+            message: 'server.management_api.enabled requires server.management_api.api_secret or server.api_secret.',
+            suggestion: 'Set server.management_api.api_secret so control-plane requests require bearer-token auth.',
+        });
+    }
+    if (managementApiEnabled && !managementApiSecret && config.server.api_secret) {
+        diagnostics.push({
+            level: 'warn',
+            message: 'management_api is using server.api_secret; set server.management_api.api_secret to separate the control-plane secret from the data-plane fallback.',
+            suggestion: 'Generate a fresh management secret, set server.management_api.api_secret, and update management clients to use it.',
+        });
+    }
+    if (managementApiEnabled &&
+        managementApiSecret &&
+        config.server.api_secret &&
+        managementApiSecret === config.server.api_secret) {
+        diagnostics.push({
+            level: 'warn',
+            message: 'server.management_api.api_secret matches server.api_secret; rotate one secret to separate the control-plane credential from the data-plane fallback.',
+            suggestion: 'Use different resolved values for server.management_api.api_secret and server.api_secret.',
+        });
+    }
+    if (managementApiEnabled &&
+        !isLoopbackHost(config.server.management_api.host) &&
+        !config.server.management_api.insecure_remote_bind) {
+        diagnostics.push({
+            level: 'error',
+            message: 'server.management_api.host is non-loopback while insecure_remote_bind is false.',
+            suggestion: 'Keep server.management_api.host on 127.0.0.1/::1, or explicitly set server.management_api.insecure_remote_bind: true and restrict the control-plane port with network ACLs.',
+        });
+    }
+    if (managementApiEnabled && config.server.management_api.port === config.server.port) {
+        diagnostics.push({
+            level: 'error',
+            message: 'Control-plane and data-plane must not share a socket.',
+            suggestion: 'Set server.management_api.port to a different port than server.port so admin/audit/approval routes cannot co-host with agent MCP routes.',
+        });
+    }
     for (const [agentId, agent] of Object.entries(config.agents)) {
         // Check for unknown profile references
         for (const ref of agent.extends) {
             if (!profileNames.has(ref)) {
                 diagnostics.push({
                     level: 'error',
+                    code: 'unknown-profile-ref',
                     agent: agentId,
                     message: `extends references unknown profile "${ref}".`,
                     suggestion: `Add "${ref}" to your profiles block, or check for typos.`,
                 });
             }
         }
+        diagnostics.push(...validateArgScopeRefs(config, agent.arg_scope, `agents.${agentId}.arg_scope`, agentId));
+        diagnostics.push(...validateArgPolicyRefs(config, agent.arg_policy, `agents.${agentId}.arg_policy`, agentId));
         for (const presetName of agent.sandbox.presets) {
             if (!sandboxPresetNames.has(presetName)) {
                 diagnostics.push({
@@ -103,6 +233,7 @@ export function validateConfig(config) {
             }
         }
         for (const [toolName, override] of Object.entries(agent.tool_overrides)) {
+            diagnostics.push(...validateArgPolicyRefs(config, override.args ? { [toolName]: override.args } : undefined, `agents.${agentId}.tool_overrides.${toolName}.args`, agentId));
             for (const presetName of override.sandbox_presets ?? []) {
                 if (!sandboxPresetNames.has(presetName)) {
                     diagnostics.push({
@@ -117,6 +248,9 @@ export function validateConfig(config) {
         // Collect all referenced namespaces from allow/ask/deny
         const allPatterns = [...agent.allow, ...agent.ask, ...agent.deny];
         const referencedNamespaces = new Set();
+        const toolOverrideNamespaces = new Set(Object.keys(agent.tool_overrides)
+            .map((toolName) => toolName.split('/')[0])
+            .filter((namespace) => !!namespace));
         for (const pattern of allPatterns) {
             const ns = pattern.split('/')[0];
             if (ns)
@@ -124,7 +258,7 @@ export function validateConfig(config) {
         }
         // Check for unknown providers
         for (const ns of referencedNamespaces) {
-            if (!providerNames.has(ns)) {
+            if (!providerNames.has(ns) && !toolOverrideNamespaces.has(ns)) {
                 diagnostics.push({
                     level: 'error',
                     agent: agentId,
@@ -150,6 +284,15 @@ export function validateConfig(config) {
         }
         // Check for unreachable ask: ask pattern also matched by deny
         for (const askPattern of agent.ask) {
+            const forbiddenAirlockTool = AIRLOCK_NON_ASK_TOOLS.find((tool) => matches(askPattern, tool));
+            if (forbiddenAirlockTool) {
+                diagnostics.push({
+                    level: 'error',
+                    agent: agentId,
+                    message: `"${askPattern}" puts ${forbiddenAirlockTool} behind ask, which is not allowed.`,
+                    suggestion: 'Move Airlock human-attention tools to allow or deny. They cannot require approval without creating recursive approval.',
+                });
+            }
             for (const denyPattern of agent.deny) {
                 if (matches(denyPattern, askPattern) ||
                     matches(askPattern, denyPattern) ||
@@ -184,7 +327,7 @@ export function validateConfig(config) {
             });
         }
         // Check empty agent
-        if (agent.allow.length === 0 && agent.ask.length === 0) {
+        if (agent.extends.length === 0 && agent.allow.length === 0 && agent.ask.length === 0) {
             diagnostics.push({
                 level: 'info',
                 agent: agentId,
@@ -201,6 +344,20 @@ export function validateConfig(config) {
             });
         }
     }
+    for (const [profileId, profile] of Object.entries(config.profiles)) {
+        for (const ref of profile.extends) {
+            if (!profileNames.has(ref)) {
+                diagnostics.push({
+                    level: 'error',
+                    code: 'unknown-profile-ref',
+                    message: `Profile "${profileId}" extends unknown profile "${ref}".`,
+                    suggestion: `Add "${ref}" to your profiles block, or check for typos.`,
+                });
+            }
+        }
+        diagnostics.push(...validateArgScopeRefs(config, profile.arg_scope, `profiles.${profileId}.arg_scope`));
+        diagnostics.push(...validateArgPolicyRefs(config, profile.arg_policy, `profiles.${profileId}.arg_policy`));
+    }
     // Validate CLI configs
     for (const [cliId, cli] of Object.entries(config.clis)) {
         for (const [cmdName, cmd] of Object.entries(cli.commands)) {
@@ -225,6 +382,625 @@ export function validateConfig(config) {
     }
     return diagnostics;
 }
+function validateArgScopeRefs(config, argScope, location, agent) {
+    const diagnostics = [];
+    if (!argScope)
+        return diagnostics;
+    const providerNames = new Set(Object.keys(config.providers));
+    for (const [dimensionName, valueSetNames] of Object.entries(argScope)) {
+        const dimension = config.arg_dimensions[dimensionName];
+        if (!dimension) {
+            diagnostics.push({
+                level: 'error',
+                code: 'unknown-arg-dimension-ref',
+                agent,
+                message: `${location} references unknown arg_dimension "${dimensionName}".`,
+                suggestion: `Add "${dimensionName}" to arg_dimensions, or check for typos.`,
+            });
+            continue;
+        }
+        for (const valueSetName of valueSetNames) {
+            if (!config.value_sets[valueSetName]) {
+                diagnostics.push({
+                    level: 'error',
+                    code: 'unknown-value-set-ref',
+                    agent,
+                    message: `${location}.${dimensionName} references unknown value_set "${valueSetName}".`,
+                    suggestion: `Add "${valueSetName}" to value_sets, or check for typos.`,
+                });
+            }
+        }
+        for (const toolName of Object.keys(dimension.bindings)) {
+            const providerName = toolName.split('/')[0];
+            if (providerName && !providerNames.has(providerName)) {
+                diagnostics.push({
+                    level: 'warn',
+                    agent,
+                    message: `arg_dimensions.${dimensionName}.bindings references tool "${toolName}" from unknown provider "${providerName}".`,
+                    suggestion: 'Declare the provider, remove the binding, or leave it only if this config fragment is merged with providers elsewhere.',
+                });
+            }
+        }
+    }
+    return diagnostics;
+}
+function validateArgPolicyRefs(config, argPolicy, location, agent) {
+    const diagnostics = [];
+    if (!argPolicy)
+        return diagnostics;
+    for (const [toolName, toolPolicy] of Object.entries(argPolicy)) {
+        for (const [argName, constraints] of Object.entries(toolPolicy)) {
+            for (const constraint of constraints) {
+                const valueSetName = constraint.in ?? constraint.glob_in ?? constraint.each_in;
+                if (valueSetName && !config.value_sets[valueSetName]) {
+                    diagnostics.push({
+                        level: 'error',
+                        code: 'unknown-value-set-ref',
+                        agent,
+                        message: `${location}.${toolName}.${argName} references unknown value_set "${valueSetName}".`,
+                        suggestion: `Add "${valueSetName}" to value_sets, or check for typos.`,
+                    });
+                }
+            }
+        }
+    }
+    return diagnostics;
+}
+function validateRawArgDimensionUsage(config) {
+    const diagnostics = [];
+    const usedDimensions = new Set();
+    for (const [dimensionName, dimension] of Object.entries(config.arg_dimensions)) {
+        if (Object.keys(dimension.bindings).length === 0) {
+            diagnostics.push({
+                level: 'warn',
+                message: `arg_dimensions.${dimensionName}.bindings is empty.`,
+                suggestion: 'Add at least one tool-to-argument binding, or remove the dimension so arg_scope cannot resolve to a no-op.',
+            });
+        }
+    }
+    for (const agentName of Object.keys(config.agents)) {
+        for (const dimensionName of collectAgentArgScopeDimensions(config, agentName)) {
+            usedDimensions.add(dimensionName);
+        }
+    }
+    for (const dimensionName of Object.keys(config.arg_dimensions)) {
+        if (!usedDimensions.has(dimensionName)) {
+            diagnostics.push({
+                level: 'warn',
+                message: `arg_dimensions.${dimensionName} is not used by any scoped agent.`,
+                suggestion: 'Attach it through an agent arg_scope or through a profile that at least one agent extends.',
+            });
+        }
+    }
+    return diagnostics;
+}
+function validateEffectiveArgRestrictions(rawConfig, resolvedConfig) {
+    const diagnostics = [];
+    for (const [agentName, resolvedAgent] of Object.entries(resolvedConfig.agents)) {
+        const sources = collectAgentArgRestrictionSources(rawConfig, agentName);
+        if (sources.length === 0)
+            continue;
+        if (countArgPolicyConstraints(resolvedAgent.arg_policy) === 0) {
+            diagnostics.push({
+                level: 'error',
+                agent: agentName,
+                message: `Agent declares arg_scope/arg_policy via ${sources.join(', ')} but resolves to zero effective argument constraints.`,
+                suggestion: 'Check that arg_scope dimensions have bindings and referenced value_sets, or remove the no-op restriction.',
+            });
+        }
+    }
+    return diagnostics;
+}
+function validateYamlScalarFootguns(config) {
+    const diagnostics = [];
+    const stringMatchedValueSets = collectStringMatchedValueSets(config);
+    for (const [valueSetName, locations] of stringMatchedValueSets) {
+        const valueSet = config.value_sets[valueSetName];
+        if (!valueSet)
+            continue;
+        valueSet.values.forEach((value, index) => {
+            if (!isUnquotedStringFootgun(value))
+                return;
+            diagnostics.push({
+                level: 'warn',
+                message: `value_sets.${valueSetName}[${index}] value ${String(value)} looks like an unquoted string while used by ${locations.join(', ')}.`,
+                suggestion: `Quote it (${quoteSuggestion(value)}) if it should match string tool arguments.`,
+            });
+        });
+    }
+    for (const source of collectArgPolicySources(config)) {
+        for (const [toolName, toolPolicy] of Object.entries(source.policy ?? {})) {
+            for (const [argName, constraints] of Object.entries(toolPolicy)) {
+                for (const constraint of constraints) {
+                    if (!usesStringNormalizer(constraint.normalize))
+                        continue;
+                    const values = constraint.allow ?? constraint.each_allow;
+                    if (!values)
+                        continue;
+                    values.forEach((value, index) => {
+                        if (!isUnquotedStringFootgun(value))
+                            return;
+                        diagnostics.push({
+                            level: 'warn',
+                            agent: source.agent,
+                            message: `${source.location}.${toolName}.${argName}[${index}] value ${String(value)} looks like an unquoted string while used with normalize: ${constraint.normalize?.join(', ')}.`,
+                            suggestion: `Quote it (${quoteSuggestion(value)}) so string normalization can apply before matching.`,
+                        });
+                    });
+                }
+            }
+        }
+    }
+    return diagnostics;
+}
+function collectAgentArgScopeDimensions(config, agentName) {
+    const agent = config.agents[agentName];
+    if (!agent)
+        return [];
+    const dimensions = new Set();
+    const visitedProfiles = new Set();
+    function visitProfile(profileName) {
+        if (visitedProfiles.has(profileName))
+            return;
+        visitedProfiles.add(profileName);
+        const profile = config.profiles[profileName];
+        if (!profile)
+            return;
+        for (const parentName of profile.extends)
+            visitProfile(parentName);
+        for (const dimensionName of Object.keys(profile.arg_scope ?? {}))
+            dimensions.add(dimensionName);
+    }
+    for (const profileName of agent.extends)
+        visitProfile(profileName);
+    for (const dimensionName of Object.keys(agent.arg_scope ?? {}))
+        dimensions.add(dimensionName);
+    return Array.from(dimensions);
+}
+function collectAgentArgRestrictionSources(config, agentName) {
+    const agent = config.agents[agentName];
+    if (!agent)
+        return [];
+    const sources = [];
+    const visitedProfiles = new Set();
+    function visitProfile(profileName) {
+        if (visitedProfiles.has(profileName))
+            return;
+        visitedProfiles.add(profileName);
+        const profile = config.profiles[profileName];
+        if (!profile)
+            return;
+        for (const parentName of profile.extends)
+            visitProfile(parentName);
+        if (profile.arg_scope)
+            sources.push(`profiles.${profileName}.arg_scope`);
+        if (profile.arg_policy)
+            sources.push(`profiles.${profileName}.arg_policy`);
+    }
+    for (const profileName of agent.extends)
+        visitProfile(profileName);
+    if (agent.arg_scope)
+        sources.push(`agents.${agentName}.arg_scope`);
+    if (agent.arg_policy)
+        sources.push(`agents.${agentName}.arg_policy`);
+    return sources;
+}
+function countArgPolicyConstraints(argPolicy) {
+    let count = 0;
+    for (const toolPolicy of Object.values(argPolicy ?? {})) {
+        for (const constraints of Object.values(toolPolicy)) {
+            count += constraints.length;
+        }
+    }
+    return count;
+}
+function collectStringMatchedValueSets(config) {
+    const valueSets = new Map();
+    function add(valueSetName, location) {
+        if (!valueSetName)
+            return;
+        const locations = valueSets.get(valueSetName) ?? [];
+        if (!locations.includes(location))
+            locations.push(location);
+        valueSets.set(valueSetName, locations);
+    }
+    for (const [agentName, agent] of Object.entries(config.agents)) {
+        collectArgScopeValueSets(config, agent.arg_scope, `agents.${agentName}.arg_scope`, add);
+    }
+    for (const [profileName, profile] of Object.entries(config.profiles)) {
+        collectArgScopeValueSets(config, profile.arg_scope, `profiles.${profileName}.arg_scope`, add);
+    }
+    for (const source of collectArgPolicySources(config)) {
+        for (const [toolName, toolPolicy] of Object.entries(source.policy ?? {})) {
+            for (const [argName, constraints] of Object.entries(toolPolicy)) {
+                for (const constraint of constraints) {
+                    add(constraint.in, `${source.location}.${toolName}.${argName}.in`);
+                    add(constraint.glob_in, `${source.location}.${toolName}.${argName}.glob_in`);
+                    if (usesStringNormalizer(constraint.normalize)) {
+                        add(constraint.each_in, `${source.location}.${toolName}.${argName}.each_in`);
+                    }
+                }
+            }
+        }
+    }
+    return valueSets;
+}
+function collectArgScopeValueSets(config, argScope, location, add) {
+    for (const [dimensionName, valueSetNames] of Object.entries(argScope ?? {})) {
+        const dimension = config.arg_dimensions[dimensionName];
+        const stringMatched = dimension?.match === 'in' ||
+            dimension?.match === 'glob_in' ||
+            usesStringNormalizer(dimension?.normalize);
+        if (!stringMatched)
+            continue;
+        for (const valueSetName of valueSetNames) {
+            add(valueSetName, `${location}.${dimensionName}`);
+        }
+    }
+}
+function collectArgPolicySources(config) {
+    const sources = [];
+    for (const [agentName, agent] of Object.entries(config.agents)) {
+        sources.push({
+            location: `agents.${agentName}.arg_policy`,
+            agent: agentName,
+            policy: agent.arg_policy,
+        });
+        for (const [toolName, override] of Object.entries(agent.tool_overrides)) {
+            if (!override.args)
+                continue;
+            sources.push({
+                location: `agents.${agentName}.tool_overrides.${toolName}.args`,
+                agent: agentName,
+                policy: { [toolName]: override.args },
+            });
+        }
+    }
+    for (const [profileName, profile] of Object.entries(config.profiles)) {
+        sources.push({ location: `profiles.${profileName}.arg_policy`, policy: profile.arg_policy });
+    }
+    return sources;
+}
+function usesStringNormalizer(normalizers) {
+    return !!normalizers?.some((normalizer) => ['phone', 'email', 'lower', 'trim'].includes(normalizer));
+}
+function isUnquotedStringFootgun(value) {
+    return typeof value === 'number' || typeof value === 'boolean';
+}
+function quoteSuggestion(value) {
+    if (typeof value === 'number' && Number.isInteger(value) && value > 1_000_000_000) {
+        return `"+${value}"`;
+    }
+    return `"${String(value)}"`;
+}
+function dedupeDiagnostics(diagnostics) {
+    const seen = new Set();
+    const result = [];
+    for (const diagnostic of diagnostics) {
+        const key = `${diagnostic.level}\0${diagnostic.agent ?? ''}\0${diagnostic.message}`;
+        if (seen.has(key))
+            continue;
+        seen.add(key);
+        result.push(diagnostic);
+    }
+    return result;
+}
+function findUnknownKeys(value) {
+    const diagnostics = [];
+    checkObjectKeys(diagnostics, value, [], rootKeys);
+    return diagnostics;
+}
+const rootKeys = new Set([
+    'providers',
+    'value_sets',
+    'arg_dimensions',
+    'profiles',
+    'sandbox_presets',
+    'clis',
+    'apis',
+    'agents',
+    'approvals',
+    'security',
+    'audit',
+    'server',
+    'lint',
+]);
+const providerKeys = new Set([
+    'type',
+    'enabled',
+    'command',
+    'args',
+    'env',
+    'url',
+    'headers',
+    'oauth',
+    'oauth_callback_port',
+    'oauth_callback_url',
+    'client_id',
+    'client_secret',
+]);
+const agentKeys = new Set([
+    'token',
+    'extends',
+    'allow',
+    'remember_allow',
+    'ask',
+    'deny',
+    'tool_overrides',
+    'arg_policy',
+    'arg_scope',
+    'exec',
+    'http',
+    'sandbox',
+    'middleware',
+]);
+const profileKeys = new Set(['extends', 'allow', 'ask', 'deny', 'arg_policy', 'arg_scope']);
+const serverKeys = new Set([
+    'port',
+    'host',
+    'api_secret',
+    'auth_required',
+    'require_agent_tokens',
+    'allowed_origins',
+    'expose_tools_api',
+    'management_api',
+    'expose_management_api',
+    'expose_hook_api',
+]);
+const managementApiKeys = new Set([
+    'enabled',
+    'api_secret',
+    'host',
+    'port',
+    'insecure_remote_bind',
+    'expose_hook_api',
+]);
+const argDimensionKeys = new Set(['match', 'normalize', 'bindings']);
+const valueSetKeys = new Set(['values', 'expose_values']);
+const sandboxOverrideKeys = new Set(['filesystem', 'network']);
+const sandboxKeys = new Set(['enabled', 'presets', 'filesystem', 'network', 'overrides']);
+const filesystemKeys = new Set(['allow_write', 'deny_read', 'deny_write', 'allow_read']);
+const networkKeys = new Set(['allowed_domains', 'denied_domains']);
+const toolOverrideKeys = new Set(['description', 'alias_of', 'sandbox_presets', 'sandbox', 'args']);
+const argConstraintKeys = new Set([
+    'allow',
+    'equals',
+    'in',
+    'glob_in',
+    'each_in',
+    'glob_allow',
+    'each_allow',
+    'normalize',
+    'path',
+    'required',
+    'label',
+    'value_set',
+    'expose_values',
+]);
+const agentExecKeys = new Set(['allow', 'ask', 'deny', 'env', 'default_timeout_ms']);
+const agentHttpKeys = new Set(['domain_allowlist', 'max_response_bytes', 'timeout_ms']);
+const rememberAllowKeys = new Set(['tool', 'expires_at']);
+const approvalsKeys = new Set(['provider', 'timeout_ms', 'batch_window_ms']);
+const approvalProviderKeys = new Set([
+    'type',
+    'bot_token',
+    'chat_id',
+    'gateway_url',
+    'token',
+    'session_key',
+    'webhook_url',
+    'url',
+    'headers',
+    'sound',
+    'host',
+    'port',
+    'team_id',
+    'key_id',
+    'key_path',
+    'bundle_id',
+    'production',
+    'interruption_level',
+]);
+const securityKeys = new Set(['blocked_hosts', 'allowed_local']);
+const auditKeys = new Set(['db_path', 'retention_days', 'redact_fields']);
+const cliKeys = new Set(['discovered', 'shell', 'cwd', 'max_output_bytes', 'commands']);
+const cliCommandKeys = new Set(['exec', 'description', 'params', 'cwd', 'timeout']);
+const cliParamKeys = new Set(['type', 'flag', 'positional', 'required', 'default', 'description']);
+const apiKeys = new Set([
+    'spec',
+    'base_url',
+    'auth',
+    'include',
+    'exclude',
+    'timeout_ms',
+    'max_response_bytes',
+]);
+const apiAuthKeys = new Set(['type', 'token', 'name', 'value']);
+const middlewareKeys = new Set([
+    'name',
+    'enabled',
+    'tools',
+    'exclude',
+    'max_requests',
+    'window_ms',
+    'per',
+    'mode',
+    'backend',
+    'inference_url',
+    'threshold',
+    'max_lines',
+    'max_chars',
+    'model',
+    'threshold_chars',
+]);
+const lintKeys = new Set(['disable', 'severity']);
+function checkObjectKeys(diagnostics, value, path, allowed) {
+    if (!isRecord(value))
+        return;
+    for (const key of Object.keys(value)) {
+        if (!allowed.has(key)) {
+            diagnostics.push({
+                level: 'error',
+                message: unknownKeyMessage(key, path),
+                suggestion: unknownKeySuggestion(key, path),
+            });
+        }
+    }
+    if (path.length === 0) {
+        checkRecordChildren(diagnostics, value.providers, ['providers'], providerKeys);
+        checkRecordChildren(diagnostics, value.value_sets, ['value_sets'], valueSetKeys);
+        checkRecordChildren(diagnostics, value.agents, ['agents'], agentKeys);
+        checkRecordChildren(diagnostics, value.profiles, ['profiles'], profileKeys);
+        checkRecordChildren(diagnostics, value.arg_dimensions, ['arg_dimensions'], argDimensionKeys);
+        checkRecordChildren(diagnostics, value.sandbox_presets, ['sandbox_presets'], sandboxOverrideKeys);
+        checkRecordChildren(diagnostics, value.clis, ['clis'], cliKeys);
+        checkRecordChildren(diagnostics, value.apis, ['apis'], apiKeys);
+        checkObjectKeys(diagnostics, value.approvals, ['approvals'], approvalsKeys);
+        checkObjectKeys(diagnostics, value.security, ['security'], securityKeys);
+        checkObjectKeys(diagnostics, value.audit, ['audit'], auditKeys);
+        checkObjectKeys(diagnostics, value.server, ['server'], serverKeys);
+        checkObjectKeys(diagnostics, value.lint, ['lint'], lintKeys);
+    }
+    else if (path[0] === 'agents' && path.length === 2) {
+        checkAgentChildren(diagnostics, value, path);
+    }
+    else if (path[0] === 'profiles' && path.length === 2) {
+        checkArgPolicyKeys(diagnostics, value.arg_policy, [...path, 'arg_policy']);
+    }
+    else if (path[0] === 'sandbox_presets' && path.length === 2) {
+        checkSandboxOverrideChildren(diagnostics, value, path);
+    }
+    else if (path[0] === 'clis' && path.length === 2) {
+        checkRecordChildren(diagnostics, value.commands, [...path, 'commands'], cliCommandKeys);
+    }
+    else if (path[0] === 'clis' && path[2] === 'commands' && path.length === 4) {
+        checkRecordChildren(diagnostics, value.params, [...path, 'params'], cliParamKeys);
+    }
+    else if (path[0] === 'apis' && path.length === 2) {
+        checkObjectKeys(diagnostics, value.auth, [...path, 'auth'], apiAuthKeys);
+    }
+    else if (path.join('.') === 'approvals') {
+        checkApprovalProviderKeys(diagnostics, value.provider, ['approvals', 'provider']);
+    }
+    else if (path.join('.') === 'server') {
+        checkObjectKeys(diagnostics, value.management_api, ['server', 'management_api'], managementApiKeys);
+    }
+    else if (path.at(-1) === 'sandbox' || path.join('.') === 'agents') {
+        checkSandboxChildren(diagnostics, value, path);
+    }
+}
+function checkAgentChildren(diagnostics, value, path) {
+    checkArrayChildren(diagnostics, value.remember_allow, [...path, 'remember_allow'], rememberAllowKeys);
+    checkRecordChildren(diagnostics, value.tool_overrides, [...path, 'tool_overrides'], toolOverrideKeys);
+    checkArgPolicyKeys(diagnostics, value.arg_policy, [...path, 'arg_policy']);
+    checkObjectKeys(diagnostics, value.exec, [...path, 'exec'], agentExecKeys);
+    checkObjectKeys(diagnostics, value.http, [...path, 'http'], agentHttpKeys);
+    checkObjectKeys(diagnostics, value.sandbox, [...path, 'sandbox'], sandboxKeys);
+    checkArrayChildren(diagnostics, value.middleware, [...path, 'middleware'], middlewareKeys);
+}
+function checkSandboxChildren(diagnostics, value, path) {
+    if (!isRecord(value))
+        return;
+    checkObjectKeys(diagnostics, value.filesystem, [...path, 'filesystem'], filesystemKeys);
+    checkObjectKeys(diagnostics, value.network, [...path, 'network'], networkKeys);
+    checkRecordChildren(diagnostics, value.overrides, [...path, 'overrides'], sandboxOverrideKeys);
+}
+function checkSandboxOverrideChildren(diagnostics, value, path) {
+    if (!isRecord(value))
+        return;
+    checkObjectKeys(diagnostics, value.filesystem, [...path, 'filesystem'], filesystemKeys);
+    checkObjectKeys(diagnostics, value.network, [...path, 'network'], networkKeys);
+}
+function checkToolOverrideChildren(diagnostics, value, path) {
+    checkSandboxOverrideChildren(diagnostics, value.sandbox, [...path, 'sandbox']);
+    checkArgPolicyKeys(diagnostics, value.args, [...path, 'args']);
+}
+function checkArgPolicyKeys(diagnostics, value, path) {
+    if (!isRecord(value))
+        return;
+    for (const [toolName, toolPolicy] of Object.entries(value)) {
+        if (!isRecord(toolPolicy))
+            continue;
+        for (const [argName, constraintOrList] of Object.entries(toolPolicy)) {
+            const constraints = Array.isArray(constraintOrList) ? constraintOrList : [constraintOrList];
+            constraints.forEach((constraint, index) => {
+                const constraintPath = [
+                    ...path,
+                    toolName,
+                    argName,
+                    ...(Array.isArray(constraintOrList) ? [String(index)] : []),
+                ];
+                checkObjectKeys(diagnostics, constraint, constraintPath, argConstraintKeys);
+            });
+        }
+    }
+}
+function checkApprovalProviderKeys(diagnostics, value, path) {
+    if (Array.isArray(value)) {
+        value.forEach((provider, index) => checkObjectKeys(diagnostics, provider, [...path, String(index)], approvalProviderKeys));
+        return;
+    }
+    checkObjectKeys(diagnostics, value, path, approvalProviderKeys);
+}
+function checkArrayChildren(diagnostics, value, path, allowed) {
+    if (!Array.isArray(value))
+        return;
+    value.forEach((child, index) => {
+        checkObjectKeys(diagnostics, child, [...path, String(index)], allowed);
+    });
+}
+function checkRecordChildren(diagnostics, value, path, allowed) {
+    if (!isRecord(value))
+        return;
+    for (const [name, child] of Object.entries(value)) {
+        if (isRecord(child)) {
+            checkObjectKeys(diagnostics, child, [...path, name], allowed);
+            if (path[0] === 'agents' && path[2] === 'tool_overrides') {
+                checkToolOverrideChildren(diagnostics, child, [...path, name]);
+            }
+            else if (path[0] === 'clis' && path[2] === 'commands') {
+                checkRecordChildren(diagnostics, child.params, [...path, name, 'params'], cliParamKeys);
+            }
+            else if (path[0] === 'sandbox_presets' || path.at(-1) === 'overrides') {
+                checkSandboxOverrideChildren(diagnostics, child, [...path, name]);
+            }
+        }
+    }
+}
+function unknownKeyMessage(key, path) {
+    if (path[0] === 'profiles' && path.length === 2) {
+        return `Unrecognized key "${key}" in profile "${path[1]}".`;
+    }
+    if (path[0] === 'agents' && path.length === 2) {
+        return `Unrecognized key "${key}" in agent "${path[1]}".`;
+    }
+    return `Unknown config key "${[...path, key].join('.')}".`;
+}
+function unknownKeySuggestion(key, path) {
+    if (key === 'scope' && (path[0] === 'agents' || path[0] === 'profiles')) {
+        return 'Did you mean "arg_scope"?';
+    }
+    if (key === 'mcps')
+        return 'Use "providers" to declare MCP servers and builtins.';
+    if (key === 'hitl')
+        return 'Use "ask" for agent tool routing or "approvals" for approval providers.';
+    return undefined;
+}
+function isRecord(value) {
+    return !!value && typeof value === 'object' && !Array.isArray(value);
+}
+function isLoopbackHost(host) {
+    const normalized = host.startsWith('[') && host.endsWith(']') ? host.slice(1, -1) : host;
+    if (normalized === 'localhost')
+        return true;
+    const ipVersion = isIP(normalized);
+    if (ipVersion === 6)
+        return normalized === '::1';
+    if (ipVersion !== 4)
+        return false;
+    const firstOctet = Number(normalized.split('.')[0]);
+    return firstOctet === 127;
+}
 /** Check if two glob patterns could match the same tool name */
 function patternsOverlap(a, b) {
     // If either is a wildcard that covers the other's namespace