atabey 0.0.13 → 0.0.15

package/framework-mcp/dist/framework-mcp/src/tools/compliance/mask_pii.js

@@ -0,0 +1,55 @@
+import { classifyData, containsPII, maskObject, maskText } from "../../../../src/shared/pii.js";
+export function handleMaskPII(root, args) {
+    const mode = args.mode || "auto";
+    const strictMode = args.strictMode ?? false;
+    // Mode: text
+    if (mode === "text" || (mode === "auto" && args.text && !args.data)) {
+        if (!args.text) {
+            return {
+                isError: true,
+                content: [{ type: "text", text: "[ERROR] 'text' parameter is required when mode is 'text'." }],
+            };
+        }
+        const masked = maskText(args.text);
+        const hasPII = containsPII(args.text);
+        const classification = classifyData(args.text);
+        return {
+            content: [{
+                    type: "text",
+                    text: JSON.stringify({
+                        originalLength: args.text.length,
+                        maskedLength: masked.length,
+                        hasPII,
+                        classification,
+                        masked,
+                    }, null, 2),
+                }],
+        };
+    }
+    // Mode: object
+    if (mode === "object" || (mode === "auto" && args.data)) {
+        if (!args.data) {
+            return {
+                isError: true,
+                content: [{ type: "text", text: "[ERROR] 'data' parameter is required when mode is 'object'." }],
+            };
+        }
+        const masked = maskObject(args.data, 0, strictMode);
+        const hasPII = containsPII(JSON.stringify(args.data));
+        const classification = classifyData(JSON.stringify(args.data));
+        return {
+            content: [{
+                    type: "text",
+                    text: JSON.stringify({
+                        hasPII,
+                        classification,
+                        masked,
+                    }, null, 2),
+                }],
+        };
+    }
+    return {
+        isError: true,
+        content: [{ type: "text", text: "[ERROR] Provide either 'text' (string) or 'data' (object) parameter." }],
+    };
+}

package/framework-mcp/dist/framework-mcp/src/tools/definitions.js

@@ -172,6 +172,12 @@ export const TOOLS = [
         description: "Pause execution and ask the human developer a clarifying question via the terminal.",
         inputSchema: zodToMcpSchema(schemas.AskHumanSchema),
     },
+    // ─── PII / Compliance ─────────────────────────────────────────
+    {
+        name: "mask_pii",
+        description: "Mask Personally Identifiable Information (PII) in text or structured data. Compliant with KVKK (Law No. 6698) and GDPR. Detects and masks emails, phone numbers, TC IDs, API keys, tokens, IPs, credit cards, IBANs, and more.",
+        inputSchema: zodToMcpSchema(schemas.MaskPIISchema),
+    },
     // ─── Code Quality ─────────────────────────────────────────────
     {
         name: "analyze_code_quality",
@@ -183,15 +189,10 @@ export const TOOLS = [
         description: "Check architecture compliance in a given path. Verifies layer boundaries (Controller→Service→Repository), import direction rules, and strict mode.",
         inputSchema: zodToMcpSchema(schemas.CheckArchitectureComplianceSchema),
     },
-    // ─── LLM Gateway ─────────────────────────────────────────
-    {
-        name: "llm_gateway_query",
-        description: "Send a chat completion request through the ATABEY LLM Gateway. The gateway automatically load-balances across providers (OpenAI, Anthropic, Google, Grok, Ollama) using configurable strategies (failover, round-robin, cost-optimized). Allows any MCP-connected AI to route LLM requests through the gateway.",
-        inputSchema: zodToMcpSchema(schemas.LLMGatewayQuerySchema),
-    },
+    // ─── Human-in-the-Loop ────────────────────────────────────────
     {
-        name: "llm_gateway_status",
-        description: "Get the current status of the LLM Gateway including provider health, load balancing strategy, usage statistics, and budget information.",
-        inputSchema: zodToMcpSchema(schemas.LLMGatewayStatusSchema),
+        name: "approve_operation",
+        description: "Approve, reject, or list pending risk-gated operations. Use this when an operation was blocked by the Risk Gate (risk score ≥ 60). Action: 'approve' | 'reject' | 'list'.",
+        inputSchema: zodToMcpSchema(schemas.ApproveOperationSchema),
     },
 ];

package/framework-mcp/dist/framework-mcp/src/tools/framework/run_tests.js

@@ -1,11 +1,36 @@
 import { execSync } from "child_process";
 import { getBackendLanguage, getDefaultTestCommand } from "../../utils/cli.js";
+const TEST_COMMAND_ALLOW_LIST = [
+    "npm test",
+    "npm run test",
+    "npx vitest",
+    "pytest",
+    "go test",
+    "dotnet test",
+    "mvn test",
+    "./gradlew test",
+    "cargo test"
+];
 /**
  * Executes project tests and returns results for agent analysis.
  */
 export function handleRunTests(projectRoot, args) {
     const language = getBackendLanguage(projectRoot);
     const testCommand = args.command || getDefaultTestCommand(language);
+    // Validate command to prevent shell injection / chaining
+    const isAllowed = TEST_COMMAND_ALLOW_LIST.some(allowedCmd => testCommand.startsWith(allowedCmd));
+    if (!isAllowed) {
+        return {
+            isError: true,
+            content: [{ type: "text", text: `[ERROR] Test command not allowed: "${testCommand}". Must start with one of: ${TEST_COMMAND_ALLOW_LIST.join(", ")}` }]
+        };
+    }
+    if (/[;&|><$`\n\r]/.test(testCommand)) {
+        return {
+            isError: true,
+            content: [{ type: "text", text: "[ERROR] Test command rejected: Shell metacharacters are forbidden to prevent command injection." }]
+        };
+    }
     try {
         const output = execSync(testCommand, { cwd: projectRoot, encoding: "utf8", stdio: "pipe" });
         return {

package/framework-mcp/dist/framework-mcp/src/tools/index.js

@@ -1,3 +1,4 @@
+import { handleMaskPII } from "./compliance/mask_pii.js";
 import { handleAcquireLock, handleReleaseLock } from "./control_plane/locking.js";
 import { handleRegisterAgent } from "./control_plane/registry.js";
 import { TOOLS } from "./definitions.js";
@@ -13,14 +14,13 @@ import { handleRunTests } from "./framework/run_tests.js";
 import { handleSubmitPlan } from "./framework/submit_plan.js";
 import { handleUpdateContractHash } from "./framework/update_contract_hash.js";
 import { handleUpdateProjectMemory } from "./framework/update_memory.js";
-import { handleLLMGatewayQuery } from "./gateway/llm_gateway_query.js";
-import { handleLLMGatewayStatus } from "./gateway/llm_gateway_status.js";
 import { handleDeleteKnowledge } from "./memory/delete_knowledge.js";
 import { handleGetMemoryInsights } from "./memory/get_insights.js";
 import { handleReadProjectMemory } from "./memory/read_memory.js";
 import { handleSearchKnowledge } from "./memory/search_knowledge.js";
 import { handleStoreKnowledge } from "./memory/store_knowledge.js";
 import { handleAskHuman } from "./messaging/ask_human.js";
+import { handleApproveOperation } from "./messaging/approve_operation.js";
 import { handleLogAgentAction } from "./messaging/log_action.js";
 import { handleSendAgentMessage } from "./messaging/send_message.js";
 import { handleCheckPorts } from "./observability/check_ports.js";
@@ -65,6 +65,7 @@ export const toolHandlers = {
     send_agent_message: bind(handleSendAgentMessage),
     log_agent_action: bind(handleLogAgentAction),
     ask_human: bind(handleAskHuman),
+    approve_operation: bind(handleApproveOperation),
     update_contract_hash: bind(handleUpdateContractHash),
     acquire_lock: bind(handleAcquireLock),
     release_lock: bind(handleReleaseLock),
@@ -73,9 +74,7 @@ export const toolHandlers = {
     check_lint: bind(handleCheckLint),
     analyze_code_quality: bind(handleAnalyzeCodeQuality),
     check_architecture_compliance: bind(handleCheckArchitectureCompliance),
-    // LLM Gateway
-    llm_gateway_query: bind(handleLLMGatewayQuery),
-    llm_gateway_status: bind(handleLLMGatewayStatus),
+    mask_pii: bind(handleMaskPII),
 };
 // Map of tool names to their Zod validation schemas
 export const toolSchemas = {
@@ -116,11 +115,11 @@ export const toolSchemas = {
     send_agent_message: schemas.SendAgentMessageSchema,
     log_agent_action: schemas.LogAgentActionSchema,
     ask_human: schemas.AskHumanSchema,
+    approve_operation: schemas.ApproveOperationSchema,
     // Code Quality
     analyze_code_quality: schemas.AnalyzeCodeQualitySchema,
     check_architecture_compliance: schemas.CheckArchitectureComplianceSchema,
-    // LLM Gateway
-    llm_gateway_query: schemas.LLMGatewayQuerySchema,
-    llm_gateway_status: schemas.LLMGatewayStatusSchema,
+    // PII / Compliance
+    mask_pii: schemas.MaskPIISchema,
 };
 export { TOOLS };

package/framework-mcp/dist/framework-mcp/src/tools/messaging/approve_operation.js

@@ -0,0 +1,80 @@
+import { approveOperation, getPendingApprovals, rejectOperation } from "../../utils/human-in-loop.js";
+/**
+ * MCP Tool: approve_operation
+ *
+ * In AI CLI (Claude Code, Gemini CLI), running "atabey approve <traceId>"
+ * is not possible — anything typed in chat is treated as a message, not a CLI command.
+ *
+ * This tool moves the risk gate approval flow directly into an MCP tool call:
+ *
+ * 1. Atabey blocks a high-risk operation
+ * 2. Tells the developer: "call the approve_operation tool"
+ * 3. AI calls this tool → operation is approved/rejected
+ *
+ * Developer never has to switch to terminal.
+ */
+export async function handleApproveOperation(_root, args) {
+    const { action, traceId, reason } = args;
+    // LIST: Show pending approvals
+    if (action === "list") {
+        const pending = getPendingApprovals();
+        if (pending.length === 0) {
+            return {
+                content: [{ type: "text", text: "[APPROVALS] No pending operations waiting for approval." }],
+            };
+        }
+        const lines = [
+            `[APPROVALS] ${pending.length} pending operation(s):\n`,
+            ...pending.map(req => [
+                "  ─────────────────────────────────────",
+                `  Trace ID:   ${req.traceId}`,
+                `  Tool:       ${req.toolName}`,
+                `  Agent:      ${req.agent}`,
+                `  Risk Score: ${req.riskScore}/100 (${req.riskLevel})`,
+                `  Reason:     ${req.reason}`,
+                `  Expires:    ${new Date(req.expiresAt).toISOString()}`,
+            ].join("\n")),
+            "",
+            "To approve: call approve_operation with action=\"approve\" and traceId=\"<id>\"",
+            "To reject:  call approve_operation with action=\"reject\" and traceId=\"<id>\"",
+        ];
+        return {
+            content: [{ type: "text", text: lines.join("\n") }],
+        };
+    }
+    // APPROVE or REJECT: traceId is required
+    if (!traceId) {
+        return {
+            isError: true,
+            content: [{ type: "text", text: `[ERROR] traceId is required for "${action}" action.` }],
+        };
+    }
+    if (action === "approve") {
+        const result = approveOperation(traceId);
+        return {
+            content: [{
+                    type: "text",
+                    text: result.success
+                        ? `[APPROVED] ✅ ${result.message}\nYou may retry the blocked operation now.`
+                        : `[ERROR] ${result.message}`,
+                }],
+            isError: !result.success,
+        };
+    }
+    if (action === "reject") {
+        const result = rejectOperation(traceId);
+        return {
+            content: [{
+                    type: "text",
+                    text: result.success
+                        ? `[REJECTED] ⛔ ${result.message}${reason ? `\nReason: ${reason}` : ""}`
+                        : `[ERROR] ${result.message}`,
+                }],
+            isError: !result.success,
+        };
+    }
+    return {
+        isError: true,
+        content: [{ type: "text", text: `[ERROR] Unknown action: "${String(action)}". Use "approve", "reject", or "list".` }],
+    };
+}

package/framework-mcp/dist/framework-mcp/src/tools/messaging/ask_human.js

@@ -1,30 +1,99 @@
-import chalk from "chalk";
+import fs from "fs";
+import path from "path";
+/**
+ * ─── ASK HUMAN — File Bridge ─────────────────────────────────────────
+ *
+ * AI CLIs (Claude Code, Gemini CLI) start the MCP server as a stdio subprocess.
+ * In this subprocess, stdin is isTTY=false (used for MCP JSON-RPC).
+ *
+ * Solution: File-based Q&A bridge.
+ * 1. Question → written to .atabey/hitl/question.txt
+ * 2. Developer answers via `atabey hitl` command
+ * 3. Answer → written to .atabey/hitl/answer.txt
+ * 4. This handler reads the answer and returns it to the AI
+ *
+ * Dashboard: Can also be answered via /api/approvals endpoint on the web dashboard.
+ */
 export async function handleAskHuman(root, args) {
-    if (process.env.ATABEY_TEST_DIR || !process.stdin.isTTY) {
-        return { content: [{ type: "text", text: "[SKIPPED] Non-interactive environment. Cannot ask human." }] };
-    }
+    const timeoutSeconds = args.timeoutSeconds ?? 120;
+    const hitlDir = path.join(root, ".atabey", "hitl");
+    const questionFile = path.join(hitlDir, "question.txt");
+    const answerFile = path.join(hitlDir, "answer.txt");
     try {
-        const readline = await import("readline");
-        const rl = readline.createInterface({
-            input: process.stdin,
-            output: process.stdout
-        });
-        return new Promise((resolve) => {
-            process.stdout.write("\n" + chalk.bgMagenta.white.bold(" [HUMAN-IN-THE-LOOP REQUIRED] ") + "\n");
-            process.stdout.write(chalk.magenta("An agent has paused execution to ask you a question:\n"));
-            rl.question(`\n${chalk.bold(args.question)}\n${chalk.gray("> ")}`, (answer) => {
-                rl.close();
-                resolve({
-                    content: [{ type: "text", text: `[HUMAN RESPONSE] ${answer}` }]
-                });
-            });
-        });
+        // Ensure hitl directory exists
+        fs.mkdirSync(hitlDir, { recursive: true });
+        // Clear any stale answer file
+        if (fs.existsSync(answerFile)) {
+            fs.unlinkSync(answerFile);
+        }
+        // Write the question with metadata
+        const questionPayload = JSON.stringify({
+            timestamp: new Date().toISOString(),
+            question: args.question,
+            timeoutAt: new Date(Date.now() + timeoutSeconds * 1000).toISOString(),
+        }, null, 2);
+        fs.writeFileSync(questionFile, questionPayload);
+        // Write human-readable prompt file alongside
+        fs.writeFileSync(path.join(hitlDir, "PENDING.txt"), [
+            "═══════════════════════════════════════════════════",
+            " [ATABEY] AGENT WAITING FOR YOUR ANSWER",
+            "═══════════════════════════════════════════════════",
+            "",
+            `QUESTION: ${args.question}`,
+            "",
+            "To answer, run in your terminal:",
+            "  atabey hitl answer \"your answer here\"",
+            "",
+            "Or use the dashboard: http://localhost:5858",
+            "═══════════════════════════════════════════════════",
+        ].join("\n"));
+        process.stderr.write(`[HITL] Question written to ${questionFile}\n`);
+        process.stderr.write("[HITL] Run: atabey hitl answer \"your answer\"\n");
+        // Poll for answer file
+        const pollIntervalMs = 1000;
+        const maxAttempts = timeoutSeconds;
+        for (let attempt = 0; attempt < maxAttempts; attempt++) {
+            await new Promise(resolve => setTimeout(resolve, pollIntervalMs));
+            if (fs.existsSync(answerFile)) {
+                const answer = fs.readFileSync(answerFile, "utf8").trim();
+                // Clean up
+                try {
+                    fs.unlinkSync(questionFile);
+                    fs.unlinkSync(answerFile);
+                    const pendingFile = path.join(hitlDir, "PENDING.txt");
+                    if (fs.existsSync(pendingFile))
+                        fs.unlinkSync(pendingFile);
+                }
+                catch { /* cleanup is best-effort */ }
+                process.stderr.write("[HITL] Answer received.\n");
+                return {
+                    content: [{ type: "text", text: `[HUMAN RESPONSE] ${answer}` }],
+                };
+            }
+        }
+        // Timeout — clean up question file
+        try {
+            if (fs.existsSync(questionFile))
+                fs.unlinkSync(questionFile);
+            const pendingFile = path.join(hitlDir, "PENDING.txt");
+            if (fs.existsSync(pendingFile))
+                fs.unlinkSync(pendingFile);
+        }
+        catch { /* cleanup is best-effort */ }
+        return {
+            content: [{
+                    type: "text",
+                    text: `[HITL TIMEOUT] No answer received within ${timeoutSeconds}s.\n` +
+                        `Question was: "${args.question}"\n` +
+                        "To answer pending questions, run: atabey hitl answer \"your answer\"",
+                }],
+        };
     }
     catch (error) {
         const message = error instanceof Error ? error.message : String(error);
         return {
             isError: true,
-            content: [{ type: "text", text: `[ERROR] Failed to ask human: ${message}` }]
+            content: [{ type: "text", text: `[ERROR] ask_human failed: ${message}` }],
         };
     }
 }

package/framework-mcp/dist/framework-mcp/src/tools/observability/check_ports.js

@@ -1,16 +1,32 @@
-import { execSync } from "child_process";
+import { spawnSync } from "child_process";
 /**
  * Checks for active network ports and their status.
+ * Uses spawnSync instead of execSync to prevent shell injection.
  */
 export function handleCheckPorts(projectRoot, args) {
-    const filter = args.filter || ""; // Optional filter (e.g., ":3000")
+    const rawFilter = args.filter || "";
+    // Sanitize filter to prevent command injection (allow only alphanumeric, dots, colons, dashes, underscores)
+    const filter = rawFilter.replace(/[^a-zA-Z0-9.:_-]/g, "");
     try {
-        // Using 'lsof -i -P -n' to list open files and network connections
-        // Note: may require permissions or behave differently on non-Unix systems
-        const command = process.platform === "win32"
-            ? `netstat -ano | findstr LISTENING ${filter ? `| findstr ${filter}` : ""}`
-            : `lsof -i -P -n | grep LISTEN ${filter ? `| grep ${filter}` : ""}`;
-        const output = execSync(command, { encoding: "utf8" });
+        let output;
+        if (process.platform === "win32") {
+            const result = spawnSync("netstat", ["-ano"], { encoding: "utf8" });
+            if (result.error)
+                throw result.error;
+            const lines = (result.stdout || "").split("\n").filter(l => l.includes("LISTENING"));
+            output = filter
+                ? lines.filter(l => l.includes(filter)).join("\n")
+                : lines.join("\n");
+        }
+        else {
+            const result = spawnSync("lsof", ["-i", "-P", "-n"], { encoding: "utf8" });
+            if (result.error)
+                throw result.error;
+            const lines = (result.stdout || "").split("\n").filter(l => l.includes("LISTEN"));
+            output = filter
+                ? lines.filter(l => l.includes(filter)).join("\n")
+                : lines.join("\n");
+        }
         return {
             content: [{
                     type: "text",

package/framework-mcp/dist/framework-mcp/src/tools/quality/analyze_code_quality.js

@@ -1,6 +1,7 @@
 import { execSync } from "child_process";
 import fs from "fs";
 import path from "path";
+import { analyzePathQuality } from "../../utils/quality.js";
 /**
  * Code quality analysis tool for Atabey MCP.
  *
@@ -10,6 +11,13 @@ import path from "path";
  * - Code complexity analysis (checkComplexity)
  */
 export function handleAnalyzeCodeQuality(projectRoot, args) {
+    // Validate path parameter to prevent command injection
+    if (!/^[a-zA-Z0-9_./-]+$/.test(args.path)) {
+        return {
+            isError: true,
+            content: [{ type: "text", text: `[ERROR] Invalid path characters detected: ${args.path}` }]
+        };
+    }
     const targetPath = path.resolve(projectRoot, args.path);
     if (!fs.existsSync(targetPath)) {
         return {
@@ -81,73 +89,14 @@ export function handleAnalyzeCodeQuality(projectRoot, args) {
     }
     // 3. Code Complexity Check (basic heuristic)
     if (args.checkComplexity !== false) {
-        const complexityIssues = [];
-        function scanDirectory(dir) {
-            if (!fs.existsSync(dir))
-                return;
-            const entries = fs.readdirSync(dir, { withFileTypes: true });
-            for (const entry of entries) {
-                const fullPath = path.join(dir, entry.name);
-                if (entry.isDirectory() && !entry.name.startsWith("node_modules") && !entry.name.startsWith(".")) {
-                    scanDirectory(fullPath);
-                }
-                else if (entry.isFile() && (entry.name.endsWith(".ts") || entry.name.endsWith(".tsx"))) {
-                    try {
-                        const content = fs.readFileSync(fullPath, "utf8");
-                        const lines = content.split("\n");
-                        // Check for long functions (>50 lines)
-                        let inFunction = false;
-                        let funcLines = 0;
-                        let funcName = "";
-                        const relativePath = path.relative(projectRoot, fullPath);
-                        for (let i = 0; i < lines.length; i++) {
-                            const line = lines[i];
-                            // Detect function start
-                            const funcMatch = line.match(/(?:public|private|protected|static\s+)?(?:async\s+)?(?:function\s+)?(\w+)\s*\([^)]*\)\s*{/);
-                            if (funcMatch) {
-                                inFunction = true;
-                                funcLines = 1;
-                                funcName = funcMatch[1];
-                                continue;
-                            }
-                            // Detect method in class
-                            const methodMatch = line.match(/^\s*(?:public|private|protected|static\s+)?(\w+)\s*\([^)]*\)\s*{/);
-                            if (methodMatch && !line.includes("function")) {
-                                inFunction = true;
-                                funcLines = 1;
-                                funcName = methodMatch[1];
-                                continue;
-                            }
-                            if (inFunction) {
-                                if (line.includes("}")) {
-                                    if (funcLines > 50) {
-                                        complexityIssues.push(`- ${relativePath}:${i + 1} — Function \`${funcName}\` is ${funcLines} lines long (max: 50)`);
-                                    }
-                                    inFunction = false;
-                                }
-                                funcLines++;
-                            }
-                            // Check nesting depth (>4 levels)
-                            const indentMatch = line.match(/^(?:\s{2}){5,}/);
-                            if (indentMatch && !line.trim().startsWith("//") && !line.trim().startsWith("*")) {
-                                const depth = Math.floor(indentMatch[0].length / 2);
-                                if (depth > 4) {
-                                    complexityIssues.push(`- ${relativePath}:${i + 1} — Nesting depth ${depth} (max: 4)`);
-                                }
-                            }
-                        }
-                    }
-                    catch {
-                        // Skip files that can't be read
-                    }
-                }
-            }
-        }
-        scanDirectory(targetPath);
+        const qualityResult = analyzePathQuality(projectRoot, args.path);
+        const complexityIssues = qualityResult.issues.filter(issue => issue.type === "complexity");
         if (complexityIssues.length > 0) {
             hasErrors = true;
             results.push(`## ⚠️ Code Complexity Issues (${complexityIssues.length})`);
-            results.push(...complexityIssues);
+            complexityIssues.forEach(issue => {
+                results.push(`- ${issue.file}:${issue.line} — ${issue.message}`);
+            });
         }
         else {
             results.push("## ✅ Code Complexity: OK");

package/framework-mcp/dist/framework-mcp/src/tools/schemas.js

@@ -34,7 +34,7 @@ export const ReplaceTextSchema = z.object({
     path: z.string().min(1, "Path is required"),
     oldText: z.string().min(1, "oldText is required"),
     newText: z.string(),
-    allowMultiple: z.boolean().default(false),
+    allowMultiple: z.boolean().optional().default(false),
 }).strict();
 // ─── Search & Exploration
 export const ListDirSchema = z.object({
@@ -58,7 +58,7 @@ export const BatchSurgicalEditSchema = z.object({
         path: z.string().min(1),
         oldText: z.string().min(1),
         newText: z.string(),
-        allowMultiple: z.boolean().default(false),
+        allowMultiple: z.boolean().optional().default(false),
     })),
 }).strict();
 export const PatchFileSchema = z.object({
@@ -97,7 +97,7 @@ export const SubmitPlanSchema = z.object({
 export const AcquireLockSchema = z.object({
     resource: z.string().min(1),
     agent: AgentIDSchema,
-    ttl: z.number().int().positive().default(60),
+    ttl: z.number().int().positive().optional().default(60),
 }).strict();
 export const ReleaseLockSchema = z.object({
     resource: z.string().min(1),
@@ -106,7 +106,7 @@ export const ReleaseLockSchema = z.object({
 export const RegisterAgentSchema = z.object({
     agent: AgentIDSchema,
     role: z.string().min(1),
-    capability: z.number().int().min(1).max(10).default(5),
+    capability: z.number().int().min(1).max(10).optional().default(5),
     specialties: z.record(z.number()).optional(),
 }).strict();
 export const UpdateContractHashSchema = z.object({}).strict();
@@ -123,7 +123,7 @@ export const StoreKnowledgeSchema = z.object({
 export const SearchKnowledgeSchema = z.object({
     query: z.string().min(1, "Query is required"),
     category: z.enum(["ARCHITECTURE", "DECISION", "CODE_SNIPPET", "RULE", "TASK_HISTORY"]).optional(),
-    limit: z.number().int().positive().default(5),
+    limit: z.number().int().positive().optional().default(5),
 }).strict();
 export const DeleteKnowledgeSchema = z.object({
     id: z.string().optional(),
@@ -137,8 +137,8 @@ export const SendAgentMessageSchema = z.object({
     content: z.string().min(1, "Content cannot be empty"),
     traceId: TraceIDSchema,
     parentId: TaskIDSchema.optional(),
-    priority: z.enum(["HIGH", "NORMAL", "LOW"]).default("NORMAL"),
-    requiresApproval: z.boolean().default(false),
+    priority: z.enum(["HIGH", "NORMAL", "LOW"]).optional().default("NORMAL"),
+    requiresApproval: z.boolean().optional().default(false),
 }).strict();
 export const LogAgentActionSchema = z.object({
     agent: AgentIDSchema,
@@ -150,23 +150,12 @@ export const LogAgentActionSchema = z.object({
 }).strict();
 export const AskHumanSchema = z.object({
     question: z.string().min(10, "Question must be clear and detailed."),
+    timeoutSeconds: z.number().int().positive().optional().default(120),
 }).strict();
-// ─── LLM Gateway ────────────────────────────────────────────────────
-export const LLMGatewayQuerySchema = z.object({
-    messages: z.array(z.object({
-        role: z.enum(["system", "user", "assistant", "tool"]),
-        content: z.string().min(1),
-    })).min(1, "At least one message is required"),
-    system: z.string().optional(),
-    model: z.string().optional(),
-    provider: z.enum(["openai", "anthropic", "google", "grok", "ollama"]).optional(),
-    strategy: z.enum(["round-robin", "least-latency", "cost-optimized", "failover", "priority-based", "model-based"]).optional(),
-    temperature: z.number().min(0).max(2).optional(),
-    maxTokens: z.number().int().positive().optional(),
+export const ApproveOperationSchema = z.object({
+    action: z.enum(["approve", "reject", "list"]),
     traceId: z.string().optional(),
-}).strict();
-export const LLMGatewayStatusSchema = z.object({
-    detail: z.enum(["overview", "providers", "stats"]).optional().default("overview"),
+    reason: z.string().optional(),
 }).strict();
 // ─── Code Quality Analysis ──────────────────────────────────────────
 export const AnalyzeCodeQualitySchema = z.object({
@@ -180,3 +169,10 @@ export const CheckArchitectureComplianceSchema = z.object({
     path: z.string().min(1, "Path to check is required"),
     rules: z.array(z.string()).optional(),
 }).strict();
+// ─── PII / Compliance ───────────────────────────────────────────────
+export const MaskPIISchema = z.object({
+    text: z.string().optional(),
+    data: z.record(z.unknown()).optional(),
+    mode: z.enum(["text", "object", "auto"]).optional().default("auto"),
+    strictMode: z.boolean().optional().default(false),
+}).strict();