refactor(config): dedupe exec/fs zod schemas

src/config/zod-schema.agent-runtime.ts

@@ -246,6 +246,47 @@ export const ElevatedAllowFromSchema = z
   .record(z.string(), z.array(z.union([z.string(), z.number()])))
   .optional();
 
+const ToolExecApplyPatchSchema = z
+  .object({
+    enabled: z.boolean().optional(),
+    workspaceOnly: z.boolean().optional(),
+    allowModels: z.array(z.string()).optional(),
+  })
+  .strict()
+  .optional();
+
+const ToolExecBaseShape = {
+  host: z.enum(["sandbox", "gateway", "node"]).optional(),
+  security: z.enum(["deny", "allowlist", "full"]).optional(),
+  ask: z.enum(["off", "on-miss", "always"]).optional(),
+  node: z.string().optional(),
+  pathPrepend: z.array(z.string()).optional(),
+  safeBins: z.array(z.string()).optional(),
+  backgroundMs: z.number().int().positive().optional(),
+  timeoutSec: z.number().int().positive().optional(),
+  cleanupMs: z.number().int().positive().optional(),
+  notifyOnExit: z.boolean().optional(),
+  notifyOnExitEmptySuccess: z.boolean().optional(),
+  applyPatch: ToolExecApplyPatchSchema,
+} as const;
+
+const AgentToolExecSchema = z
+  .object({
+    ...ToolExecBaseShape,
+    approvalRunningNoticeMs: z.number().int().nonnegative().optional(),
+  })
+  .strict()
+  .optional();
+
+const ToolExecSchema = z.object(ToolExecBaseShape).strict().optional();
+
+const ToolFsSchema = z
+  .object({
+    workspaceOnly: z.boolean().optional(),
+  })
+  .strict()
+  .optional();
+
 export const AgentSandboxSchema = z
   .object({
     mode: z.union([z.literal("off"), z.literal("non-main"), z.literal("all")]).optional(),
@@ -275,37 +316,8 @@ export const AgentToolsSchema = z
       })
       .strict()
       .optional(),
-    exec: z
+    exec: AgentToolExecSchema,
-      .object({
+    fs: ToolFsSchema,
-        host: z.enum(["sandbox", "gateway", "node"]).optional(),
-        security: z.enum(["deny", "allowlist", "full"]).optional(),
-        ask: z.enum(["off", "on-miss", "always"]).optional(),
-        node: z.string().optional(),
-        pathPrepend: z.array(z.string()).optional(),
-        safeBins: z.array(z.string()).optional(),
-        backgroundMs: z.number().int().positive().optional(),
-        timeoutSec: z.number().int().positive().optional(),
-        approvalRunningNoticeMs: z.number().int().nonnegative().optional(),
-        cleanupMs: z.number().int().positive().optional(),
-        notifyOnExit: z.boolean().optional(),
-        notifyOnExitEmptySuccess: z.boolean().optional(),
-        applyPatch: z
-          .object({
-            enabled: z.boolean().optional(),
-            workspaceOnly: z.boolean().optional(),
-            allowModels: z.array(z.string()).optional(),
-          })
-          .strict()
-          .optional(),
-      })
-      .strict()
-      .optional(),
-    fs: z
-      .object({
-        workspaceOnly: z.boolean().optional(),
-      })
-      .strict()
-      .optional(),
     sandbox: z
       .object({
         tools: ToolPolicySchema,
@@ -535,36 +547,8 @@ export const ToolsSchema = z
       })
       .strict()
       .optional(),
-    exec: z
+    exec: ToolExecSchema,
-      .object({
+    fs: ToolFsSchema,
-        host: z.enum(["sandbox", "gateway", "node"]).optional(),
-        security: z.enum(["deny", "allowlist", "full"]).optional(),
-        ask: z.enum(["off", "on-miss", "always"]).optional(),
-        node: z.string().optional(),
-        pathPrepend: z.array(z.string()).optional(),
-        safeBins: z.array(z.string()).optional(),
-        backgroundMs: z.number().int().positive().optional(),
-        timeoutSec: z.number().int().positive().optional(),
-        cleanupMs: z.number().int().positive().optional(),
-        notifyOnExit: z.boolean().optional(),
-        notifyOnExitEmptySuccess: z.boolean().optional(),
-        applyPatch: z
-          .object({
-            enabled: z.boolean().optional(),
-            workspaceOnly: z.boolean().optional(),
-            allowModels: z.array(z.string()).optional(),
-          })
-          .strict()
-          .optional(),
-      })
-      .strict()
-      .optional(),
-    fs: z
-      .object({
-        workspaceOnly: z.boolean().optional(),
-      })
-      .strict()
-      .optional(),
     subagents: z
       .object({
         tools: ToolPolicySchema,