@cjhyy/code-shell-core 0.5.0-rc.0

package/dist/settings/schema.d.ts

@@ -0,0 +1,1219 @@
+/**
+ * Settings schema with Zod validation.
+ */
+import { z } from "zod";
+export declare const SettingsSchema: z.ZodObject<{
+    agent: z.ZodDefault<z.ZodObject<{
+        preset: z.ZodDefault<z.ZodString>;
+        enabledBuiltinTools: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+        disabledBuiltinTools: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+        customSystemPrompt: z.ZodOptional<z.ZodString>;
+        appendSystemPrompt: z.ZodOptional<z.ZodString>;
+    }, "strip", z.ZodTypeAny, {
+        preset: string;
+        enabledBuiltinTools: string[];
+        disabledBuiltinTools: string[];
+        customSystemPrompt?: string | undefined;
+        appendSystemPrompt?: string | undefined;
+    }, {
+        preset?: string | undefined;
+        enabledBuiltinTools?: string[] | undefined;
+        disabledBuiltinTools?: string[] | undefined;
+        customSystemPrompt?: string | undefined;
+        appendSystemPrompt?: string | undefined;
+    }>>;
+    /**
+     * Primary source of truth for the active model is settings.activeKey
+     * (points at models[].key). settings.model is a derived mirror of that
+     * entry kept in sync for legacy boot paths (cli/main.ts, repl.ts, etc.)
+     * which read provider/name/apiKey/baseUrl directly. Writers must update
+     * both — appendOnboardingResult does this in one shot.
+     */
+    activeKey: z.ZodOptional<z.ZodString>;
+    /**
+     * Toggle background auto-update. When true (default), code-shell checks
+     * npm for newer versions and — if the npm global prefix is writable —
+     * installs the update in the background on process exit so the next
+     * launch picks it up.
+     * Can also be disabled via env var `DISABLE_AUTOUPDATER=1`.
+     */
+    autoUpdates: z.ZodDefault<z.ZodBoolean>;
+    model: z.ZodDefault<z.ZodObject<{
+        provider: z.ZodDefault<z.ZodString>;
+        name: z.ZodDefault<z.ZodString>;
+        apiKey: z.ZodOptional<z.ZodString>;
+        baseUrl: z.ZodDefault<z.ZodString>;
+        temperature: z.ZodDefault<z.ZodNumber>;
+        maxTokens: z.ZodDefault<z.ZodNumber>;
+    }, "strip", z.ZodTypeAny, {
+        provider: string;
+        name: string;
+        temperature: number;
+        baseUrl: string;
+        maxTokens: number;
+        apiKey?: string | undefined;
+    }, {
+        provider?: string | undefined;
+        name?: string | undefined;
+        temperature?: number | undefined;
+        baseUrl?: string | undefined;
+        apiKey?: string | undefined;
+        maxTokens?: number | undefined;
+    }>>;
+    providers: z.ZodDefault<z.ZodArray<z.ZodObject<{
+        key: z.ZodString;
+        label: z.ZodOptional<z.ZodString>;
+        kind: z.ZodEnum<["openai", "anthropic", "deepseek", "zai", "xai", "mistral", "groq", "google", "openrouter", "ollama", "custom"]>;
+        baseUrl: z.ZodString;
+        apiKey: z.ZodOptional<z.ZodString>;
+        protocol: z.ZodOptional<z.ZodEnum<["openai-compat", "anthropic-style"]>>;
+        modelsPath: z.ZodOptional<z.ZodString>;
+        /**
+         * DeepSeek V4 thinking-mode default for this provider. "enabled"
+         * matches endpoint default; "disabled" makes V4 calls run in
+         * non-thinking mode (faster, cheaper). Ignored by every provider
+         * other than DeepSeek V4. Per-call overrides still win.
+         */
+        thinking: z.ZodOptional<z.ZodEnum<["enabled", "disabled"]>>;
+    }, "strip", z.ZodTypeAny, {
+        key: string;
+        kind: "anthropic" | "openai" | "deepseek" | "zai" | "xai" | "mistral" | "groq" | "google" | "openrouter" | "ollama" | "custom";
+        baseUrl: string;
+        thinking?: "enabled" | "disabled" | undefined;
+        label?: string | undefined;
+        apiKey?: string | undefined;
+        protocol?: "openai-compat" | "anthropic-style" | undefined;
+        modelsPath?: string | undefined;
+    }, {
+        key: string;
+        kind: "anthropic" | "openai" | "deepseek" | "zai" | "xai" | "mistral" | "groq" | "google" | "openrouter" | "ollama" | "custom";
+        baseUrl: string;
+        thinking?: "enabled" | "disabled" | undefined;
+        label?: string | undefined;
+        apiKey?: string | undefined;
+        protocol?: "openai-compat" | "anthropic-style" | undefined;
+        modelsPath?: string | undefined;
+    }>, "many">>;
+    models: z.ZodDefault<z.ZodArray<z.ZodEffects<z.ZodObject<{
+        key: z.ZodString;
+        label: z.ZodOptional<z.ZodString>;
+        providerKey: z.ZodOptional<z.ZodString>;
+        model: z.ZodString;
+        maxOutputTokens: z.ZodOptional<z.ZodNumber>;
+        maxContextTokens: z.ZodOptional<z.ZodNumber>;
+        /**
+         * Which LLM client to use ("openai" or "anthropic"). New name —
+         * the legacy field is `provider`, which we still accept and
+         * fold into `protocol` below so old configs keep working.
+         * NOT the brand/vendor — that's providerKey above.
+         */
+        protocol: z.ZodOptional<z.ZodString>;
+        provider: z.ZodOptional<z.ZodString>;
+        baseUrl: z.ZodOptional<z.ZodString>;
+        apiKey: z.ZodOptional<z.ZodString>;
+        /**
+         * Per-model thinking override. Wins over the provider-level
+         * setting (settings.providers[].thinking). Use this when
+         * different models under the same provider need different
+         * defaults — e.g. DeepSeek V4 Pro off (faster) but V4 Flash on.
+         */
+        thinking: z.ZodOptional<z.ZodEnum<["enabled", "disabled"]>>;
+    }, "strip", z.ZodTypeAny, {
+        model: string;
+        key: string;
+        provider?: string | undefined;
+        thinking?: "enabled" | "disabled" | undefined;
+        label?: string | undefined;
+        baseUrl?: string | undefined;
+        apiKey?: string | undefined;
+        protocol?: string | undefined;
+        providerKey?: string | undefined;
+        maxOutputTokens?: number | undefined;
+        maxContextTokens?: number | undefined;
+    }, {
+        model: string;
+        key: string;
+        provider?: string | undefined;
+        thinking?: "enabled" | "disabled" | undefined;
+        label?: string | undefined;
+        baseUrl?: string | undefined;
+        apiKey?: string | undefined;
+        protocol?: string | undefined;
+        providerKey?: string | undefined;
+        maxOutputTokens?: number | undefined;
+        maxContextTokens?: number | undefined;
+    }>, {
+        protocol: string | undefined;
+        provider: string | undefined;
+        model: string;
+        key: string;
+        thinking?: "enabled" | "disabled" | undefined;
+        label?: string | undefined;
+        baseUrl?: string | undefined;
+        apiKey?: string | undefined;
+        providerKey?: string | undefined;
+        maxOutputTokens?: number | undefined;
+        maxContextTokens?: number | undefined;
+    }, {
+        model: string;
+        key: string;
+        provider?: string | undefined;
+        thinking?: "enabled" | "disabled" | undefined;
+        label?: string | undefined;
+        baseUrl?: string | undefined;
+        apiKey?: string | undefined;
+        protocol?: string | undefined;
+        providerKey?: string | undefined;
+        maxOutputTokens?: number | undefined;
+        maxContextTokens?: number | undefined;
+    }>, "many">>;
+    permissions: z.ZodDefault<z.ZodObject<{
+        defaultMode: z.ZodDefault<z.ZodEnum<["default", "acceptEdits", "dontAsk", "bypassPermissions", "auto", "plan"]>>;
+        rules: z.ZodDefault<z.ZodArray<z.ZodObject<{
+            tool: z.ZodString;
+            argsPattern: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+            decision: z.ZodEnum<["allow", "deny", "ask"]>;
+            reason: z.ZodOptional<z.ZodString>;
+        }, "strip", z.ZodTypeAny, {
+            tool: string;
+            decision: "allow" | "deny" | "ask";
+            reason?: string | undefined;
+            argsPattern?: Record<string, string> | undefined;
+        }, {
+            tool: string;
+            decision: "allow" | "deny" | "ask";
+            reason?: string | undefined;
+            argsPattern?: Record<string, string> | undefined;
+        }>, "many">>;
+    }, "strip", z.ZodTypeAny, {
+        defaultMode: "default" | "acceptEdits" | "dontAsk" | "bypassPermissions" | "auto" | "plan";
+        rules: {
+            tool: string;
+            decision: "allow" | "deny" | "ask";
+            reason?: string | undefined;
+            argsPattern?: Record<string, string> | undefined;
+        }[];
+    }, {
+        defaultMode?: "default" | "acceptEdits" | "dontAsk" | "bypassPermissions" | "auto" | "plan" | undefined;
+        rules?: {
+            tool: string;
+            decision: "allow" | "deny" | "ask";
+            reason?: string | undefined;
+            argsPattern?: Record<string, string> | undefined;
+        }[] | undefined;
+    }>>;
+    context: z.ZodDefault<z.ZodObject<{
+        maxTokens: z.ZodDefault<z.ZodNumber>;
+        compactAtRatio: z.ZodDefault<z.ZodNumber>;
+        summarizeAtRatio: z.ZodDefault<z.ZodNumber>;
+    }, "strip", z.ZodTypeAny, {
+        maxTokens: number;
+        compactAtRatio: number;
+        summarizeAtRatio: number;
+    }, {
+        maxTokens?: number | undefined;
+        compactAtRatio?: number | undefined;
+        summarizeAtRatio?: number | undefined;
+    }>>;
+    session: z.ZodDefault<z.ZodObject<{
+        storageDir: z.ZodOptional<z.ZodString>;
+        maxHistory: z.ZodDefault<z.ZodNumber>;
+    }, "strip", z.ZodTypeAny, {
+        maxHistory: number;
+        storageDir?: string | undefined;
+    }, {
+        storageDir?: string | undefined;
+        maxHistory?: number | undefined;
+    }>>;
+    mcpServers: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodObject<{
+        name: z.ZodString;
+        command: z.ZodOptional<z.ZodString>;
+        args: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        env: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+        url: z.ZodOptional<z.ZodString>;
+        transport: z.ZodOptional<z.ZodEnum<["stdio", "sse", "streamable-http", "inprocess"]>>;
+        headers: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+    }, "strip", z.ZodTypeAny, {
+        name: string;
+        url?: string | undefined;
+        args?: string[] | undefined;
+        env?: Record<string, string> | undefined;
+        command?: string | undefined;
+        transport?: "stdio" | "sse" | "streamable-http" | "inprocess" | undefined;
+        headers?: Record<string, string> | undefined;
+    }, {
+        name: string;
+        url?: string | undefined;
+        args?: string[] | undefined;
+        env?: Record<string, string> | undefined;
+        command?: string | undefined;
+        transport?: "stdio" | "sse" | "streamable-http" | "inprocess" | undefined;
+        headers?: Record<string, string> | undefined;
+    }>>>;
+    /**
+     * Skill names hidden from the LLM. Names include the full
+     * "<plugin>:<skill>" prefix for plugin skills. Filtered at the
+     * scanner so PromptComposer's skills listing and the skill builtin
+     * tool both see the filtered set — see scanSkills(opts).
+     */
+    disabledSkills: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+    instructions: z.ZodDefault<z.ZodObject<{
+        fileName: z.ZodDefault<z.ZodString>;
+        scanDirs: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+        compatFileNames: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+        ignoreGitBoundary: z.ZodDefault<z.ZodBoolean>;
+    }, "strip", z.ZodTypeAny, {
+        fileName: string;
+        scanDirs: string[];
+        compatFileNames: string[];
+        ignoreGitBoundary: boolean;
+    }, {
+        fileName?: string | undefined;
+        scanDirs?: string[] | undefined;
+        compatFileNames?: string[] | undefined;
+        ignoreGitBoundary?: boolean | undefined;
+    }>>;
+    arena: z.ZodDefault<z.ZodObject<{
+        participants: z.ZodDefault<z.ZodArray<z.ZodUnion<[z.ZodString, z.ZodObject<{
+            name: z.ZodString;
+            model: z.ZodString;
+            provider: z.ZodOptional<z.ZodString>;
+            apiKey: z.ZodOptional<z.ZodString>;
+            baseUrl: z.ZodOptional<z.ZodString>;
+        }, "strip", z.ZodTypeAny, {
+            model: string;
+            name: string;
+            provider?: string | undefined;
+            baseUrl?: string | undefined;
+            apiKey?: string | undefined;
+        }, {
+            model: string;
+            name: string;
+            provider?: string | undefined;
+            baseUrl?: string | undefined;
+            apiKey?: string | undefined;
+        }>]>, "many">>;
+    }, "strip", z.ZodTypeAny, {
+        participants: (string | {
+            model: string;
+            name: string;
+            provider?: string | undefined;
+            baseUrl?: string | undefined;
+            apiKey?: string | undefined;
+        })[];
+    }, {
+        participants?: (string | {
+            model: string;
+            name: string;
+            provider?: string | undefined;
+            baseUrl?: string | undefined;
+            apiKey?: string | undefined;
+        })[] | undefined;
+    }>>;
+    search: z.ZodDefault<z.ZodObject<{
+        provider: z.ZodDefault<z.ZodEnum<["serper", "tavily", "searxng"]>>;
+        apiKey: z.ZodOptional<z.ZodString>;
+        baseUrl: z.ZodOptional<z.ZodString>;
+        /**
+         * Per-provider credentials bag. Lets the desktop UI keep
+         * Serper/Tavily/SearXNG configured simultaneously and flip the
+         * default without losing the others. `provider/apiKey/baseUrl`
+         * remain authoritative for the *active* provider so legacy
+         * readers keep working.
+         */
+        providers: z.ZodOptional<z.ZodRecord<z.ZodEnum<["serper", "tavily", "searxng"]>, z.ZodObject<{
+            apiKey: z.ZodOptional<z.ZodString>;
+            baseUrl: z.ZodOptional<z.ZodString>;
+        }, "strip", z.ZodTypeAny, {
+            baseUrl?: string | undefined;
+            apiKey?: string | undefined;
+        }, {
+            baseUrl?: string | undefined;
+            apiKey?: string | undefined;
+        }>>>;
+    }, "strip", z.ZodTypeAny, {
+        provider: "serper" | "tavily" | "searxng";
+        baseUrl?: string | undefined;
+        apiKey?: string | undefined;
+        providers?: Partial<Record<"serper" | "tavily" | "searxng", {
+            baseUrl?: string | undefined;
+            apiKey?: string | undefined;
+        }>> | undefined;
+    }, {
+        provider?: "serper" | "tavily" | "searxng" | undefined;
+        baseUrl?: string | undefined;
+        apiKey?: string | undefined;
+        providers?: Partial<Record<"serper" | "tavily" | "searxng", {
+            baseUrl?: string | undefined;
+            apiKey?: string | undefined;
+        }>> | undefined;
+    }>>;
+    output: z.ZodDefault<z.ZodObject<{
+        format: z.ZodDefault<z.ZodEnum<["text", "json", "jsonl", "stream-json"]>>;
+    }, "strip", z.ZodTypeAny, {
+        format: "text" | "json" | "jsonl" | "stream-json";
+    }, {
+        format?: "text" | "json" | "jsonl" | "stream-json" | undefined;
+    }>>;
+    /**
+     * OS-level sandbox for shell-tool execution. "auto" picks per platform:
+     * Seatbelt on macOS, bubblewrap on Linux when installed, otherwise off.
+     * Defaults are applied per Engine run depending on headless vs REPL —
+     * see Engine.run() and run.ts.
+     */
+    sandbox: z.ZodOptional<z.ZodObject<{
+        mode: z.ZodOptional<z.ZodEnum<["off", "auto", "seatbelt", "bwrap"]>>;
+        writableRoots: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        deniedReads: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        network: z.ZodOptional<z.ZodEnum<["allow", "deny"]>>;
+    }, "strip", z.ZodTypeAny, {
+        mode?: "auto" | "seatbelt" | "bwrap" | "off" | undefined;
+        writableRoots?: string[] | undefined;
+        deniedReads?: string[] | undefined;
+        network?: "allow" | "deny" | undefined;
+    }, {
+        mode?: "auto" | "seatbelt" | "bwrap" | "off" | undefined;
+        writableRoots?: string[] | undefined;
+        deniedReads?: string[] | undefined;
+        network?: "allow" | "deny" | undefined;
+    }>>;
+    /**
+     * Shell-hook configuration. Each entry binds a HookEventName to a
+     * shell command; the command receives ctx JSON on stdin and returns
+     * a HookResult JSON on stdout (or exit 2 = deny with stderr as
+     * reason). See src/hooks/shell-runner.ts for the wire protocol.
+     *
+     * The event field is loose-typed here (z.string()) because adding
+     * new lifecycle events shouldn't force a schema bump; the runner
+     * silently ignores entries whose event isn't registered.
+     */
+    hooks: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        event: z.ZodString;
+        command: z.ZodString;
+        matcher: z.ZodOptional<z.ZodString>;
+        timeout_ms: z.ZodOptional<z.ZodNumber>;
+        cwd: z.ZodOptional<z.ZodString>;
+    }, "strip", z.ZodTypeAny, {
+        command: string;
+        event: string;
+        cwd?: string | undefined;
+        matcher?: string | undefined;
+        timeout_ms?: number | undefined;
+    }, {
+        command: string;
+        event: string;
+        cwd?: string | undefined;
+        matcher?: string | undefined;
+        timeout_ms?: number | undefined;
+    }>, "many">>;
+}, "passthrough", z.ZodTypeAny, z.objectOutputType<{
+    agent: z.ZodDefault<z.ZodObject<{
+        preset: z.ZodDefault<z.ZodString>;
+        enabledBuiltinTools: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+        disabledBuiltinTools: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+        customSystemPrompt: z.ZodOptional<z.ZodString>;
+        appendSystemPrompt: z.ZodOptional<z.ZodString>;
+    }, "strip", z.ZodTypeAny, {
+        preset: string;
+        enabledBuiltinTools: string[];
+        disabledBuiltinTools: string[];
+        customSystemPrompt?: string | undefined;
+        appendSystemPrompt?: string | undefined;
+    }, {
+        preset?: string | undefined;
+        enabledBuiltinTools?: string[] | undefined;
+        disabledBuiltinTools?: string[] | undefined;
+        customSystemPrompt?: string | undefined;
+        appendSystemPrompt?: string | undefined;
+    }>>;
+    /**
+     * Primary source of truth for the active model is settings.activeKey
+     * (points at models[].key). settings.model is a derived mirror of that
+     * entry kept in sync for legacy boot paths (cli/main.ts, repl.ts, etc.)
+     * which read provider/name/apiKey/baseUrl directly. Writers must update
+     * both — appendOnboardingResult does this in one shot.
+     */
+    activeKey: z.ZodOptional<z.ZodString>;
+    /**
+     * Toggle background auto-update. When true (default), code-shell checks
+     * npm for newer versions and — if the npm global prefix is writable —
+     * installs the update in the background on process exit so the next
+     * launch picks it up.
+     * Can also be disabled via env var `DISABLE_AUTOUPDATER=1`.
+     */
+    autoUpdates: z.ZodDefault<z.ZodBoolean>;
+    model: z.ZodDefault<z.ZodObject<{
+        provider: z.ZodDefault<z.ZodString>;
+        name: z.ZodDefault<z.ZodString>;
+        apiKey: z.ZodOptional<z.ZodString>;
+        baseUrl: z.ZodDefault<z.ZodString>;
+        temperature: z.ZodDefault<z.ZodNumber>;
+        maxTokens: z.ZodDefault<z.ZodNumber>;
+    }, "strip", z.ZodTypeAny, {
+        provider: string;
+        name: string;
+        temperature: number;
+        baseUrl: string;
+        maxTokens: number;
+        apiKey?: string | undefined;
+    }, {
+        provider?: string | undefined;
+        name?: string | undefined;
+        temperature?: number | undefined;
+        baseUrl?: string | undefined;
+        apiKey?: string | undefined;
+        maxTokens?: number | undefined;
+    }>>;
+    providers: z.ZodDefault<z.ZodArray<z.ZodObject<{
+        key: z.ZodString;
+        label: z.ZodOptional<z.ZodString>;
+        kind: z.ZodEnum<["openai", "anthropic", "deepseek", "zai", "xai", "mistral", "groq", "google", "openrouter", "ollama", "custom"]>;
+        baseUrl: z.ZodString;
+        apiKey: z.ZodOptional<z.ZodString>;
+        protocol: z.ZodOptional<z.ZodEnum<["openai-compat", "anthropic-style"]>>;
+        modelsPath: z.ZodOptional<z.ZodString>;
+        /**
+         * DeepSeek V4 thinking-mode default for this provider. "enabled"
+         * matches endpoint default; "disabled" makes V4 calls run in
+         * non-thinking mode (faster, cheaper). Ignored by every provider
+         * other than DeepSeek V4. Per-call overrides still win.
+         */
+        thinking: z.ZodOptional<z.ZodEnum<["enabled", "disabled"]>>;
+    }, "strip", z.ZodTypeAny, {
+        key: string;
+        kind: "anthropic" | "openai" | "deepseek" | "zai" | "xai" | "mistral" | "groq" | "google" | "openrouter" | "ollama" | "custom";
+        baseUrl: string;
+        thinking?: "enabled" | "disabled" | undefined;
+        label?: string | undefined;
+        apiKey?: string | undefined;
+        protocol?: "openai-compat" | "anthropic-style" | undefined;
+        modelsPath?: string | undefined;
+    }, {
+        key: string;
+        kind: "anthropic" | "openai" | "deepseek" | "zai" | "xai" | "mistral" | "groq" | "google" | "openrouter" | "ollama" | "custom";
+        baseUrl: string;
+        thinking?: "enabled" | "disabled" | undefined;
+        label?: string | undefined;
+        apiKey?: string | undefined;
+        protocol?: "openai-compat" | "anthropic-style" | undefined;
+        modelsPath?: string | undefined;
+    }>, "many">>;
+    models: z.ZodDefault<z.ZodArray<z.ZodEffects<z.ZodObject<{
+        key: z.ZodString;
+        label: z.ZodOptional<z.ZodString>;
+        providerKey: z.ZodOptional<z.ZodString>;
+        model: z.ZodString;
+        maxOutputTokens: z.ZodOptional<z.ZodNumber>;
+        maxContextTokens: z.ZodOptional<z.ZodNumber>;
+        /**
+         * Which LLM client to use ("openai" or "anthropic"). New name —
+         * the legacy field is `provider`, which we still accept and
+         * fold into `protocol` below so old configs keep working.
+         * NOT the brand/vendor — that's providerKey above.
+         */
+        protocol: z.ZodOptional<z.ZodString>;
+        provider: z.ZodOptional<z.ZodString>;
+        baseUrl: z.ZodOptional<z.ZodString>;
+        apiKey: z.ZodOptional<z.ZodString>;
+        /**
+         * Per-model thinking override. Wins over the provider-level
+         * setting (settings.providers[].thinking). Use this when
+         * different models under the same provider need different
+         * defaults — e.g. DeepSeek V4 Pro off (faster) but V4 Flash on.
+         */
+        thinking: z.ZodOptional<z.ZodEnum<["enabled", "disabled"]>>;
+    }, "strip", z.ZodTypeAny, {
+        model: string;
+        key: string;
+        provider?: string | undefined;
+        thinking?: "enabled" | "disabled" | undefined;
+        label?: string | undefined;
+        baseUrl?: string | undefined;
+        apiKey?: string | undefined;
+        protocol?: string | undefined;
+        providerKey?: string | undefined;
+        maxOutputTokens?: number | undefined;
+        maxContextTokens?: number | undefined;
+    }, {
+        model: string;
+        key: string;
+        provider?: string | undefined;
+        thinking?: "enabled" | "disabled" | undefined;
+        label?: string | undefined;
+        baseUrl?: string | undefined;
+        apiKey?: string | undefined;
+        protocol?: string | undefined;
+        providerKey?: string | undefined;
+        maxOutputTokens?: number | undefined;
+        maxContextTokens?: number | undefined;
+    }>, {
+        protocol: string | undefined;
+        provider: string | undefined;
+        model: string;
+        key: string;
+        thinking?: "enabled" | "disabled" | undefined;
+        label?: string | undefined;
+        baseUrl?: string | undefined;
+        apiKey?: string | undefined;
+        providerKey?: string | undefined;
+        maxOutputTokens?: number | undefined;
+        maxContextTokens?: number | undefined;
+    }, {
+        model: string;
+        key: string;
+        provider?: string | undefined;
+        thinking?: "enabled" | "disabled" | undefined;
+        label?: string | undefined;
+        baseUrl?: string | undefined;
+        apiKey?: string | undefined;
+        protocol?: string | undefined;
+        providerKey?: string | undefined;
+        maxOutputTokens?: number | undefined;
+        maxContextTokens?: number | undefined;
+    }>, "many">>;
+    permissions: z.ZodDefault<z.ZodObject<{
+        defaultMode: z.ZodDefault<z.ZodEnum<["default", "acceptEdits", "dontAsk", "bypassPermissions", "auto", "plan"]>>;
+        rules: z.ZodDefault<z.ZodArray<z.ZodObject<{
+            tool: z.ZodString;
+            argsPattern: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+            decision: z.ZodEnum<["allow", "deny", "ask"]>;
+            reason: z.ZodOptional<z.ZodString>;
+        }, "strip", z.ZodTypeAny, {
+            tool: string;
+            decision: "allow" | "deny" | "ask";
+            reason?: string | undefined;
+            argsPattern?: Record<string, string> | undefined;
+        }, {
+            tool: string;
+            decision: "allow" | "deny" | "ask";
+            reason?: string | undefined;
+            argsPattern?: Record<string, string> | undefined;
+        }>, "many">>;
+    }, "strip", z.ZodTypeAny, {
+        defaultMode: "default" | "acceptEdits" | "dontAsk" | "bypassPermissions" | "auto" | "plan";
+        rules: {
+            tool: string;
+            decision: "allow" | "deny" | "ask";
+            reason?: string | undefined;
+            argsPattern?: Record<string, string> | undefined;
+        }[];
+    }, {
+        defaultMode?: "default" | "acceptEdits" | "dontAsk" | "bypassPermissions" | "auto" | "plan" | undefined;
+        rules?: {
+            tool: string;
+            decision: "allow" | "deny" | "ask";
+            reason?: string | undefined;
+            argsPattern?: Record<string, string> | undefined;
+        }[] | undefined;
+    }>>;
+    context: z.ZodDefault<z.ZodObject<{
+        maxTokens: z.ZodDefault<z.ZodNumber>;
+        compactAtRatio: z.ZodDefault<z.ZodNumber>;
+        summarizeAtRatio: z.ZodDefault<z.ZodNumber>;
+    }, "strip", z.ZodTypeAny, {
+        maxTokens: number;
+        compactAtRatio: number;
+        summarizeAtRatio: number;
+    }, {
+        maxTokens?: number | undefined;
+        compactAtRatio?: number | undefined;
+        summarizeAtRatio?: number | undefined;
+    }>>;
+    session: z.ZodDefault<z.ZodObject<{
+        storageDir: z.ZodOptional<z.ZodString>;
+        maxHistory: z.ZodDefault<z.ZodNumber>;
+    }, "strip", z.ZodTypeAny, {
+        maxHistory: number;
+        storageDir?: string | undefined;
+    }, {
+        storageDir?: string | undefined;
+        maxHistory?: number | undefined;
+    }>>;
+    mcpServers: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodObject<{
+        name: z.ZodString;
+        command: z.ZodOptional<z.ZodString>;
+        args: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        env: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+        url: z.ZodOptional<z.ZodString>;
+        transport: z.ZodOptional<z.ZodEnum<["stdio", "sse", "streamable-http", "inprocess"]>>;
+        headers: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+    }, "strip", z.ZodTypeAny, {
+        name: string;
+        url?: string | undefined;
+        args?: string[] | undefined;
+        env?: Record<string, string> | undefined;
+        command?: string | undefined;
+        transport?: "stdio" | "sse" | "streamable-http" | "inprocess" | undefined;
+        headers?: Record<string, string> | undefined;
+    }, {
+        name: string;
+        url?: string | undefined;
+        args?: string[] | undefined;
+        env?: Record<string, string> | undefined;
+        command?: string | undefined;
+        transport?: "stdio" | "sse" | "streamable-http" | "inprocess" | undefined;
+        headers?: Record<string, string> | undefined;
+    }>>>;
+    /**
+     * Skill names hidden from the LLM. Names include the full
+     * "<plugin>:<skill>" prefix for plugin skills. Filtered at the
+     * scanner so PromptComposer's skills listing and the skill builtin
+     * tool both see the filtered set — see scanSkills(opts).
+     */
+    disabledSkills: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+    instructions: z.ZodDefault<z.ZodObject<{
+        fileName: z.ZodDefault<z.ZodString>;
+        scanDirs: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+        compatFileNames: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+        ignoreGitBoundary: z.ZodDefault<z.ZodBoolean>;
+    }, "strip", z.ZodTypeAny, {
+        fileName: string;
+        scanDirs: string[];
+        compatFileNames: string[];
+        ignoreGitBoundary: boolean;
+    }, {
+        fileName?: string | undefined;
+        scanDirs?: string[] | undefined;
+        compatFileNames?: string[] | undefined;
+        ignoreGitBoundary?: boolean | undefined;
+    }>>;
+    arena: z.ZodDefault<z.ZodObject<{
+        participants: z.ZodDefault<z.ZodArray<z.ZodUnion<[z.ZodString, z.ZodObject<{
+            name: z.ZodString;
+            model: z.ZodString;
+            provider: z.ZodOptional<z.ZodString>;
+            apiKey: z.ZodOptional<z.ZodString>;
+            baseUrl: z.ZodOptional<z.ZodString>;
+        }, "strip", z.ZodTypeAny, {
+            model: string;
+            name: string;
+            provider?: string | undefined;
+            baseUrl?: string | undefined;
+            apiKey?: string | undefined;
+        }, {
+            model: string;
+            name: string;
+            provider?: string | undefined;
+            baseUrl?: string | undefined;
+            apiKey?: string | undefined;
+        }>]>, "many">>;
+    }, "strip", z.ZodTypeAny, {
+        participants: (string | {
+            model: string;
+            name: string;
+            provider?: string | undefined;
+            baseUrl?: string | undefined;
+            apiKey?: string | undefined;
+        })[];
+    }, {
+        participants?: (string | {
+            model: string;
+            name: string;
+            provider?: string | undefined;
+            baseUrl?: string | undefined;
+            apiKey?: string | undefined;
+        })[] | undefined;
+    }>>;
+    search: z.ZodDefault<z.ZodObject<{
+        provider: z.ZodDefault<z.ZodEnum<["serper", "tavily", "searxng"]>>;
+        apiKey: z.ZodOptional<z.ZodString>;
+        baseUrl: z.ZodOptional<z.ZodString>;
+        /**
+         * Per-provider credentials bag. Lets the desktop UI keep
+         * Serper/Tavily/SearXNG configured simultaneously and flip the
+         * default without losing the others. `provider/apiKey/baseUrl`
+         * remain authoritative for the *active* provider so legacy
+         * readers keep working.
+         */
+        providers: z.ZodOptional<z.ZodRecord<z.ZodEnum<["serper", "tavily", "searxng"]>, z.ZodObject<{
+            apiKey: z.ZodOptional<z.ZodString>;
+            baseUrl: z.ZodOptional<z.ZodString>;
+        }, "strip", z.ZodTypeAny, {
+            baseUrl?: string | undefined;
+            apiKey?: string | undefined;
+        }, {
+            baseUrl?: string | undefined;
+            apiKey?: string | undefined;
+        }>>>;
+    }, "strip", z.ZodTypeAny, {
+        provider: "serper" | "tavily" | "searxng";
+        baseUrl?: string | undefined;
+        apiKey?: string | undefined;
+        providers?: Partial<Record<"serper" | "tavily" | "searxng", {
+            baseUrl?: string | undefined;
+            apiKey?: string | undefined;
+        }>> | undefined;
+    }, {
+        provider?: "serper" | "tavily" | "searxng" | undefined;
+        baseUrl?: string | undefined;
+        apiKey?: string | undefined;
+        providers?: Partial<Record<"serper" | "tavily" | "searxng", {
+            baseUrl?: string | undefined;
+            apiKey?: string | undefined;
+        }>> | undefined;
+    }>>;
+    output: z.ZodDefault<z.ZodObject<{
+        format: z.ZodDefault<z.ZodEnum<["text", "json", "jsonl", "stream-json"]>>;
+    }, "strip", z.ZodTypeAny, {
+        format: "text" | "json" | "jsonl" | "stream-json";
+    }, {
+        format?: "text" | "json" | "jsonl" | "stream-json" | undefined;
+    }>>;
+    /**
+     * OS-level sandbox for shell-tool execution. "auto" picks per platform:
+     * Seatbelt on macOS, bubblewrap on Linux when installed, otherwise off.
+     * Defaults are applied per Engine run depending on headless vs REPL —
+     * see Engine.run() and run.ts.
+     */
+    sandbox: z.ZodOptional<z.ZodObject<{
+        mode: z.ZodOptional<z.ZodEnum<["off", "auto", "seatbelt", "bwrap"]>>;
+        writableRoots: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        deniedReads: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        network: z.ZodOptional<z.ZodEnum<["allow", "deny"]>>;
+    }, "strip", z.ZodTypeAny, {
+        mode?: "auto" | "seatbelt" | "bwrap" | "off" | undefined;
+        writableRoots?: string[] | undefined;
+        deniedReads?: string[] | undefined;
+        network?: "allow" | "deny" | undefined;
+    }, {
+        mode?: "auto" | "seatbelt" | "bwrap" | "off" | undefined;
+        writableRoots?: string[] | undefined;
+        deniedReads?: string[] | undefined;
+        network?: "allow" | "deny" | undefined;
+    }>>;
+    /**
+     * Shell-hook configuration. Each entry binds a HookEventName to a
+     * shell command; the command receives ctx JSON on stdin and returns
+     * a HookResult JSON on stdout (or exit 2 = deny with stderr as
+     * reason). See src/hooks/shell-runner.ts for the wire protocol.
+     *
+     * The event field is loose-typed here (z.string()) because adding
+     * new lifecycle events shouldn't force a schema bump; the runner
+     * silently ignores entries whose event isn't registered.
+     */
+    hooks: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        event: z.ZodString;
+        command: z.ZodString;
+        matcher: z.ZodOptional<z.ZodString>;
+        timeout_ms: z.ZodOptional<z.ZodNumber>;
+        cwd: z.ZodOptional<z.ZodString>;
+    }, "strip", z.ZodTypeAny, {
+        command: string;
+        event: string;
+        cwd?: string | undefined;
+        matcher?: string | undefined;
+        timeout_ms?: number | undefined;
+    }, {
+        command: string;
+        event: string;
+        cwd?: string | undefined;
+        matcher?: string | undefined;
+        timeout_ms?: number | undefined;
+    }>, "many">>;
+}, z.ZodTypeAny, "passthrough">, z.objectInputType<{
+    agent: z.ZodDefault<z.ZodObject<{
+        preset: z.ZodDefault<z.ZodString>;
+        enabledBuiltinTools: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+        disabledBuiltinTools: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+        customSystemPrompt: z.ZodOptional<z.ZodString>;
+        appendSystemPrompt: z.ZodOptional<z.ZodString>;
+    }, "strip", z.ZodTypeAny, {
+        preset: string;
+        enabledBuiltinTools: string[];
+        disabledBuiltinTools: string[];
+        customSystemPrompt?: string | undefined;
+        appendSystemPrompt?: string | undefined;
+    }, {
+        preset?: string | undefined;
+        enabledBuiltinTools?: string[] | undefined;
+        disabledBuiltinTools?: string[] | undefined;
+        customSystemPrompt?: string | undefined;
+        appendSystemPrompt?: string | undefined;
+    }>>;
+    /**
+     * Primary source of truth for the active model is settings.activeKey
+     * (points at models[].key). settings.model is a derived mirror of that
+     * entry kept in sync for legacy boot paths (cli/main.ts, repl.ts, etc.)
+     * which read provider/name/apiKey/baseUrl directly. Writers must update
+     * both — appendOnboardingResult does this in one shot.
+     */
+    activeKey: z.ZodOptional<z.ZodString>;
+    /**
+     * Toggle background auto-update. When true (default), code-shell checks
+     * npm for newer versions and — if the npm global prefix is writable —
+     * installs the update in the background on process exit so the next
+     * launch picks it up.
+     * Can also be disabled via env var `DISABLE_AUTOUPDATER=1`.
+     */
+    autoUpdates: z.ZodDefault<z.ZodBoolean>;
+    model: z.ZodDefault<z.ZodObject<{
+        provider: z.ZodDefault<z.ZodString>;
+        name: z.ZodDefault<z.ZodString>;
+        apiKey: z.ZodOptional<z.ZodString>;
+        baseUrl: z.ZodDefault<z.ZodString>;
+        temperature: z.ZodDefault<z.ZodNumber>;
+        maxTokens: z.ZodDefault<z.ZodNumber>;
+    }, "strip", z.ZodTypeAny, {
+        provider: string;
+        name: string;
+        temperature: number;
+        baseUrl: string;
+        maxTokens: number;
+        apiKey?: string | undefined;
+    }, {
+        provider?: string | undefined;
+        name?: string | undefined;
+        temperature?: number | undefined;
+        baseUrl?: string | undefined;
+        apiKey?: string | undefined;
+        maxTokens?: number | undefined;
+    }>>;
+    providers: z.ZodDefault<z.ZodArray<z.ZodObject<{
+        key: z.ZodString;
+        label: z.ZodOptional<z.ZodString>;
+        kind: z.ZodEnum<["openai", "anthropic", "deepseek", "zai", "xai", "mistral", "groq", "google", "openrouter", "ollama", "custom"]>;
+        baseUrl: z.ZodString;
+        apiKey: z.ZodOptional<z.ZodString>;
+        protocol: z.ZodOptional<z.ZodEnum<["openai-compat", "anthropic-style"]>>;
+        modelsPath: z.ZodOptional<z.ZodString>;
+        /**
+         * DeepSeek V4 thinking-mode default for this provider. "enabled"
+         * matches endpoint default; "disabled" makes V4 calls run in
+         * non-thinking mode (faster, cheaper). Ignored by every provider
+         * other than DeepSeek V4. Per-call overrides still win.
+         */
+        thinking: z.ZodOptional<z.ZodEnum<["enabled", "disabled"]>>;
+    }, "strip", z.ZodTypeAny, {
+        key: string;
+        kind: "anthropic" | "openai" | "deepseek" | "zai" | "xai" | "mistral" | "groq" | "google" | "openrouter" | "ollama" | "custom";
+        baseUrl: string;
+        thinking?: "enabled" | "disabled" | undefined;
+        label?: string | undefined;
+        apiKey?: string | undefined;
+        protocol?: "openai-compat" | "anthropic-style" | undefined;
+        modelsPath?: string | undefined;
+    }, {
+        key: string;
+        kind: "anthropic" | "openai" | "deepseek" | "zai" | "xai" | "mistral" | "groq" | "google" | "openrouter" | "ollama" | "custom";
+        baseUrl: string;
+        thinking?: "enabled" | "disabled" | undefined;
+        label?: string | undefined;
+        apiKey?: string | undefined;
+        protocol?: "openai-compat" | "anthropic-style" | undefined;
+        modelsPath?: string | undefined;
+    }>, "many">>;
+    models: z.ZodDefault<z.ZodArray<z.ZodEffects<z.ZodObject<{
+        key: z.ZodString;
+        label: z.ZodOptional<z.ZodString>;
+        providerKey: z.ZodOptional<z.ZodString>;
+        model: z.ZodString;
+        maxOutputTokens: z.ZodOptional<z.ZodNumber>;
+        maxContextTokens: z.ZodOptional<z.ZodNumber>;
+        /**
+         * Which LLM client to use ("openai" or "anthropic"). New name —
+         * the legacy field is `provider`, which we still accept and
+         * fold into `protocol` below so old configs keep working.
+         * NOT the brand/vendor — that's providerKey above.
+         */
+        protocol: z.ZodOptional<z.ZodString>;
+        provider: z.ZodOptional<z.ZodString>;
+        baseUrl: z.ZodOptional<z.ZodString>;
+        apiKey: z.ZodOptional<z.ZodString>;
+        /**
+         * Per-model thinking override. Wins over the provider-level
+         * setting (settings.providers[].thinking). Use this when
+         * different models under the same provider need different
+         * defaults — e.g. DeepSeek V4 Pro off (faster) but V4 Flash on.
+         */
+        thinking: z.ZodOptional<z.ZodEnum<["enabled", "disabled"]>>;
+    }, "strip", z.ZodTypeAny, {
+        model: string;
+        key: string;
+        provider?: string | undefined;
+        thinking?: "enabled" | "disabled" | undefined;
+        label?: string | undefined;
+        baseUrl?: string | undefined;
+        apiKey?: string | undefined;
+        protocol?: string | undefined;
+        providerKey?: string | undefined;
+        maxOutputTokens?: number | undefined;
+        maxContextTokens?: number | undefined;
+    }, {
+        model: string;
+        key: string;
+        provider?: string | undefined;
+        thinking?: "enabled" | "disabled" | undefined;
+        label?: string | undefined;
+        baseUrl?: string | undefined;
+        apiKey?: string | undefined;
+        protocol?: string | undefined;
+        providerKey?: string | undefined;
+        maxOutputTokens?: number | undefined;
+        maxContextTokens?: number | undefined;
+    }>, {
+        protocol: string | undefined;
+        provider: string | undefined;
+        model: string;
+        key: string;
+        thinking?: "enabled" | "disabled" | undefined;
+        label?: string | undefined;
+        baseUrl?: string | undefined;
+        apiKey?: string | undefined;
+        providerKey?: string | undefined;
+        maxOutputTokens?: number | undefined;
+        maxContextTokens?: number | undefined;
+    }, {
+        model: string;
+        key: string;
+        provider?: string | undefined;
+        thinking?: "enabled" | "disabled" | undefined;
+        label?: string | undefined;
+        baseUrl?: string | undefined;
+        apiKey?: string | undefined;
+        protocol?: string | undefined;
+        providerKey?: string | undefined;
+        maxOutputTokens?: number | undefined;
+        maxContextTokens?: number | undefined;
+    }>, "many">>;
+    permissions: z.ZodDefault<z.ZodObject<{
+        defaultMode: z.ZodDefault<z.ZodEnum<["default", "acceptEdits", "dontAsk", "bypassPermissions", "auto", "plan"]>>;
+        rules: z.ZodDefault<z.ZodArray<z.ZodObject<{
+            tool: z.ZodString;
+            argsPattern: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+            decision: z.ZodEnum<["allow", "deny", "ask"]>;
+            reason: z.ZodOptional<z.ZodString>;
+        }, "strip", z.ZodTypeAny, {
+            tool: string;
+            decision: "allow" | "deny" | "ask";
+            reason?: string | undefined;
+            argsPattern?: Record<string, string> | undefined;
+        }, {
+            tool: string;
+            decision: "allow" | "deny" | "ask";
+            reason?: string | undefined;
+            argsPattern?: Record<string, string> | undefined;
+        }>, "many">>;
+    }, "strip", z.ZodTypeAny, {
+        defaultMode: "default" | "acceptEdits" | "dontAsk" | "bypassPermissions" | "auto" | "plan";
+        rules: {
+            tool: string;
+            decision: "allow" | "deny" | "ask";
+            reason?: string | undefined;
+            argsPattern?: Record<string, string> | undefined;
+        }[];
+    }, {
+        defaultMode?: "default" | "acceptEdits" | "dontAsk" | "bypassPermissions" | "auto" | "plan" | undefined;
+        rules?: {
+            tool: string;
+            decision: "allow" | "deny" | "ask";
+            reason?: string | undefined;
+            argsPattern?: Record<string, string> | undefined;
+        }[] | undefined;
+    }>>;
+    context: z.ZodDefault<z.ZodObject<{
+        maxTokens: z.ZodDefault<z.ZodNumber>;
+        compactAtRatio: z.ZodDefault<z.ZodNumber>;
+        summarizeAtRatio: z.ZodDefault<z.ZodNumber>;
+    }, "strip", z.ZodTypeAny, {
+        maxTokens: number;
+        compactAtRatio: number;
+        summarizeAtRatio: number;
+    }, {
+        maxTokens?: number | undefined;
+        compactAtRatio?: number | undefined;
+        summarizeAtRatio?: number | undefined;
+    }>>;
+    session: z.ZodDefault<z.ZodObject<{
+        storageDir: z.ZodOptional<z.ZodString>;
+        maxHistory: z.ZodDefault<z.ZodNumber>;
+    }, "strip", z.ZodTypeAny, {
+        maxHistory: number;
+        storageDir?: string | undefined;
+    }, {
+        storageDir?: string | undefined;
+        maxHistory?: number | undefined;
+    }>>;
+    mcpServers: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodObject<{
+        name: z.ZodString;
+        command: z.ZodOptional<z.ZodString>;
+        args: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        env: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+        url: z.ZodOptional<z.ZodString>;
+        transport: z.ZodOptional<z.ZodEnum<["stdio", "sse", "streamable-http", "inprocess"]>>;
+        headers: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+    }, "strip", z.ZodTypeAny, {
+        name: string;
+        url?: string | undefined;
+        args?: string[] | undefined;
+        env?: Record<string, string> | undefined;
+        command?: string | undefined;
+        transport?: "stdio" | "sse" | "streamable-http" | "inprocess" | undefined;
+        headers?: Record<string, string> | undefined;
+    }, {
+        name: string;
+        url?: string | undefined;
+        args?: string[] | undefined;
+        env?: Record<string, string> | undefined;
+        command?: string | undefined;
+        transport?: "stdio" | "sse" | "streamable-http" | "inprocess" | undefined;
+        headers?: Record<string, string> | undefined;
+    }>>>;
+    /**
+     * Skill names hidden from the LLM. Names include the full
+     * "<plugin>:<skill>" prefix for plugin skills. Filtered at the
+     * scanner so PromptComposer's skills listing and the skill builtin
+     * tool both see the filtered set — see scanSkills(opts).
+     */
+    disabledSkills: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+    instructions: z.ZodDefault<z.ZodObject<{
+        fileName: z.ZodDefault<z.ZodString>;
+        scanDirs: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+        compatFileNames: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+        ignoreGitBoundary: z.ZodDefault<z.ZodBoolean>;
+    }, "strip", z.ZodTypeAny, {
+        fileName: string;
+        scanDirs: string[];
+        compatFileNames: string[];
+        ignoreGitBoundary: boolean;
+    }, {
+        fileName?: string | undefined;
+        scanDirs?: string[] | undefined;
+        compatFileNames?: string[] | undefined;
+        ignoreGitBoundary?: boolean | undefined;
+    }>>;
+    arena: z.ZodDefault<z.ZodObject<{
+        participants: z.ZodDefault<z.ZodArray<z.ZodUnion<[z.ZodString, z.ZodObject<{
+            name: z.ZodString;
+            model: z.ZodString;
+            provider: z.ZodOptional<z.ZodString>;
+            apiKey: z.ZodOptional<z.ZodString>;
+            baseUrl: z.ZodOptional<z.ZodString>;
+        }, "strip", z.ZodTypeAny, {
+            model: string;
+            name: string;
+            provider?: string | undefined;
+            baseUrl?: string | undefined;
+            apiKey?: string | undefined;
+        }, {
+            model: string;
+            name: string;
+            provider?: string | undefined;
+            baseUrl?: string | undefined;
+            apiKey?: string | undefined;
+        }>]>, "many">>;
+    }, "strip", z.ZodTypeAny, {
+        participants: (string | {
+            model: string;
+            name: string;
+            provider?: string | undefined;
+            baseUrl?: string | undefined;
+            apiKey?: string | undefined;
+        })[];
+    }, {
+        participants?: (string | {
+            model: string;
+            name: string;
+            provider?: string | undefined;
+            baseUrl?: string | undefined;
+            apiKey?: string | undefined;
+        })[] | undefined;
+    }>>;
+    search: z.ZodDefault<z.ZodObject<{
+        provider: z.ZodDefault<z.ZodEnum<["serper", "tavily", "searxng"]>>;
+        apiKey: z.ZodOptional<z.ZodString>;
+        baseUrl: z.ZodOptional<z.ZodString>;
+        /**
+         * Per-provider credentials bag. Lets the desktop UI keep
+         * Serper/Tavily/SearXNG configured simultaneously and flip the
+         * default without losing the others. `provider/apiKey/baseUrl`
+         * remain authoritative for the *active* provider so legacy
+         * readers keep working.
+         */
+        providers: z.ZodOptional<z.ZodRecord<z.ZodEnum<["serper", "tavily", "searxng"]>, z.ZodObject<{
+            apiKey: z.ZodOptional<z.ZodString>;
+            baseUrl: z.ZodOptional<z.ZodString>;
+        }, "strip", z.ZodTypeAny, {
+            baseUrl?: string | undefined;
+            apiKey?: string | undefined;
+        }, {
+            baseUrl?: string | undefined;
+            apiKey?: string | undefined;
+        }>>>;
+    }, "strip", z.ZodTypeAny, {
+        provider: "serper" | "tavily" | "searxng";
+        baseUrl?: string | undefined;
+        apiKey?: string | undefined;
+        providers?: Partial<Record<"serper" | "tavily" | "searxng", {
+            baseUrl?: string | undefined;
+            apiKey?: string | undefined;
+        }>> | undefined;
+    }, {
+        provider?: "serper" | "tavily" | "searxng" | undefined;
+        baseUrl?: string | undefined;
+        apiKey?: string | undefined;
+        providers?: Partial<Record<"serper" | "tavily" | "searxng", {
+            baseUrl?: string | undefined;
+            apiKey?: string | undefined;
+        }>> | undefined;
+    }>>;
+    output: z.ZodDefault<z.ZodObject<{
+        format: z.ZodDefault<z.ZodEnum<["text", "json", "jsonl", "stream-json"]>>;
+    }, "strip", z.ZodTypeAny, {
+        format: "text" | "json" | "jsonl" | "stream-json";
+    }, {
+        format?: "text" | "json" | "jsonl" | "stream-json" | undefined;
+    }>>;
+    /**
+     * OS-level sandbox for shell-tool execution. "auto" picks per platform:
+     * Seatbelt on macOS, bubblewrap on Linux when installed, otherwise off.
+     * Defaults are applied per Engine run depending on headless vs REPL —
+     * see Engine.run() and run.ts.
+     */
+    sandbox: z.ZodOptional<z.ZodObject<{
+        mode: z.ZodOptional<z.ZodEnum<["off", "auto", "seatbelt", "bwrap"]>>;
+        writableRoots: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        deniedReads: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        network: z.ZodOptional<z.ZodEnum<["allow", "deny"]>>;
+    }, "strip", z.ZodTypeAny, {
+        mode?: "auto" | "seatbelt" | "bwrap" | "off" | undefined;
+        writableRoots?: string[] | undefined;
+        deniedReads?: string[] | undefined;
+        network?: "allow" | "deny" | undefined;
+    }, {
+        mode?: "auto" | "seatbelt" | "bwrap" | "off" | undefined;
+        writableRoots?: string[] | undefined;
+        deniedReads?: string[] | undefined;
+        network?: "allow" | "deny" | undefined;
+    }>>;
+    /**
+     * Shell-hook configuration. Each entry binds a HookEventName to a
+     * shell command; the command receives ctx JSON on stdin and returns
+     * a HookResult JSON on stdout (or exit 2 = deny with stderr as
+     * reason). See src/hooks/shell-runner.ts for the wire protocol.
+     *
+     * The event field is loose-typed here (z.string()) because adding
+     * new lifecycle events shouldn't force a schema bump; the runner
+     * silently ignores entries whose event isn't registered.
+     */
+    hooks: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        event: z.ZodString;
+        command: z.ZodString;
+        matcher: z.ZodOptional<z.ZodString>;
+        timeout_ms: z.ZodOptional<z.ZodNumber>;
+        cwd: z.ZodOptional<z.ZodString>;
+    }, "strip", z.ZodTypeAny, {
+        command: string;
+        event: string;
+        cwd?: string | undefined;
+        matcher?: string | undefined;
+        timeout_ms?: number | undefined;
+    }, {
+        command: string;
+        event: string;
+        cwd?: string | undefined;
+        matcher?: string | undefined;
+        timeout_ms?: number | undefined;
+    }>, "many">>;
+}, z.ZodTypeAny, "passthrough">>;
+export type ValidatedSettings = z.infer<typeof SettingsSchema>;
+export declare function validateSettings(raw: unknown): ValidatedSettings;