@cjhyy/code-shell-core 0.5.0-rc.1 → 0.6.0-rc.1

package/dist/settings/schema.d.ts

@@ -2,6 +2,48 @@
  * Settings schema with Zod validation.
  */
 import { z } from "zod";
+/**
+ * Tri-state project capability overlay. Lives in PROJECT settings only and
+ * layers over the global baseline (disabledSkills / disabledPlugins /
+ * mcpServers.<name>.enabled / disabledAgents). NOT a second denylist:
+ *   - "on"      → force enabled (even if globally disabled)
+ *   - "off"     → force disabled (even if globally enabled)
+ *   - "inherit" → take the global baseline. We don't persist "inherit"; an
+ *                 absent key means inherit. See the project-scoped
+ *                 capabilities design (spec §4).
+ */
+export declare const CapabilityOverrideSchema: z.ZodEnum<["inherit", "on", "off"]>;
+export type CapabilityOverride = z.infer<typeof CapabilityOverrideSchema>;
+export declare const CapabilityOverridesSchema: z.ZodOptional<z.ZodObject<{
+    skills: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodEnum<["inherit", "on", "off"]>>>;
+    plugins: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodEnum<["inherit", "on", "off"]>>>;
+    agents: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodEnum<["inherit", "on", "off"]>>>;
+    mcp: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodEnum<["inherit", "on", "off"]>>>;
+    builtin: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodEnum<["inherit", "on", "off"]>>>;
+    /**
+     * Per-hook overlay for PLUGIN-provided hooks, keyed by
+     * `pluginHookKey()` (`<plugin>:<RawEvent>:<command>`). Finer-grained
+     * than `plugins` (which kills a whole plugin): "off" suppresses one
+     * hook for this project only. Only "off" is meaningful today — plugin
+     * hooks have no global disable list to force back "on" from.
+     */
+    pluginHooks: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodEnum<["inherit", "on", "off"]>>>;
+}, "strip", z.ZodTypeAny, {
+    builtin?: Record<string, "off" | "on" | "inherit"> | undefined;
+    mcp?: Record<string, "off" | "on" | "inherit"> | undefined;
+    skills?: Record<string, "off" | "on" | "inherit"> | undefined;
+    plugins?: Record<string, "off" | "on" | "inherit"> | undefined;
+    agents?: Record<string, "off" | "on" | "inherit"> | undefined;
+    pluginHooks?: Record<string, "off" | "on" | "inherit"> | undefined;
+}, {
+    builtin?: Record<string, "off" | "on" | "inherit"> | undefined;
+    mcp?: Record<string, "off" | "on" | "inherit"> | undefined;
+    skills?: Record<string, "off" | "on" | "inherit"> | undefined;
+    plugins?: Record<string, "off" | "on" | "inherit"> | undefined;
+    agents?: Record<string, "off" | "on" | "inherit"> | undefined;
+    pluginHooks?: Record<string, "off" | "on" | "inherit"> | undefined;
+}>>;
+export type CapabilityOverrides = z.infer<typeof CapabilityOverridesSchema>;
 export declare const SettingsSchema: z.ZodObject<{
     agent: z.ZodDefault<z.ZodObject<{
         preset: z.ZodDefault<z.ZodString>;
@@ -9,27 +51,43 @@ export declare const SettingsSchema: z.ZodObject<{
         disabledBuiltinTools: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
         customSystemPrompt: z.ZodOptional<z.ZodString>;
         appendSystemPrompt: z.ZodOptional<z.ZodString>;
+        responseLanguage: z.ZodOptional<z.ZodString>;
+        userProfile: z.ZodOptional<z.ZodString>;
+        instructions: z.ZodOptional<z.ZodObject<{
+            compatClaude: z.ZodDefault<z.ZodBoolean>;
+            compatCodex: z.ZodDefault<z.ZodBoolean>;
+        }, "strip", z.ZodTypeAny, {
+            compatClaude: boolean;
+            compatCodex: boolean;
+        }, {
+            compatClaude?: boolean | undefined;
+            compatCodex?: boolean | undefined;
+        }>>;
     }, "strip", z.ZodTypeAny, {
         preset: string;
         enabledBuiltinTools: string[];
         disabledBuiltinTools: string[];
         customSystemPrompt?: string | undefined;
         appendSystemPrompt?: string | undefined;
+        responseLanguage?: string | undefined;
+        userProfile?: string | undefined;
+        instructions?: {
+            compatClaude: boolean;
+            compatCodex: boolean;
+        } | undefined;
     }, {
         preset?: string | undefined;
         enabledBuiltinTools?: string[] | undefined;
         disabledBuiltinTools?: string[] | undefined;
         customSystemPrompt?: string | undefined;
         appendSystemPrompt?: string | undefined;
+        responseLanguage?: string | undefined;
+        userProfile?: string | undefined;
+        instructions?: {
+            compatClaude?: boolean | undefined;
+            compatCodex?: boolean | undefined;
+        } | undefined;
     }>>;
-    /**
-     * Primary source of truth for the active model is settings.activeKey
-     * (points at models[].key). settings.model is a derived mirror of that
-     * entry kept in sync for legacy boot paths (cli/main.ts, repl.ts, etc.)
-     * which read provider/name/apiKey/baseUrl directly. Writers must update
-     * both — appendOnboardingResult does this in one shot.
-     */
-    activeKey: z.ZodOptional<z.ZodString>;
     /**
      * Toggle background auto-update. When true (default), code-shell checks
      * npm for newer versions and — if the npm global prefix is writable —
@@ -38,135 +96,215 @@ export declare const SettingsSchema: z.ZodObject<{
      * Can also be disabled via env var `DISABLE_AUTOUPDATER=1`.
      */
     autoUpdates: z.ZodDefault<z.ZodBoolean>;
-    model: z.ZodDefault<z.ZodObject<{
-        provider: z.ZodDefault<z.ZodString>;
-        name: z.ZodDefault<z.ZodString>;
-        apiKey: z.ZodOptional<z.ZodString>;
-        baseUrl: z.ZodDefault<z.ZodString>;
-        temperature: z.ZodDefault<z.ZodNumber>;
-        maxTokens: z.ZodDefault<z.ZodNumber>;
+    /**
+     * Image generation is a general capability, decoupled from LLM providers
+     * (TODO 7.1): a vendor may use different keys/endpoints/models for chat vs
+     * image, and image vendors (Gemini, and later 国内 模型) don't fit the LLM
+     * `providers[].kind` enum. `imageGen.providers[]` is the canonical config;
+     * each entry has a user-chosen `id` (selected via GenerateImage's
+     * `provider` arg) and a `kind` that picks the adapter. When `imageGen` is
+     * absent, resolution falls back to scanning LLM `providers[]` for an
+     * image-capable kind — so existing configs keep working with no migration.
+     */
+    imageGen: z.ZodOptional<z.ZodObject<{
+        defaultProvider: z.ZodOptional<z.ZodString>;
+        providers: z.ZodDefault<z.ZodArray<z.ZodObject<{
+            /** User-chosen instance name; GenerateImage(provider) selects by this. */
+            id: z.ZodString;
+            /** Adapter selector — e.g. "openai", "google". */
+            kind: z.ZodString;
+            baseUrl: z.ZodString;
+            apiKey: z.ZodOptional<z.ZodString>;
+            /** Default model for this instance when the call omits `model`. */
+            defaultModel: z.ZodOptional<z.ZodString>;
+            /** Catalog template this instance was created from (for paramsDoc / displayName回显). */
+            catalogId: z.ZodOptional<z.ZodString>;
+            /** Reuse another instance's key: id of the instance whose apiKey to use (when apiKey is empty). */
+            apiKeyRef: z.ZodOptional<z.ZodString>;
+        }, "strip", z.ZodTypeAny, {
+            id: string;
+            kind: string;
+            baseUrl: string;
+            apiKey?: string | undefined;
+            defaultModel?: string | undefined;
+            catalogId?: string | undefined;
+            apiKeyRef?: string | undefined;
+        }, {
+            id: string;
+            kind: string;
+            baseUrl: string;
+            apiKey?: string | undefined;
+            defaultModel?: string | undefined;
+            catalogId?: string | undefined;
+            apiKeyRef?: string | undefined;
+        }>, "many">>;
     }, "strip", z.ZodTypeAny, {
-        provider: string;
-        name: string;
-        temperature: number;
-        baseUrl: string;
-        maxTokens: number;
-        apiKey?: string | undefined;
+        providers: {
+            id: string;
+            kind: string;
+            baseUrl: string;
+            apiKey?: string | undefined;
+            defaultModel?: string | undefined;
+            catalogId?: string | undefined;
+            apiKeyRef?: string | undefined;
+        }[];
+        defaultProvider?: string | undefined;
     }, {
-        provider?: string | undefined;
-        name?: string | undefined;
-        temperature?: number | undefined;
-        baseUrl?: string | undefined;
-        apiKey?: string | undefined;
-        maxTokens?: number | undefined;
+        defaultProvider?: string | undefined;
+        providers?: {
+            id: string;
+            kind: string;
+            baseUrl: string;
+            apiKey?: string | undefined;
+            defaultModel?: string | undefined;
+            catalogId?: string | undefined;
+            apiKeyRef?: string | undefined;
+        }[] | undefined;
     }>>;
-    providers: z.ZodDefault<z.ZodArray<z.ZodObject<{
-        key: z.ZodString;
-        label: z.ZodOptional<z.ZodString>;
-        kind: z.ZodEnum<["openai", "anthropic", "deepseek", "zai", "xai", "mistral", "groq", "google", "openrouter", "ollama", "custom"]>;
-        baseUrl: z.ZodString;
-        apiKey: z.ZodOptional<z.ZodString>;
-        protocol: z.ZodOptional<z.ZodEnum<["openai-compat", "anthropic-style"]>>;
-        modelsPath: z.ZodOptional<z.ZodString>;
-        /**
-         * DeepSeek V4 thinking-mode default for this provider. "enabled"
-         * matches endpoint default; "disabled" makes V4 calls run in
-         * non-thinking mode (faster, cheaper). Ignored by every provider
-         * other than DeepSeek V4. Per-call overrides still win.
-         */
-        thinking: z.ZodOptional<z.ZodEnum<["enabled", "disabled"]>>;
+    /**
+     * Video generation config (TODO 7.1) — same shape as imageGen, decoupled
+     * from LLM providers. `videoGen.providers[]` each carry an `id` (selected
+     * via GenerateVideo's `provider` arg) + a `kind` picking the adapter. With
+     * no real adapters wired yet, this is config-ready: a future getVideoProvider
+     * case lights it up. Falls back to scanning LLM providers[] when absent.
+     */
+    videoGen: z.ZodOptional<z.ZodObject<{
+        defaultProvider: z.ZodOptional<z.ZodString>;
+        providers: z.ZodDefault<z.ZodArray<z.ZodObject<{
+            id: z.ZodString;
+            kind: z.ZodString;
+            baseUrl: z.ZodString;
+            apiKey: z.ZodOptional<z.ZodString>;
+            defaultModel: z.ZodOptional<z.ZodString>;
+            /** Catalog template this instance was created from (for paramsDoc / displayName回显). */
+            catalogId: z.ZodOptional<z.ZodString>;
+            /** Reuse another instance's key: id of the instance whose apiKey to use (when apiKey is empty). */
+            apiKeyRef: z.ZodOptional<z.ZodString>;
+        }, "strip", z.ZodTypeAny, {
+            id: string;
+            kind: string;
+            baseUrl: string;
+            apiKey?: string | undefined;
+            defaultModel?: string | undefined;
+            catalogId?: string | undefined;
+            apiKeyRef?: string | undefined;
+        }, {
+            id: string;
+            kind: string;
+            baseUrl: string;
+            apiKey?: string | undefined;
+            defaultModel?: string | undefined;
+            catalogId?: string | undefined;
+            apiKeyRef?: string | undefined;
+        }>, "many">>;
     }, "strip", z.ZodTypeAny, {
-        key: string;
-        kind: "anthropic" | "openai" | "deepseek" | "zai" | "xai" | "mistral" | "groq" | "google" | "openrouter" | "ollama" | "custom";
-        baseUrl: string;
-        thinking?: "enabled" | "disabled" | undefined;
-        label?: string | undefined;
-        apiKey?: string | undefined;
-        protocol?: "openai-compat" | "anthropic-style" | undefined;
-        modelsPath?: string | undefined;
-    }, {
-        key: string;
-        kind: "anthropic" | "openai" | "deepseek" | "zai" | "xai" | "mistral" | "groq" | "google" | "openrouter" | "ollama" | "custom";
-        baseUrl: string;
-        thinking?: "enabled" | "disabled" | undefined;
-        label?: string | undefined;
-        apiKey?: string | undefined;
-        protocol?: "openai-compat" | "anthropic-style" | undefined;
-        modelsPath?: string | undefined;
-    }>, "many">>;
-    models: z.ZodDefault<z.ZodArray<z.ZodEffects<z.ZodObject<{
-        key: z.ZodString;
-        label: z.ZodOptional<z.ZodString>;
-        providerKey: z.ZodOptional<z.ZodString>;
-        model: z.ZodString;
-        maxOutputTokens: z.ZodOptional<z.ZodNumber>;
-        maxContextTokens: z.ZodOptional<z.ZodNumber>;
-        /**
-         * Which LLM client to use ("openai" or "anthropic"). New name —
-         * the legacy field is `provider`, which we still accept and
-         * fold into `protocol` below so old configs keep working.
-         * NOT the brand/vendor — that's providerKey above.
-         */
-        protocol: z.ZodOptional<z.ZodString>;
-        provider: z.ZodOptional<z.ZodString>;
-        baseUrl: z.ZodOptional<z.ZodString>;
+        providers: {
+            id: string;
+            kind: string;
+            baseUrl: string;
+            apiKey?: string | undefined;
+            defaultModel?: string | undefined;
+            catalogId?: string | undefined;
+            apiKeyRef?: string | undefined;
+        }[];
+        defaultProvider?: string | undefined;
+    }, {
+        defaultProvider?: string | undefined;
+        providers?: {
+            id: string;
+            kind: string;
+            baseUrl: string;
+            apiKey?: string | undefined;
+            defaultModel?: string | undefined;
+            catalogId?: string | undefined;
+            apiKeyRef?: string | undefined;
+        }[] | undefined;
+    }>>;
+    /**
+     * Credentials — independent key entities (统一模型接入方案 §3.3). A key
+     * lives here, not inlined on a connection, so deleting a connection never
+     * loses a key and many connections share one key by referencing the same
+     * credential id (LiteLLM credential_list model).
+     */
+    credentials: z.ZodDefault<z.ZodArray<z.ZodObject<{
+        /** User-chosen unique credential name. */
+        id: z.ZodString;
+        /** Catalog template this credential is for (a key belongs to one provider). */
+        catalogId: z.ZodString;
         apiKey: z.ZodOptional<z.ZodString>;
-        /**
-         * Per-model thinking override. Wins over the provider-level
-         * setting (settings.providers[].thinking). Use this when
-         * different models under the same provider need different
-         * defaults — e.g. DeepSeek V4 Pro off (faster) but V4 Flash on.
-         */
-        thinking: z.ZodOptional<z.ZodEnum<["enabled", "disabled"]>>;
+        baseUrl: z.ZodOptional<z.ZodString>;
     }, "strip", z.ZodTypeAny, {
-        model: string;
-        key: string;
-        provider?: string | undefined;
-        thinking?: "enabled" | "disabled" | undefined;
-        label?: string | undefined;
+        id: string;
+        catalogId: string;
         baseUrl?: string | undefined;
         apiKey?: string | undefined;
-        protocol?: string | undefined;
-        providerKey?: string | undefined;
-        maxOutputTokens?: number | undefined;
-        maxContextTokens?: number | undefined;
     }, {
-        model: string;
-        key: string;
-        provider?: string | undefined;
-        thinking?: "enabled" | "disabled" | undefined;
-        label?: string | undefined;
+        id: string;
+        catalogId: string;
         baseUrl?: string | undefined;
         apiKey?: string | undefined;
-        protocol?: string | undefined;
-        providerKey?: string | undefined;
-        maxOutputTokens?: number | undefined;
-        maxContextTokens?: number | undefined;
-    }>, {
-        protocol: string | undefined;
-        provider: string | undefined;
+    }>, "many">>;
+    /**
+     * Unified instance layer (统一模型接入方案, see
+     * docs/superpowers/specs/2026-06-15-unified-model-catalog-design.md §3.3).
+     * One store for text/image/video connections, each pointing at a catalog
+     * entry (catalogId), a credential (credentialId), its chosen model, and the
+     * param values the user picked. Replaces the legacy split of
+     * providers[]/models[]/imageGen/videoGen.
+     */
+    modelConnections: z.ZodDefault<z.ZodArray<z.ZodObject<{
+        /** User-chosen unique instance name. */
+        id: z.ZodString;
+        /** Catalog template this instance was created from. */
+        catalogId: z.ZodString;
+        tag: z.ZodEnum<["text", "image", "video", "audio"]>;
+        /** Selected modelId (from the entry's modelPresets). */
+        model: z.ZodString;
+        /** Per-connection baseUrl override (else the credential's / catalog's). */
+        baseUrl: z.ZodOptional<z.ZodString>;
+        /** Which credential supplies this connection's key. */
+        credentialId: z.ZodOptional<z.ZodString>;
+        /** Values the user picked for the model's params, e.g. { reasoning: "high" }. */
+        paramValues: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+    }, "strip", z.ZodTypeAny, {
+        id: string;
         model: string;
-        key: string;
-        thinking?: "enabled" | "disabled" | undefined;
-        label?: string | undefined;
+        catalogId: string;
+        tag: "text" | "image" | "video" | "audio";
         baseUrl?: string | undefined;
-        apiKey?: string | undefined;
-        providerKey?: string | undefined;
-        maxOutputTokens?: number | undefined;
-        maxContextTokens?: number | undefined;
+        credentialId?: string | undefined;
+        paramValues?: Record<string, unknown> | undefined;
     }, {
+        id: string;
         model: string;
-        key: string;
-        provider?: string | undefined;
-        thinking?: "enabled" | "disabled" | undefined;
-        label?: string | undefined;
+        catalogId: string;
+        tag: "text" | "image" | "video" | "audio";
         baseUrl?: string | undefined;
-        apiKey?: string | undefined;
-        protocol?: string | undefined;
-        providerKey?: string | undefined;
-        maxOutputTokens?: number | undefined;
-        maxContextTokens?: number | undefined;
+        credentialId?: string | undefined;
+        paramValues?: Record<string, unknown> | undefined;
     }>, "many">>;
+    /** Default instance id per tag (replaces activeKey / defaultProvider). */
+    defaults: z.ZodDefault<z.ZodObject<{
+        text: z.ZodOptional<z.ZodString>;
+        image: z.ZodOptional<z.ZodString>;
+        video: z.ZodOptional<z.ZodString>;
+        /** Default speech-to-text (voice input) connection. */
+        audio: z.ZodOptional<z.ZodString>;
+        /** Background-task model (replaces auxModelKey). */
+        auxText: z.ZodOptional<z.ZodString>;
+    }, "strip", z.ZodTypeAny, {
+        text?: string | undefined;
+        image?: string | undefined;
+        video?: string | undefined;
+        audio?: string | undefined;
+        auxText?: string | undefined;
+    }, {
+        text?: string | undefined;
+        image?: string | undefined;
+        video?: string | undefined;
+        audio?: string | undefined;
+        auxText?: string | undefined;
+    }>>;
     permissions: z.ZodDefault<z.ZodObject<{
         defaultMode: z.ZodDefault<z.ZodEnum<["default", "acceptEdits", "dontAsk", "bypassPermissions", "auto", "plan"]>>;
         rules: z.ZodDefault<z.ZodArray<z.ZodObject<{
@@ -186,7 +324,7 @@ export declare const SettingsSchema: z.ZodObject<{
             argsPattern?: Record<string, string> | undefined;
         }>, "many">>;
     }, "strip", z.ZodTypeAny, {
-        defaultMode: "default" | "acceptEdits" | "dontAsk" | "bypassPermissions" | "auto" | "plan";
+        defaultMode: "auto" | "default" | "acceptEdits" | "dontAsk" | "bypassPermissions" | "plan";
         rules: {
             tool: string;
             decision: "allow" | "deny" | "ask";
@@ -194,7 +332,7 @@ export declare const SettingsSchema: z.ZodObject<{
             argsPattern?: Record<string, string> | undefined;
         }[];
     }, {
-        defaultMode?: "default" | "acceptEdits" | "dontAsk" | "bypassPermissions" | "auto" | "plan" | undefined;
+        defaultMode?: "auto" | "default" | "acceptEdits" | "dontAsk" | "bypassPermissions" | "plan" | undefined;
         rules?: {
             tool: string;
             decision: "allow" | "deny" | "ask";
@@ -206,14 +344,17 @@ export declare const SettingsSchema: z.ZodObject<{
         maxTokens: z.ZodDefault<z.ZodNumber>;
         compactAtRatio: z.ZodDefault<z.ZodNumber>;
         summarizeAtRatio: z.ZodDefault<z.ZodNumber>;
+        microcompactFloorRatio: z.ZodDefault<z.ZodNumber>;
     }, "strip", z.ZodTypeAny, {
         maxTokens: number;
         compactAtRatio: number;
         summarizeAtRatio: number;
+        microcompactFloorRatio: number;
     }, {
         maxTokens?: number | undefined;
         compactAtRatio?: number | undefined;
         summarizeAtRatio?: number | undefined;
+        microcompactFloorRatio?: number | undefined;
     }>>;
     session: z.ZodDefault<z.ZodObject<{
         storageDir: z.ZodOptional<z.ZodString>;
@@ -225,7 +366,7 @@ export declare const SettingsSchema: z.ZodObject<{
         storageDir?: string | undefined;
         maxHistory?: number | undefined;
     }>>;
-    mcpServers: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodObject<{
+    mcpServers: z.ZodDefault<z.ZodEffects<z.ZodRecord<z.ZodString, z.ZodObject<{
         name: z.ZodString;
         command: z.ZodOptional<z.ZodString>;
         args: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
@@ -233,22 +374,76 @@ export declare const SettingsSchema: z.ZodObject<{
         url: z.ZodOptional<z.ZodString>;
         transport: z.ZodOptional<z.ZodEnum<["stdio", "sse", "streamable-http", "inprocess"]>>;
         headers: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+        envVars: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        bearerTokenEnvVar: z.ZodOptional<z.ZodString>;
+        envHeaders: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+        credentialRef: z.ZodOptional<z.ZodString>;
+        enabled: z.ZodOptional<z.ZodBoolean>;
     }, "strip", z.ZodTypeAny, {
         name: string;
+        enabled?: boolean | undefined;
         url?: string | undefined;
         args?: string[] | undefined;
-        env?: Record<string, string> | undefined;
         command?: string | undefined;
+        env?: Record<string, string> | undefined;
         transport?: "stdio" | "sse" | "streamable-http" | "inprocess" | undefined;
         headers?: Record<string, string> | undefined;
+        envVars?: string[] | undefined;
+        bearerTokenEnvVar?: string | undefined;
+        envHeaders?: Record<string, string> | undefined;
+        credentialRef?: string | undefined;
     }, {
         name: string;
+        enabled?: boolean | undefined;
         url?: string | undefined;
         args?: string[] | undefined;
+        command?: string | undefined;
         env?: Record<string, string> | undefined;
+        transport?: "stdio" | "sse" | "streamable-http" | "inprocess" | undefined;
+        headers?: Record<string, string> | undefined;
+        envVars?: string[] | undefined;
+        bearerTokenEnvVar?: string | undefined;
+        envHeaders?: Record<string, string> | undefined;
+        credentialRef?: string | undefined;
+    }>>, Record<string, {
+        name: string;
+        enabled?: boolean | undefined;
+        url?: string | undefined;
+        args?: string[] | undefined;
         command?: string | undefined;
+        env?: Record<string, string> | undefined;
         transport?: "stdio" | "sse" | "streamable-http" | "inprocess" | undefined;
         headers?: Record<string, string> | undefined;
+        envVars?: string[] | undefined;
+        bearerTokenEnvVar?: string | undefined;
+        envHeaders?: Record<string, string> | undefined;
+        credentialRef?: string | undefined;
+    }>, unknown>>;
+    /**
+     * User supplements for PLUGIN-provided MCP servers, keyed by the server's
+     * `<plugin>:<server>` name. Layered onto the plugin config at merge time
+     * (mergePluginMcpServers). Only env/credential fields are accepted —
+     * command/args/url/transport are intentionally absent and `.strict()`
+     * rejects them, so a plugin update is never shadowed by a stale copy.
+     */
+    mcpServerOverrides: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodObject<{
+        env: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+        envVars: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        credentialRef: z.ZodOptional<z.ZodString>;
+        bearerTokenEnvVar: z.ZodOptional<z.ZodString>;
+        envHeaders: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+    }, "strict", z.ZodTypeAny, {
+        env?: Record<string, string> | undefined;
+        envVars?: string[] | undefined;
+        bearerTokenEnvVar?: string | undefined;
+        envHeaders?: Record<string, string> | undefined;
+        credentialRef?: string | undefined;
+    }, {
+        env?: Record<string, string> | undefined;
+        envVars?: string[] | undefined;
+        bearerTokenEnvVar?: string | undefined;
+        envHeaders?: Record<string, string> | undefined;
+        credentialRef?: string | undefined;
     }>>>;
     /**
      * Skill names hidden from the LLM. Names include the full
@@ -264,6 +459,82 @@ export declare const SettingsSchema: z.ZodObject<{
      * names (no colon suffix). See scanSkills(opts.disabledPlugins).
      */
     disabledPlugins: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+    /**
+     * Sub-agent role names (the `name` in .code-shell/agents/*.md) to
+     * hide from the registry. A disabled role is filtered out at load
+     * so it never appears in registry.list()/get() — the Agent tool's
+     * agent_type list won't show it and the LLM can't pick it. Mirrors
+     * disabledSkills / disabledPlugins.
+     */
+    disabledAgents: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+    /**
+     * Project-scoped tri-state capability overlay. Only meaningful in
+     * ${cwd}/.code-shell/settings.json; layered over the global baseline at
+     * capability-assembly time. Optional — absence === everything inherits.
+     */
+    capabilityOverrides: z.ZodOptional<z.ZodObject<{
+        skills: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodEnum<["inherit", "on", "off"]>>>;
+        plugins: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodEnum<["inherit", "on", "off"]>>>;
+        agents: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodEnum<["inherit", "on", "off"]>>>;
+        mcp: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodEnum<["inherit", "on", "off"]>>>;
+        builtin: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodEnum<["inherit", "on", "off"]>>>;
+        /**
+         * Per-hook overlay for PLUGIN-provided hooks, keyed by
+         * `pluginHookKey()` (`<plugin>:<RawEvent>:<command>`). Finer-grained
+         * than `plugins` (which kills a whole plugin): "off" suppresses one
+         * hook for this project only. Only "off" is meaningful today — plugin
+         * hooks have no global disable list to force back "on" from.
+         */
+        pluginHooks: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodEnum<["inherit", "on", "off"]>>>;
+    }, "strip", z.ZodTypeAny, {
+        builtin?: Record<string, "off" | "on" | "inherit"> | undefined;
+        mcp?: Record<string, "off" | "on" | "inherit"> | undefined;
+        skills?: Record<string, "off" | "on" | "inherit"> | undefined;
+        plugins?: Record<string, "off" | "on" | "inherit"> | undefined;
+        agents?: Record<string, "off" | "on" | "inherit"> | undefined;
+        pluginHooks?: Record<string, "off" | "on" | "inherit"> | undefined;
+    }, {
+        builtin?: Record<string, "off" | "on" | "inherit"> | undefined;
+        mcp?: Record<string, "off" | "on" | "inherit"> | undefined;
+        skills?: Record<string, "off" | "on" | "inherit"> | undefined;
+        plugins?: Record<string, "off" | "on" | "inherit"> | undefined;
+        agents?: Record<string, "off" | "on" | "inherit"> | undefined;
+        pluginHooks?: Record<string, "off" | "on" | "inherit"> | undefined;
+    }>>;
+    /**
+     * Feature flags overlay: a map of flag name → boolean that overrides the
+     * compiled-in defaults (see settings/feature-flags.ts FEATURE_FLAGS).
+     * Project settings override user settings via the normal merge, so a flag
+     * can be flipped per-workspace. Unknown flag names are tolerated (kept as
+     * data) for forward-compat; consumers only read known flags via
+     * isFeatureEnabled(). Passthrough record — values coerced to boolean.
+     */
+    featureFlags: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodBoolean>>;
+    /**
+     * Cross-session memory knobs. Optional — absence keeps the built-in
+     * defaults (see services/extract-memories.ts). `maxCount` caps memories
+     * accepted per extraction pass; `maxAge`/`extractionModel` are reserved
+     * for the consolidation/extraction pipeline.
+     */
+    memories: z.ZodOptional<z.ZodObject<{
+        maxCount: z.ZodOptional<z.ZodNumber>;
+        maxAge: z.ZodOptional<z.ZodNumber>;
+        extractionModel: z.ZodOptional<z.ZodString>;
+        /** Master switch for end-of-session automatic memory extraction.
+         *  Absent/true = extract (current behavior); false = skip extraction
+         *  while keeping session summaries and Dream untouched. */
+        autoExtract: z.ZodOptional<z.ZodBoolean>;
+    }, "strip", z.ZodTypeAny, {
+        maxCount?: number | undefined;
+        maxAge?: number | undefined;
+        extractionModel?: string | undefined;
+        autoExtract?: boolean | undefined;
+    }, {
+        maxCount?: number | undefined;
+        maxAge?: number | undefined;
+        extractionModel?: string | undefined;
+        autoExtract?: boolean | undefined;
+    }>>;
     instructions: z.ZodDefault<z.ZodObject<{
         fileName: z.ZodDefault<z.ZodString>;
         scanDirs: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
@@ -288,30 +559,30 @@ export declare const SettingsSchema: z.ZodObject<{
             apiKey: z.ZodOptional<z.ZodString>;
             baseUrl: z.ZodOptional<z.ZodString>;
         }, "strip", z.ZodTypeAny, {
-            model: string;
             name: string;
+            model: string;
             provider?: string | undefined;
             baseUrl?: string | undefined;
             apiKey?: string | undefined;
         }, {
-            model: string;
             name: string;
+            model: string;
             provider?: string | undefined;
             baseUrl?: string | undefined;
             apiKey?: string | undefined;
         }>]>, "many">>;
     }, "strip", z.ZodTypeAny, {
         participants: (string | {
-            model: string;
             name: string;
+            model: string;
             provider?: string | undefined;
             baseUrl?: string | undefined;
             apiKey?: string | undefined;
         })[];
     }, {
         participants?: (string | {
-            model: string;
             name: string;
+            model: string;
             provider?: string | undefined;
             baseUrl?: string | undefined;
             apiKey?: string | undefined;
@@ -331,12 +602,45 @@ export declare const SettingsSchema: z.ZodObject<{
         providers: z.ZodOptional<z.ZodRecord<z.ZodEnum<["serper", "tavily", "searxng"]>, z.ZodObject<{
             apiKey: z.ZodOptional<z.ZodString>;
             baseUrl: z.ZodOptional<z.ZodString>;
+            lastProbe: z.ZodOptional<z.ZodObject<{
+                status: z.ZodEnum<["ok", "error", "unconfigured"]>;
+                sampleTitles: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+                errorMessage: z.ZodOptional<z.ZodString>;
+                errorDetail: z.ZodOptional<z.ZodString>;
+                lastProbedAt: z.ZodString;
+            }, "strip", z.ZodTypeAny, {
+                status: "error" | "ok" | "unconfigured";
+                lastProbedAt: string;
+                sampleTitles?: string[] | undefined;
+                errorMessage?: string | undefined;
+                errorDetail?: string | undefined;
+            }, {
+                status: "error" | "ok" | "unconfigured";
+                lastProbedAt: string;
+                sampleTitles?: string[] | undefined;
+                errorMessage?: string | undefined;
+                errorDetail?: string | undefined;
+            }>>;
         }, "strip", z.ZodTypeAny, {
             baseUrl?: string | undefined;
             apiKey?: string | undefined;
+            lastProbe?: {
+                status: "error" | "ok" | "unconfigured";
+                lastProbedAt: string;
+                sampleTitles?: string[] | undefined;
+                errorMessage?: string | undefined;
+                errorDetail?: string | undefined;
+            } | undefined;
         }, {
             baseUrl?: string | undefined;
             apiKey?: string | undefined;
+            lastProbe?: {
+                status: "error" | "ok" | "unconfigured";
+                lastProbedAt: string;
+                sampleTitles?: string[] | undefined;
+                errorMessage?: string | undefined;
+                errorDetail?: string | undefined;
+            } | undefined;
         }>>>;
     }, "strip", z.ZodTypeAny, {
         provider: "serper" | "tavily" | "searxng";
@@ -345,6 +649,13 @@ export declare const SettingsSchema: z.ZodObject<{
         providers?: Partial<Record<"serper" | "tavily" | "searxng", {
             baseUrl?: string | undefined;
             apiKey?: string | undefined;
+            lastProbe?: {
+                status: "error" | "ok" | "unconfigured";
+                lastProbedAt: string;
+                sampleTitles?: string[] | undefined;
+                errorMessage?: string | undefined;
+                errorDetail?: string | undefined;
+            } | undefined;
         }>> | undefined;
     }, {
         provider?: "serper" | "tavily" | "searxng" | undefined;
@@ -353,6 +664,13 @@ export declare const SettingsSchema: z.ZodObject<{
         providers?: Partial<Record<"serper" | "tavily" | "searxng", {
             baseUrl?: string | undefined;
             apiKey?: string | undefined;
+            lastProbe?: {
+                status: "error" | "ok" | "unconfigured";
+                lastProbedAt: string;
+                sampleTitles?: string[] | undefined;
+                errorMessage?: string | undefined;
+                errorDetail?: string | undefined;
+            } | undefined;
         }>> | undefined;
     }>>;
     output: z.ZodDefault<z.ZodObject<{
@@ -362,6 +680,26 @@ export declare const SettingsSchema: z.ZodObject<{
     }, {
         format?: "text" | "json" | "jsonl" | "stream-json" | undefined;
     }>>;
+    /**
+     * Image attachment handling. Sub-fields:
+     *   - detail: provider-agnostic image clarity. Drives the
+     *     renderer-side downscale (low→~1024 / standard→~1568 /
+     *     high→~2576 px long edge) so BOTH providers save tokens
+     *     before send. Legacy "original" is migrated to "high".
+     *   - mcpImageTokenBudget: per-turn cap on token cost of images
+     *     returned by MCP tools. Codex doesn't enforce this; CC uses
+     *     25 000. Set to 0 to disable.
+     */
+    images: z.ZodOptional<z.ZodObject<{
+        detail: z.ZodOptional<z.ZodEffects<z.ZodEnum<["low", "standard", "high"]>, "low" | "high" | "standard", unknown>>;
+        mcpImageTokenBudget: z.ZodOptional<z.ZodNumber>;
+    }, "strip", z.ZodTypeAny, {
+        detail?: "low" | "high" | "standard" | undefined;
+        mcpImageTokenBudget?: number | undefined;
+    }, {
+        detail?: unknown;
+        mcpImageTokenBudget?: number | undefined;
+    }>>;
     /**
      * OS-level sandbox for shell-tool execution. "auto" picks per platform:
      * Seatbelt on macOS, bubblewrap on Linux when installed, otherwise off.
@@ -374,16 +712,103 @@ export declare const SettingsSchema: z.ZodObject<{
         deniedReads: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
         network: z.ZodOptional<z.ZodEnum<["allow", "deny"]>>;
     }, "strip", z.ZodTypeAny, {
-        mode?: "auto" | "seatbelt" | "bwrap" | "off" | undefined;
+        mode?: "auto" | "off" | "seatbelt" | "bwrap" | undefined;
         writableRoots?: string[] | undefined;
         deniedReads?: string[] | undefined;
         network?: "allow" | "deny" | undefined;
     }, {
-        mode?: "auto" | "seatbelt" | "bwrap" | "off" | undefined;
+        mode?: "auto" | "off" | "seatbelt" | "bwrap" | undefined;
         writableRoots?: string[] | undefined;
         deniedReads?: string[] | undefined;
         network?: "allow" | "deny" | undefined;
     }>>;
+    /**
+     * Top-level environment variables injected into tool subprocesses (the
+     * Bash tool, background shells). Mirrors Claude Code's `env` field: a
+     * KEY=VALUE map that can be set globally (~/.code-shell/settings.json) and
+     * overridden per-project (.code-shell/settings.json). The canonical home
+     * for API keys (e.g. OPENAI_API_KEY) that a skill's script reads — configure
+     * once globally and every project's skills can use it.
+     *
+     * Precedence when merged into the spawn env (lowest → highest):
+     *   project localEnvironment.env  →  global env  →  project env
+     * None of these is filtered through the deny regex (see mergeShellEnv):
+     * they are values the user typed deliberately, a different trust class from
+     * the host process.env passthrough the deny machinery guards against.
+     */
+    env: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+    /**
+     * Project-local environment profile. Mirrors Codex's local-environment
+     * shape at the settings layer: setup/cleanup scripts can be customized per
+     * platform, and env values are stored as KEY=VALUE pairs. Runtime wiring is
+     * intentionally separate from the MCP server env model above.
+     */
+    localEnvironment: z.ZodOptional<z.ZodObject<{
+        name: z.ZodOptional<z.ZodString>;
+        setupScripts: z.ZodOptional<z.ZodObject<{
+            default: z.ZodOptional<z.ZodString>;
+            macos: z.ZodOptional<z.ZodString>;
+            linux: z.ZodOptional<z.ZodString>;
+            windows: z.ZodOptional<z.ZodString>;
+        }, "strip", z.ZodTypeAny, {
+            default?: string | undefined;
+            linux?: string | undefined;
+            macos?: string | undefined;
+            windows?: string | undefined;
+        }, {
+            default?: string | undefined;
+            linux?: string | undefined;
+            macos?: string | undefined;
+            windows?: string | undefined;
+        }>>;
+        cleanupScripts: z.ZodOptional<z.ZodObject<{
+            default: z.ZodOptional<z.ZodString>;
+            macos: z.ZodOptional<z.ZodString>;
+            linux: z.ZodOptional<z.ZodString>;
+            windows: z.ZodOptional<z.ZodString>;
+        }, "strip", z.ZodTypeAny, {
+            default?: string | undefined;
+            linux?: string | undefined;
+            macos?: string | undefined;
+            windows?: string | undefined;
+        }, {
+            default?: string | undefined;
+            linux?: string | undefined;
+            macos?: string | undefined;
+            windows?: string | undefined;
+        }>>;
+        env: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+    }, "strip", z.ZodTypeAny, {
+        name?: string | undefined;
+        env?: Record<string, string> | undefined;
+        setupScripts?: {
+            default?: string | undefined;
+            linux?: string | undefined;
+            macos?: string | undefined;
+            windows?: string | undefined;
+        } | undefined;
+        cleanupScripts?: {
+            default?: string | undefined;
+            linux?: string | undefined;
+            macos?: string | undefined;
+            windows?: string | undefined;
+        } | undefined;
+    }, {
+        name?: string | undefined;
+        env?: Record<string, string> | undefined;
+        setupScripts?: {
+            default?: string | undefined;
+            linux?: string | undefined;
+            macos?: string | undefined;
+            windows?: string | undefined;
+        } | undefined;
+        cleanupScripts?: {
+            default?: string | undefined;
+            linux?: string | undefined;
+            macos?: string | undefined;
+            windows?: string | undefined;
+        } | undefined;
+    }>>;
     /**
      * Shell-hook configuration. Each entry binds a HookEventName to a
      * shell command; the command receives ctx JSON on stdin and returns
@@ -400,19 +825,99 @@ export declare const SettingsSchema: z.ZodObject<{
         matcher: z.ZodOptional<z.ZodString>;
         timeout_ms: z.ZodOptional<z.ZodNumber>;
         cwd: z.ZodOptional<z.ZodString>;
+        /** Soft off-switch: the entry stays in the file (and the UI) but
+         *  registerSettingsHooks skips it. Absent = enabled. */
+        disabled: z.ZodOptional<z.ZodBoolean>;
     }, "strip", z.ZodTypeAny, {
         command: string;
         event: string;
-        cwd?: string | undefined;
+        disabled?: boolean | undefined;
         matcher?: string | undefined;
         timeout_ms?: number | undefined;
+        cwd?: string | undefined;
     }, {
         command: string;
         event: string;
-        cwd?: string | undefined;
+        disabled?: boolean | undefined;
         matcher?: string | undefined;
         timeout_ms?: number | undefined;
+        cwd?: string | undefined;
     }>, "many">>;
+    /**
+     * External coding-agent orchestration (Claude Code / Codex CLI).
+     * Used by the Mobile Web Remote to launch managed jobs. dangerousArgs
+     * is config-provided (not hardcoded) so it tracks CLI flag changes;
+     * project-default dangerous mode only applies inside trustedWorkspaces.
+     */
+    externalAgents: z.ZodOptional<z.ZodObject<{
+        claudeCode: z.ZodOptional<z.ZodObject<{
+            command: z.ZodOptional<z.ZodString>;
+            defaultMode: z.ZodOptional<z.ZodEnum<["safe", "dangerous"]>>;
+            dangerousArgs: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+            trustedWorkspaces: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+            autoStartInTrustedWorkspaces: z.ZodOptional<z.ZodBoolean>;
+        }, "strip", z.ZodTypeAny, {
+            defaultMode?: "safe" | "dangerous" | undefined;
+            command?: string | undefined;
+            dangerousArgs?: string[] | undefined;
+            trustedWorkspaces?: string[] | undefined;
+            autoStartInTrustedWorkspaces?: boolean | undefined;
+        }, {
+            defaultMode?: "safe" | "dangerous" | undefined;
+            command?: string | undefined;
+            dangerousArgs?: string[] | undefined;
+            trustedWorkspaces?: string[] | undefined;
+            autoStartInTrustedWorkspaces?: boolean | undefined;
+        }>>;
+        codex: z.ZodOptional<z.ZodObject<{
+            command: z.ZodOptional<z.ZodString>;
+            args: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        }, "strip", z.ZodTypeAny, {
+            args?: string[] | undefined;
+            command?: string | undefined;
+        }, {
+            args?: string[] | undefined;
+            command?: string | undefined;
+        }>>;
+    }, "strip", z.ZodTypeAny, {
+        claudeCode?: {
+            defaultMode?: "safe" | "dangerous" | undefined;
+            command?: string | undefined;
+            dangerousArgs?: string[] | undefined;
+            trustedWorkspaces?: string[] | undefined;
+            autoStartInTrustedWorkspaces?: boolean | undefined;
+        } | undefined;
+        codex?: {
+            args?: string[] | undefined;
+            command?: string | undefined;
+        } | undefined;
+    }, {
+        claudeCode?: {
+            defaultMode?: "safe" | "dangerous" | undefined;
+            command?: string | undefined;
+            dangerousArgs?: string[] | undefined;
+            trustedWorkspaces?: string[] | undefined;
+            autoStartInTrustedWorkspaces?: boolean | undefined;
+        } | undefined;
+        codex?: {
+            args?: string[] | undefined;
+            command?: string | undefined;
+        } | undefined;
+    }>>;
+    /**
+     * Credential-use gate (凭证模块第二期). Controls whether the AI's
+     * `UseCredential` tool prompts before handing a stored credential to a
+     * command. `autoApprove: true` skips the prompt entirely (默认关 — every
+     * use asks, or is remembered for the session). See
+     * docs/superpowers/specs/2026-06-16-credential-use-gate-design.md §5.
+     */
+    credentialUse: z.ZodOptional<z.ZodObject<{
+        autoApprove: z.ZodOptional<z.ZodBoolean>;
+    }, "strip", z.ZodTypeAny, {
+        autoApprove?: boolean | undefined;
+    }, {
+        autoApprove?: boolean | undefined;
+    }>>;
 }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
     agent: z.ZodDefault<z.ZodObject<{
         preset: z.ZodDefault<z.ZodString>;
@@ -420,27 +925,43 @@ export declare const SettingsSchema: z.ZodObject<{
         disabledBuiltinTools: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
         customSystemPrompt: z.ZodOptional<z.ZodString>;
         appendSystemPrompt: z.ZodOptional<z.ZodString>;
+        responseLanguage: z.ZodOptional<z.ZodString>;
+        userProfile: z.ZodOptional<z.ZodString>;
+        instructions: z.ZodOptional<z.ZodObject<{
+            compatClaude: z.ZodDefault<z.ZodBoolean>;
+            compatCodex: z.ZodDefault<z.ZodBoolean>;
+        }, "strip", z.ZodTypeAny, {
+            compatClaude: boolean;
+            compatCodex: boolean;
+        }, {
+            compatClaude?: boolean | undefined;
+            compatCodex?: boolean | undefined;
+        }>>;
     }, "strip", z.ZodTypeAny, {
         preset: string;
         enabledBuiltinTools: string[];
         disabledBuiltinTools: string[];
         customSystemPrompt?: string | undefined;
         appendSystemPrompt?: string | undefined;
+        responseLanguage?: string | undefined;
+        userProfile?: string | undefined;
+        instructions?: {
+            compatClaude: boolean;
+            compatCodex: boolean;
+        } | undefined;
     }, {
         preset?: string | undefined;
         enabledBuiltinTools?: string[] | undefined;
         disabledBuiltinTools?: string[] | undefined;
         customSystemPrompt?: string | undefined;
         appendSystemPrompt?: string | undefined;
+        responseLanguage?: string | undefined;
+        userProfile?: string | undefined;
+        instructions?: {
+            compatClaude?: boolean | undefined;
+            compatCodex?: boolean | undefined;
+        } | undefined;
     }>>;
-    /**
-     * Primary source of truth for the active model is settings.activeKey
-     * (points at models[].key). settings.model is a derived mirror of that
-     * entry kept in sync for legacy boot paths (cli/main.ts, repl.ts, etc.)
-     * which read provider/name/apiKey/baseUrl directly. Writers must update
-     * both — appendOnboardingResult does this in one shot.
-     */
-    activeKey: z.ZodOptional<z.ZodString>;
     /**
      * Toggle background auto-update. When true (default), code-shell checks
      * npm for newer versions and — if the npm global prefix is writable —
@@ -449,135 +970,215 @@ export declare const SettingsSchema: z.ZodObject<{
      * Can also be disabled via env var `DISABLE_AUTOUPDATER=1`.
      */
     autoUpdates: z.ZodDefault<z.ZodBoolean>;
-    model: z.ZodDefault<z.ZodObject<{
-        provider: z.ZodDefault<z.ZodString>;
-        name: z.ZodDefault<z.ZodString>;
-        apiKey: z.ZodOptional<z.ZodString>;
-        baseUrl: z.ZodDefault<z.ZodString>;
-        temperature: z.ZodDefault<z.ZodNumber>;
-        maxTokens: z.ZodDefault<z.ZodNumber>;
+    /**
+     * Image generation is a general capability, decoupled from LLM providers
+     * (TODO 7.1): a vendor may use different keys/endpoints/models for chat vs
+     * image, and image vendors (Gemini, and later 国内 模型) don't fit the LLM
+     * `providers[].kind` enum. `imageGen.providers[]` is the canonical config;
+     * each entry has a user-chosen `id` (selected via GenerateImage's
+     * `provider` arg) and a `kind` that picks the adapter. When `imageGen` is
+     * absent, resolution falls back to scanning LLM `providers[]` for an
+     * image-capable kind — so existing configs keep working with no migration.
+     */
+    imageGen: z.ZodOptional<z.ZodObject<{
+        defaultProvider: z.ZodOptional<z.ZodString>;
+        providers: z.ZodDefault<z.ZodArray<z.ZodObject<{
+            /** User-chosen instance name; GenerateImage(provider) selects by this. */
+            id: z.ZodString;
+            /** Adapter selector — e.g. "openai", "google". */
+            kind: z.ZodString;
+            baseUrl: z.ZodString;
+            apiKey: z.ZodOptional<z.ZodString>;
+            /** Default model for this instance when the call omits `model`. */
+            defaultModel: z.ZodOptional<z.ZodString>;
+            /** Catalog template this instance was created from (for paramsDoc / displayName回显). */
+            catalogId: z.ZodOptional<z.ZodString>;
+            /** Reuse another instance's key: id of the instance whose apiKey to use (when apiKey is empty). */
+            apiKeyRef: z.ZodOptional<z.ZodString>;
+        }, "strip", z.ZodTypeAny, {
+            id: string;
+            kind: string;
+            baseUrl: string;
+            apiKey?: string | undefined;
+            defaultModel?: string | undefined;
+            catalogId?: string | undefined;
+            apiKeyRef?: string | undefined;
+        }, {
+            id: string;
+            kind: string;
+            baseUrl: string;
+            apiKey?: string | undefined;
+            defaultModel?: string | undefined;
+            catalogId?: string | undefined;
+            apiKeyRef?: string | undefined;
+        }>, "many">>;
     }, "strip", z.ZodTypeAny, {
-        provider: string;
-        name: string;
-        temperature: number;
-        baseUrl: string;
-        maxTokens: number;
-        apiKey?: string | undefined;
+        providers: {
+            id: string;
+            kind: string;
+            baseUrl: string;
+            apiKey?: string | undefined;
+            defaultModel?: string | undefined;
+            catalogId?: string | undefined;
+            apiKeyRef?: string | undefined;
+        }[];
+        defaultProvider?: string | undefined;
     }, {
-        provider?: string | undefined;
-        name?: string | undefined;
-        temperature?: number | undefined;
-        baseUrl?: string | undefined;
-        apiKey?: string | undefined;
-        maxTokens?: number | undefined;
+        defaultProvider?: string | undefined;
+        providers?: {
+            id: string;
+            kind: string;
+            baseUrl: string;
+            apiKey?: string | undefined;
+            defaultModel?: string | undefined;
+            catalogId?: string | undefined;
+            apiKeyRef?: string | undefined;
+        }[] | undefined;
     }>>;
-    providers: z.ZodDefault<z.ZodArray<z.ZodObject<{
-        key: z.ZodString;
-        label: z.ZodOptional<z.ZodString>;
-        kind: z.ZodEnum<["openai", "anthropic", "deepseek", "zai", "xai", "mistral", "groq", "google", "openrouter", "ollama", "custom"]>;
-        baseUrl: z.ZodString;
-        apiKey: z.ZodOptional<z.ZodString>;
-        protocol: z.ZodOptional<z.ZodEnum<["openai-compat", "anthropic-style"]>>;
-        modelsPath: z.ZodOptional<z.ZodString>;
-        /**
-         * DeepSeek V4 thinking-mode default for this provider. "enabled"
-         * matches endpoint default; "disabled" makes V4 calls run in
-         * non-thinking mode (faster, cheaper). Ignored by every provider
-         * other than DeepSeek V4. Per-call overrides still win.
-         */
-        thinking: z.ZodOptional<z.ZodEnum<["enabled", "disabled"]>>;
+    /**
+     * Video generation config (TODO 7.1) — same shape as imageGen, decoupled
+     * from LLM providers. `videoGen.providers[]` each carry an `id` (selected
+     * via GenerateVideo's `provider` arg) + a `kind` picking the adapter. With
+     * no real adapters wired yet, this is config-ready: a future getVideoProvider
+     * case lights it up. Falls back to scanning LLM providers[] when absent.
+     */
+    videoGen: z.ZodOptional<z.ZodObject<{
+        defaultProvider: z.ZodOptional<z.ZodString>;
+        providers: z.ZodDefault<z.ZodArray<z.ZodObject<{
+            id: z.ZodString;
+            kind: z.ZodString;
+            baseUrl: z.ZodString;
+            apiKey: z.ZodOptional<z.ZodString>;
+            defaultModel: z.ZodOptional<z.ZodString>;
+            /** Catalog template this instance was created from (for paramsDoc / displayName回显). */
+            catalogId: z.ZodOptional<z.ZodString>;
+            /** Reuse another instance's key: id of the instance whose apiKey to use (when apiKey is empty). */
+            apiKeyRef: z.ZodOptional<z.ZodString>;
+        }, "strip", z.ZodTypeAny, {
+            id: string;
+            kind: string;
+            baseUrl: string;
+            apiKey?: string | undefined;
+            defaultModel?: string | undefined;
+            catalogId?: string | undefined;
+            apiKeyRef?: string | undefined;
+        }, {
+            id: string;
+            kind: string;
+            baseUrl: string;
+            apiKey?: string | undefined;
+            defaultModel?: string | undefined;
+            catalogId?: string | undefined;
+            apiKeyRef?: string | undefined;
+        }>, "many">>;
     }, "strip", z.ZodTypeAny, {
-        key: string;
-        kind: "anthropic" | "openai" | "deepseek" | "zai" | "xai" | "mistral" | "groq" | "google" | "openrouter" | "ollama" | "custom";
-        baseUrl: string;
-        thinking?: "enabled" | "disabled" | undefined;
-        label?: string | undefined;
-        apiKey?: string | undefined;
-        protocol?: "openai-compat" | "anthropic-style" | undefined;
-        modelsPath?: string | undefined;
-    }, {
-        key: string;
-        kind: "anthropic" | "openai" | "deepseek" | "zai" | "xai" | "mistral" | "groq" | "google" | "openrouter" | "ollama" | "custom";
-        baseUrl: string;
-        thinking?: "enabled" | "disabled" | undefined;
-        label?: string | undefined;
-        apiKey?: string | undefined;
-        protocol?: "openai-compat" | "anthropic-style" | undefined;
-        modelsPath?: string | undefined;
-    }>, "many">>;
-    models: z.ZodDefault<z.ZodArray<z.ZodEffects<z.ZodObject<{
-        key: z.ZodString;
-        label: z.ZodOptional<z.ZodString>;
-        providerKey: z.ZodOptional<z.ZodString>;
-        model: z.ZodString;
-        maxOutputTokens: z.ZodOptional<z.ZodNumber>;
-        maxContextTokens: z.ZodOptional<z.ZodNumber>;
-        /**
-         * Which LLM client to use ("openai" or "anthropic"). New name —
-         * the legacy field is `provider`, which we still accept and
-         * fold into `protocol` below so old configs keep working.
-         * NOT the brand/vendor — that's providerKey above.
-         */
-        protocol: z.ZodOptional<z.ZodString>;
-        provider: z.ZodOptional<z.ZodString>;
-        baseUrl: z.ZodOptional<z.ZodString>;
+        providers: {
+            id: string;
+            kind: string;
+            baseUrl: string;
+            apiKey?: string | undefined;
+            defaultModel?: string | undefined;
+            catalogId?: string | undefined;
+            apiKeyRef?: string | undefined;
+        }[];
+        defaultProvider?: string | undefined;
+    }, {
+        defaultProvider?: string | undefined;
+        providers?: {
+            id: string;
+            kind: string;
+            baseUrl: string;
+            apiKey?: string | undefined;
+            defaultModel?: string | undefined;
+            catalogId?: string | undefined;
+            apiKeyRef?: string | undefined;
+        }[] | undefined;
+    }>>;
+    /**
+     * Credentials — independent key entities (统一模型接入方案 §3.3). A key
+     * lives here, not inlined on a connection, so deleting a connection never
+     * loses a key and many connections share one key by referencing the same
+     * credential id (LiteLLM credential_list model).
+     */
+    credentials: z.ZodDefault<z.ZodArray<z.ZodObject<{
+        /** User-chosen unique credential name. */
+        id: z.ZodString;
+        /** Catalog template this credential is for (a key belongs to one provider). */
+        catalogId: z.ZodString;
         apiKey: z.ZodOptional<z.ZodString>;
-        /**
-         * Per-model thinking override. Wins over the provider-level
-         * setting (settings.providers[].thinking). Use this when
-         * different models under the same provider need different
-         * defaults — e.g. DeepSeek V4 Pro off (faster) but V4 Flash on.
-         */
-        thinking: z.ZodOptional<z.ZodEnum<["enabled", "disabled"]>>;
+        baseUrl: z.ZodOptional<z.ZodString>;
     }, "strip", z.ZodTypeAny, {
-        model: string;
-        key: string;
-        provider?: string | undefined;
-        thinking?: "enabled" | "disabled" | undefined;
-        label?: string | undefined;
+        id: string;
+        catalogId: string;
         baseUrl?: string | undefined;
         apiKey?: string | undefined;
-        protocol?: string | undefined;
-        providerKey?: string | undefined;
-        maxOutputTokens?: number | undefined;
-        maxContextTokens?: number | undefined;
     }, {
-        model: string;
-        key: string;
-        provider?: string | undefined;
-        thinking?: "enabled" | "disabled" | undefined;
-        label?: string | undefined;
+        id: string;
+        catalogId: string;
         baseUrl?: string | undefined;
         apiKey?: string | undefined;
-        protocol?: string | undefined;
-        providerKey?: string | undefined;
-        maxOutputTokens?: number | undefined;
-        maxContextTokens?: number | undefined;
-    }>, {
-        protocol: string | undefined;
-        provider: string | undefined;
+    }>, "many">>;
+    /**
+     * Unified instance layer (统一模型接入方案, see
+     * docs/superpowers/specs/2026-06-15-unified-model-catalog-design.md §3.3).
+     * One store for text/image/video connections, each pointing at a catalog
+     * entry (catalogId), a credential (credentialId), its chosen model, and the
+     * param values the user picked. Replaces the legacy split of
+     * providers[]/models[]/imageGen/videoGen.
+     */
+    modelConnections: z.ZodDefault<z.ZodArray<z.ZodObject<{
+        /** User-chosen unique instance name. */
+        id: z.ZodString;
+        /** Catalog template this instance was created from. */
+        catalogId: z.ZodString;
+        tag: z.ZodEnum<["text", "image", "video", "audio"]>;
+        /** Selected modelId (from the entry's modelPresets). */
+        model: z.ZodString;
+        /** Per-connection baseUrl override (else the credential's / catalog's). */
+        baseUrl: z.ZodOptional<z.ZodString>;
+        /** Which credential supplies this connection's key. */
+        credentialId: z.ZodOptional<z.ZodString>;
+        /** Values the user picked for the model's params, e.g. { reasoning: "high" }. */
+        paramValues: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+    }, "strip", z.ZodTypeAny, {
+        id: string;
         model: string;
-        key: string;
-        thinking?: "enabled" | "disabled" | undefined;
-        label?: string | undefined;
+        catalogId: string;
+        tag: "text" | "image" | "video" | "audio";
         baseUrl?: string | undefined;
-        apiKey?: string | undefined;
-        providerKey?: string | undefined;
-        maxOutputTokens?: number | undefined;
-        maxContextTokens?: number | undefined;
+        credentialId?: string | undefined;
+        paramValues?: Record<string, unknown> | undefined;
     }, {
+        id: string;
         model: string;
-        key: string;
-        provider?: string | undefined;
-        thinking?: "enabled" | "disabled" | undefined;
-        label?: string | undefined;
+        catalogId: string;
+        tag: "text" | "image" | "video" | "audio";
         baseUrl?: string | undefined;
-        apiKey?: string | undefined;
-        protocol?: string | undefined;
-        providerKey?: string | undefined;
-        maxOutputTokens?: number | undefined;
-        maxContextTokens?: number | undefined;
+        credentialId?: string | undefined;
+        paramValues?: Record<string, unknown> | undefined;
     }>, "many">>;
+    /** Default instance id per tag (replaces activeKey / defaultProvider). */
+    defaults: z.ZodDefault<z.ZodObject<{
+        text: z.ZodOptional<z.ZodString>;
+        image: z.ZodOptional<z.ZodString>;
+        video: z.ZodOptional<z.ZodString>;
+        /** Default speech-to-text (voice input) connection. */
+        audio: z.ZodOptional<z.ZodString>;
+        /** Background-task model (replaces auxModelKey). */
+        auxText: z.ZodOptional<z.ZodString>;
+    }, "strip", z.ZodTypeAny, {
+        text?: string | undefined;
+        image?: string | undefined;
+        video?: string | undefined;
+        audio?: string | undefined;
+        auxText?: string | undefined;
+    }, {
+        text?: string | undefined;
+        image?: string | undefined;
+        video?: string | undefined;
+        audio?: string | undefined;
+        auxText?: string | undefined;
+    }>>;
     permissions: z.ZodDefault<z.ZodObject<{
         defaultMode: z.ZodDefault<z.ZodEnum<["default", "acceptEdits", "dontAsk", "bypassPermissions", "auto", "plan"]>>;
         rules: z.ZodDefault<z.ZodArray<z.ZodObject<{
@@ -597,7 +1198,7 @@ export declare const SettingsSchema: z.ZodObject<{
             argsPattern?: Record<string, string> | undefined;
         }>, "many">>;
     }, "strip", z.ZodTypeAny, {
-        defaultMode: "default" | "acceptEdits" | "dontAsk" | "bypassPermissions" | "auto" | "plan";
+        defaultMode: "auto" | "default" | "acceptEdits" | "dontAsk" | "bypassPermissions" | "plan";
         rules: {
             tool: string;
             decision: "allow" | "deny" | "ask";
@@ -605,7 +1206,7 @@ export declare const SettingsSchema: z.ZodObject<{
             argsPattern?: Record<string, string> | undefined;
         }[];
     }, {
-        defaultMode?: "default" | "acceptEdits" | "dontAsk" | "bypassPermissions" | "auto" | "plan" | undefined;
+        defaultMode?: "auto" | "default" | "acceptEdits" | "dontAsk" | "bypassPermissions" | "plan" | undefined;
         rules?: {
             tool: string;
             decision: "allow" | "deny" | "ask";
@@ -617,14 +1218,17 @@ export declare const SettingsSchema: z.ZodObject<{
         maxTokens: z.ZodDefault<z.ZodNumber>;
         compactAtRatio: z.ZodDefault<z.ZodNumber>;
         summarizeAtRatio: z.ZodDefault<z.ZodNumber>;
+        microcompactFloorRatio: z.ZodDefault<z.ZodNumber>;
     }, "strip", z.ZodTypeAny, {
         maxTokens: number;
         compactAtRatio: number;
         summarizeAtRatio: number;
+        microcompactFloorRatio: number;
     }, {
         maxTokens?: number | undefined;
         compactAtRatio?: number | undefined;
         summarizeAtRatio?: number | undefined;
+        microcompactFloorRatio?: number | undefined;
     }>>;
     session: z.ZodDefault<z.ZodObject<{
         storageDir: z.ZodOptional<z.ZodString>;
@@ -636,7 +1240,7 @@ export declare const SettingsSchema: z.ZodObject<{
         storageDir?: string | undefined;
         maxHistory?: number | undefined;
     }>>;
-    mcpServers: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodObject<{
+    mcpServers: z.ZodDefault<z.ZodEffects<z.ZodRecord<z.ZodString, z.ZodObject<{
         name: z.ZodString;
         command: z.ZodOptional<z.ZodString>;
         args: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
@@ -644,22 +1248,76 @@ export declare const SettingsSchema: z.ZodObject<{
         url: z.ZodOptional<z.ZodString>;
         transport: z.ZodOptional<z.ZodEnum<["stdio", "sse", "streamable-http", "inprocess"]>>;
         headers: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+        envVars: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        bearerTokenEnvVar: z.ZodOptional<z.ZodString>;
+        envHeaders: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+        credentialRef: z.ZodOptional<z.ZodString>;
+        enabled: z.ZodOptional<z.ZodBoolean>;
     }, "strip", z.ZodTypeAny, {
         name: string;
+        enabled?: boolean | undefined;
         url?: string | undefined;
         args?: string[] | undefined;
-        env?: Record<string, string> | undefined;
         command?: string | undefined;
+        env?: Record<string, string> | undefined;
         transport?: "stdio" | "sse" | "streamable-http" | "inprocess" | undefined;
         headers?: Record<string, string> | undefined;
+        envVars?: string[] | undefined;
+        bearerTokenEnvVar?: string | undefined;
+        envHeaders?: Record<string, string> | undefined;
+        credentialRef?: string | undefined;
     }, {
         name: string;
+        enabled?: boolean | undefined;
         url?: string | undefined;
         args?: string[] | undefined;
+        command?: string | undefined;
         env?: Record<string, string> | undefined;
+        transport?: "stdio" | "sse" | "streamable-http" | "inprocess" | undefined;
+        headers?: Record<string, string> | undefined;
+        envVars?: string[] | undefined;
+        bearerTokenEnvVar?: string | undefined;
+        envHeaders?: Record<string, string> | undefined;
+        credentialRef?: string | undefined;
+    }>>, Record<string, {
+        name: string;
+        enabled?: boolean | undefined;
+        url?: string | undefined;
+        args?: string[] | undefined;
         command?: string | undefined;
+        env?: Record<string, string> | undefined;
         transport?: "stdio" | "sse" | "streamable-http" | "inprocess" | undefined;
         headers?: Record<string, string> | undefined;
+        envVars?: string[] | undefined;
+        bearerTokenEnvVar?: string | undefined;
+        envHeaders?: Record<string, string> | undefined;
+        credentialRef?: string | undefined;
+    }>, unknown>>;
+    /**
+     * User supplements for PLUGIN-provided MCP servers, keyed by the server's
+     * `<plugin>:<server>` name. Layered onto the plugin config at merge time
+     * (mergePluginMcpServers). Only env/credential fields are accepted —
+     * command/args/url/transport are intentionally absent and `.strict()`
+     * rejects them, so a plugin update is never shadowed by a stale copy.
+     */
+    mcpServerOverrides: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodObject<{
+        env: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+        envVars: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        credentialRef: z.ZodOptional<z.ZodString>;
+        bearerTokenEnvVar: z.ZodOptional<z.ZodString>;
+        envHeaders: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+    }, "strict", z.ZodTypeAny, {
+        env?: Record<string, string> | undefined;
+        envVars?: string[] | undefined;
+        bearerTokenEnvVar?: string | undefined;
+        envHeaders?: Record<string, string> | undefined;
+        credentialRef?: string | undefined;
+    }, {
+        env?: Record<string, string> | undefined;
+        envVars?: string[] | undefined;
+        bearerTokenEnvVar?: string | undefined;
+        envHeaders?: Record<string, string> | undefined;
+        credentialRef?: string | undefined;
     }>>>;
     /**
      * Skill names hidden from the LLM. Names include the full
@@ -675,6 +1333,82 @@ export declare const SettingsSchema: z.ZodObject<{
      * names (no colon suffix). See scanSkills(opts.disabledPlugins).
      */
     disabledPlugins: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+    /**
+     * Sub-agent role names (the `name` in .code-shell/agents/*.md) to
+     * hide from the registry. A disabled role is filtered out at load
+     * so it never appears in registry.list()/get() — the Agent tool's
+     * agent_type list won't show it and the LLM can't pick it. Mirrors
+     * disabledSkills / disabledPlugins.
+     */
+    disabledAgents: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+    /**
+     * Project-scoped tri-state capability overlay. Only meaningful in
+     * ${cwd}/.code-shell/settings.json; layered over the global baseline at
+     * capability-assembly time. Optional — absence === everything inherits.
+     */
+    capabilityOverrides: z.ZodOptional<z.ZodObject<{
+        skills: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodEnum<["inherit", "on", "off"]>>>;
+        plugins: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodEnum<["inherit", "on", "off"]>>>;
+        agents: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodEnum<["inherit", "on", "off"]>>>;
+        mcp: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodEnum<["inherit", "on", "off"]>>>;
+        builtin: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodEnum<["inherit", "on", "off"]>>>;
+        /**
+         * Per-hook overlay for PLUGIN-provided hooks, keyed by
+         * `pluginHookKey()` (`<plugin>:<RawEvent>:<command>`). Finer-grained
+         * than `plugins` (which kills a whole plugin): "off" suppresses one
+         * hook for this project only. Only "off" is meaningful today — plugin
+         * hooks have no global disable list to force back "on" from.
+         */
+        pluginHooks: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodEnum<["inherit", "on", "off"]>>>;
+    }, "strip", z.ZodTypeAny, {
+        builtin?: Record<string, "off" | "on" | "inherit"> | undefined;
+        mcp?: Record<string, "off" | "on" | "inherit"> | undefined;
+        skills?: Record<string, "off" | "on" | "inherit"> | undefined;
+        plugins?: Record<string, "off" | "on" | "inherit"> | undefined;
+        agents?: Record<string, "off" | "on" | "inherit"> | undefined;
+        pluginHooks?: Record<string, "off" | "on" | "inherit"> | undefined;
+    }, {
+        builtin?: Record<string, "off" | "on" | "inherit"> | undefined;
+        mcp?: Record<string, "off" | "on" | "inherit"> | undefined;
+        skills?: Record<string, "off" | "on" | "inherit"> | undefined;
+        plugins?: Record<string, "off" | "on" | "inherit"> | undefined;
+        agents?: Record<string, "off" | "on" | "inherit"> | undefined;
+        pluginHooks?: Record<string, "off" | "on" | "inherit"> | undefined;
+    }>>;
+    /**
+     * Feature flags overlay: a map of flag name → boolean that overrides the
+     * compiled-in defaults (see settings/feature-flags.ts FEATURE_FLAGS).
+     * Project settings override user settings via the normal merge, so a flag
+     * can be flipped per-workspace. Unknown flag names are tolerated (kept as
+     * data) for forward-compat; consumers only read known flags via
+     * isFeatureEnabled(). Passthrough record — values coerced to boolean.
+     */
+    featureFlags: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodBoolean>>;
+    /**
+     * Cross-session memory knobs. Optional — absence keeps the built-in
+     * defaults (see services/extract-memories.ts). `maxCount` caps memories
+     * accepted per extraction pass; `maxAge`/`extractionModel` are reserved
+     * for the consolidation/extraction pipeline.
+     */
+    memories: z.ZodOptional<z.ZodObject<{
+        maxCount: z.ZodOptional<z.ZodNumber>;
+        maxAge: z.ZodOptional<z.ZodNumber>;
+        extractionModel: z.ZodOptional<z.ZodString>;
+        /** Master switch for end-of-session automatic memory extraction.
+         *  Absent/true = extract (current behavior); false = skip extraction
+         *  while keeping session summaries and Dream untouched. */
+        autoExtract: z.ZodOptional<z.ZodBoolean>;
+    }, "strip", z.ZodTypeAny, {
+        maxCount?: number | undefined;
+        maxAge?: number | undefined;
+        extractionModel?: string | undefined;
+        autoExtract?: boolean | undefined;
+    }, {
+        maxCount?: number | undefined;
+        maxAge?: number | undefined;
+        extractionModel?: string | undefined;
+        autoExtract?: boolean | undefined;
+    }>>;
     instructions: z.ZodDefault<z.ZodObject<{
         fileName: z.ZodDefault<z.ZodString>;
         scanDirs: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
@@ -699,30 +1433,30 @@ export declare const SettingsSchema: z.ZodObject<{
             apiKey: z.ZodOptional<z.ZodString>;
             baseUrl: z.ZodOptional<z.ZodString>;
         }, "strip", z.ZodTypeAny, {
-            model: string;
             name: string;
+            model: string;
             provider?: string | undefined;
             baseUrl?: string | undefined;
             apiKey?: string | undefined;
         }, {
-            model: string;
             name: string;
+            model: string;
             provider?: string | undefined;
             baseUrl?: string | undefined;
             apiKey?: string | undefined;
         }>]>, "many">>;
     }, "strip", z.ZodTypeAny, {
         participants: (string | {
-            model: string;
             name: string;
+            model: string;
             provider?: string | undefined;
             baseUrl?: string | undefined;
             apiKey?: string | undefined;
         })[];
     }, {
         participants?: (string | {
-            model: string;
             name: string;
+            model: string;
             provider?: string | undefined;
             baseUrl?: string | undefined;
             apiKey?: string | undefined;
@@ -742,12 +1476,45 @@ export declare const SettingsSchema: z.ZodObject<{
         providers: z.ZodOptional<z.ZodRecord<z.ZodEnum<["serper", "tavily", "searxng"]>, z.ZodObject<{
             apiKey: z.ZodOptional<z.ZodString>;
             baseUrl: z.ZodOptional<z.ZodString>;
+            lastProbe: z.ZodOptional<z.ZodObject<{
+                status: z.ZodEnum<["ok", "error", "unconfigured"]>;
+                sampleTitles: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+                errorMessage: z.ZodOptional<z.ZodString>;
+                errorDetail: z.ZodOptional<z.ZodString>;
+                lastProbedAt: z.ZodString;
+            }, "strip", z.ZodTypeAny, {
+                status: "error" | "ok" | "unconfigured";
+                lastProbedAt: string;
+                sampleTitles?: string[] | undefined;
+                errorMessage?: string | undefined;
+                errorDetail?: string | undefined;
+            }, {
+                status: "error" | "ok" | "unconfigured";
+                lastProbedAt: string;
+                sampleTitles?: string[] | undefined;
+                errorMessage?: string | undefined;
+                errorDetail?: string | undefined;
+            }>>;
         }, "strip", z.ZodTypeAny, {
             baseUrl?: string | undefined;
             apiKey?: string | undefined;
+            lastProbe?: {
+                status: "error" | "ok" | "unconfigured";
+                lastProbedAt: string;
+                sampleTitles?: string[] | undefined;
+                errorMessage?: string | undefined;
+                errorDetail?: string | undefined;
+            } | undefined;
         }, {
             baseUrl?: string | undefined;
             apiKey?: string | undefined;
+            lastProbe?: {
+                status: "error" | "ok" | "unconfigured";
+                lastProbedAt: string;
+                sampleTitles?: string[] | undefined;
+                errorMessage?: string | undefined;
+                errorDetail?: string | undefined;
+            } | undefined;
         }>>>;
     }, "strip", z.ZodTypeAny, {
         provider: "serper" | "tavily" | "searxng";
@@ -756,6 +1523,13 @@ export declare const SettingsSchema: z.ZodObject<{
         providers?: Partial<Record<"serper" | "tavily" | "searxng", {
             baseUrl?: string | undefined;
             apiKey?: string | undefined;
+            lastProbe?: {
+                status: "error" | "ok" | "unconfigured";
+                lastProbedAt: string;
+                sampleTitles?: string[] | undefined;
+                errorMessage?: string | undefined;
+                errorDetail?: string | undefined;
+            } | undefined;
         }>> | undefined;
     }, {
         provider?: "serper" | "tavily" | "searxng" | undefined;
@@ -764,6 +1538,13 @@ export declare const SettingsSchema: z.ZodObject<{
         providers?: Partial<Record<"serper" | "tavily" | "searxng", {
             baseUrl?: string | undefined;
             apiKey?: string | undefined;
+            lastProbe?: {
+                status: "error" | "ok" | "unconfigured";
+                lastProbedAt: string;
+                sampleTitles?: string[] | undefined;
+                errorMessage?: string | undefined;
+                errorDetail?: string | undefined;
+            } | undefined;
         }>> | undefined;
     }>>;
     output: z.ZodDefault<z.ZodObject<{
@@ -773,6 +1554,26 @@ export declare const SettingsSchema: z.ZodObject<{
     }, {
         format?: "text" | "json" | "jsonl" | "stream-json" | undefined;
     }>>;
+    /**
+     * Image attachment handling. Sub-fields:
+     *   - detail: provider-agnostic image clarity. Drives the
+     *     renderer-side downscale (low→~1024 / standard→~1568 /
+     *     high→~2576 px long edge) so BOTH providers save tokens
+     *     before send. Legacy "original" is migrated to "high".
+     *   - mcpImageTokenBudget: per-turn cap on token cost of images
+     *     returned by MCP tools. Codex doesn't enforce this; CC uses
+     *     25 000. Set to 0 to disable.
+     */
+    images: z.ZodOptional<z.ZodObject<{
+        detail: z.ZodOptional<z.ZodEffects<z.ZodEnum<["low", "standard", "high"]>, "low" | "high" | "standard", unknown>>;
+        mcpImageTokenBudget: z.ZodOptional<z.ZodNumber>;
+    }, "strip", z.ZodTypeAny, {
+        detail?: "low" | "high" | "standard" | undefined;
+        mcpImageTokenBudget?: number | undefined;
+    }, {
+        detail?: unknown;
+        mcpImageTokenBudget?: number | undefined;
+    }>>;
     /**
      * OS-level sandbox for shell-tool execution. "auto" picks per platform:
      * Seatbelt on macOS, bubblewrap on Linux when installed, otherwise off.
@@ -785,16 +1586,103 @@ export declare const SettingsSchema: z.ZodObject<{
         deniedReads: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
         network: z.ZodOptional<z.ZodEnum<["allow", "deny"]>>;
     }, "strip", z.ZodTypeAny, {
-        mode?: "auto" | "seatbelt" | "bwrap" | "off" | undefined;
+        mode?: "auto" | "off" | "seatbelt" | "bwrap" | undefined;
         writableRoots?: string[] | undefined;
         deniedReads?: string[] | undefined;
         network?: "allow" | "deny" | undefined;
     }, {
-        mode?: "auto" | "seatbelt" | "bwrap" | "off" | undefined;
+        mode?: "auto" | "off" | "seatbelt" | "bwrap" | undefined;
         writableRoots?: string[] | undefined;
         deniedReads?: string[] | undefined;
         network?: "allow" | "deny" | undefined;
     }>>;
+    /**
+     * Top-level environment variables injected into tool subprocesses (the
+     * Bash tool, background shells). Mirrors Claude Code's `env` field: a
+     * KEY=VALUE map that can be set globally (~/.code-shell/settings.json) and
+     * overridden per-project (.code-shell/settings.json). The canonical home
+     * for API keys (e.g. OPENAI_API_KEY) that a skill's script reads — configure
+     * once globally and every project's skills can use it.
+     *
+     * Precedence when merged into the spawn env (lowest → highest):
+     *   project localEnvironment.env  →  global env  →  project env
+     * None of these is filtered through the deny regex (see mergeShellEnv):
+     * they are values the user typed deliberately, a different trust class from
+     * the host process.env passthrough the deny machinery guards against.
+     */
+    env: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+    /**
+     * Project-local environment profile. Mirrors Codex's local-environment
+     * shape at the settings layer: setup/cleanup scripts can be customized per
+     * platform, and env values are stored as KEY=VALUE pairs. Runtime wiring is
+     * intentionally separate from the MCP server env model above.
+     */
+    localEnvironment: z.ZodOptional<z.ZodObject<{
+        name: z.ZodOptional<z.ZodString>;
+        setupScripts: z.ZodOptional<z.ZodObject<{
+            default: z.ZodOptional<z.ZodString>;
+            macos: z.ZodOptional<z.ZodString>;
+            linux: z.ZodOptional<z.ZodString>;
+            windows: z.ZodOptional<z.ZodString>;
+        }, "strip", z.ZodTypeAny, {
+            default?: string | undefined;
+            linux?: string | undefined;
+            macos?: string | undefined;
+            windows?: string | undefined;
+        }, {
+            default?: string | undefined;
+            linux?: string | undefined;
+            macos?: string | undefined;
+            windows?: string | undefined;
+        }>>;
+        cleanupScripts: z.ZodOptional<z.ZodObject<{
+            default: z.ZodOptional<z.ZodString>;
+            macos: z.ZodOptional<z.ZodString>;
+            linux: z.ZodOptional<z.ZodString>;
+            windows: z.ZodOptional<z.ZodString>;
+        }, "strip", z.ZodTypeAny, {
+            default?: string | undefined;
+            linux?: string | undefined;
+            macos?: string | undefined;
+            windows?: string | undefined;
+        }, {
+            default?: string | undefined;
+            linux?: string | undefined;
+            macos?: string | undefined;
+            windows?: string | undefined;
+        }>>;
+        env: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+    }, "strip", z.ZodTypeAny, {
+        name?: string | undefined;
+        env?: Record<string, string> | undefined;
+        setupScripts?: {
+            default?: string | undefined;
+            linux?: string | undefined;
+            macos?: string | undefined;
+            windows?: string | undefined;
+        } | undefined;
+        cleanupScripts?: {
+            default?: string | undefined;
+            linux?: string | undefined;
+            macos?: string | undefined;
+            windows?: string | undefined;
+        } | undefined;
+    }, {
+        name?: string | undefined;
+        env?: Record<string, string> | undefined;
+        setupScripts?: {
+            default?: string | undefined;
+            linux?: string | undefined;
+            macos?: string | undefined;
+            windows?: string | undefined;
+        } | undefined;
+        cleanupScripts?: {
+            default?: string | undefined;
+            linux?: string | undefined;
+            macos?: string | undefined;
+            windows?: string | undefined;
+        } | undefined;
+    }>>;
     /**
      * Shell-hook configuration. Each entry binds a HookEventName to a
      * shell command; the command receives ctx JSON on stdin and returns
@@ -811,19 +1699,99 @@ export declare const SettingsSchema: z.ZodObject<{
         matcher: z.ZodOptional<z.ZodString>;
         timeout_ms: z.ZodOptional<z.ZodNumber>;
         cwd: z.ZodOptional<z.ZodString>;
+        /** Soft off-switch: the entry stays in the file (and the UI) but
+         *  registerSettingsHooks skips it. Absent = enabled. */
+        disabled: z.ZodOptional<z.ZodBoolean>;
     }, "strip", z.ZodTypeAny, {
         command: string;
         event: string;
-        cwd?: string | undefined;
+        disabled?: boolean | undefined;
         matcher?: string | undefined;
         timeout_ms?: number | undefined;
+        cwd?: string | undefined;
     }, {
         command: string;
         event: string;
-        cwd?: string | undefined;
+        disabled?: boolean | undefined;
         matcher?: string | undefined;
         timeout_ms?: number | undefined;
+        cwd?: string | undefined;
     }>, "many">>;
+    /**
+     * External coding-agent orchestration (Claude Code / Codex CLI).
+     * Used by the Mobile Web Remote to launch managed jobs. dangerousArgs
+     * is config-provided (not hardcoded) so it tracks CLI flag changes;
+     * project-default dangerous mode only applies inside trustedWorkspaces.
+     */
+    externalAgents: z.ZodOptional<z.ZodObject<{
+        claudeCode: z.ZodOptional<z.ZodObject<{
+            command: z.ZodOptional<z.ZodString>;
+            defaultMode: z.ZodOptional<z.ZodEnum<["safe", "dangerous"]>>;
+            dangerousArgs: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+            trustedWorkspaces: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+            autoStartInTrustedWorkspaces: z.ZodOptional<z.ZodBoolean>;
+        }, "strip", z.ZodTypeAny, {
+            defaultMode?: "safe" | "dangerous" | undefined;
+            command?: string | undefined;
+            dangerousArgs?: string[] | undefined;
+            trustedWorkspaces?: string[] | undefined;
+            autoStartInTrustedWorkspaces?: boolean | undefined;
+        }, {
+            defaultMode?: "safe" | "dangerous" | undefined;
+            command?: string | undefined;
+            dangerousArgs?: string[] | undefined;
+            trustedWorkspaces?: string[] | undefined;
+            autoStartInTrustedWorkspaces?: boolean | undefined;
+        }>>;
+        codex: z.ZodOptional<z.ZodObject<{
+            command: z.ZodOptional<z.ZodString>;
+            args: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        }, "strip", z.ZodTypeAny, {
+            args?: string[] | undefined;
+            command?: string | undefined;
+        }, {
+            args?: string[] | undefined;
+            command?: string | undefined;
+        }>>;
+    }, "strip", z.ZodTypeAny, {
+        claudeCode?: {
+            defaultMode?: "safe" | "dangerous" | undefined;
+            command?: string | undefined;
+            dangerousArgs?: string[] | undefined;
+            trustedWorkspaces?: string[] | undefined;
+            autoStartInTrustedWorkspaces?: boolean | undefined;
+        } | undefined;
+        codex?: {
+            args?: string[] | undefined;
+            command?: string | undefined;
+        } | undefined;
+    }, {
+        claudeCode?: {
+            defaultMode?: "safe" | "dangerous" | undefined;
+            command?: string | undefined;
+            dangerousArgs?: string[] | undefined;
+            trustedWorkspaces?: string[] | undefined;
+            autoStartInTrustedWorkspaces?: boolean | undefined;
+        } | undefined;
+        codex?: {
+            args?: string[] | undefined;
+            command?: string | undefined;
+        } | undefined;
+    }>>;
+    /**
+     * Credential-use gate (凭证模块第二期). Controls whether the AI's
+     * `UseCredential` tool prompts before handing a stored credential to a
+     * command. `autoApprove: true` skips the prompt entirely (默认关 — every
+     * use asks, or is remembered for the session). See
+     * docs/superpowers/specs/2026-06-16-credential-use-gate-design.md §5.
+     */
+    credentialUse: z.ZodOptional<z.ZodObject<{
+        autoApprove: z.ZodOptional<z.ZodBoolean>;
+    }, "strip", z.ZodTypeAny, {
+        autoApprove?: boolean | undefined;
+    }, {
+        autoApprove?: boolean | undefined;
+    }>>;
 }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
     agent: z.ZodDefault<z.ZodObject<{
         preset: z.ZodDefault<z.ZodString>;
@@ -831,27 +1799,43 @@ export declare const SettingsSchema: z.ZodObject<{
         disabledBuiltinTools: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
         customSystemPrompt: z.ZodOptional<z.ZodString>;
         appendSystemPrompt: z.ZodOptional<z.ZodString>;
+        responseLanguage: z.ZodOptional<z.ZodString>;
+        userProfile: z.ZodOptional<z.ZodString>;
+        instructions: z.ZodOptional<z.ZodObject<{
+            compatClaude: z.ZodDefault<z.ZodBoolean>;
+            compatCodex: z.ZodDefault<z.ZodBoolean>;
+        }, "strip", z.ZodTypeAny, {
+            compatClaude: boolean;
+            compatCodex: boolean;
+        }, {
+            compatClaude?: boolean | undefined;
+            compatCodex?: boolean | undefined;
+        }>>;
     }, "strip", z.ZodTypeAny, {
         preset: string;
         enabledBuiltinTools: string[];
         disabledBuiltinTools: string[];
         customSystemPrompt?: string | undefined;
         appendSystemPrompt?: string | undefined;
+        responseLanguage?: string | undefined;
+        userProfile?: string | undefined;
+        instructions?: {
+            compatClaude: boolean;
+            compatCodex: boolean;
+        } | undefined;
     }, {
         preset?: string | undefined;
         enabledBuiltinTools?: string[] | undefined;
         disabledBuiltinTools?: string[] | undefined;
         customSystemPrompt?: string | undefined;
         appendSystemPrompt?: string | undefined;
+        responseLanguage?: string | undefined;
+        userProfile?: string | undefined;
+        instructions?: {
+            compatClaude?: boolean | undefined;
+            compatCodex?: boolean | undefined;
+        } | undefined;
     }>>;
-    /**
-     * Primary source of truth for the active model is settings.activeKey
-     * (points at models[].key). settings.model is a derived mirror of that
-     * entry kept in sync for legacy boot paths (cli/main.ts, repl.ts, etc.)
-     * which read provider/name/apiKey/baseUrl directly. Writers must update
-     * both — appendOnboardingResult does this in one shot.
-     */
-    activeKey: z.ZodOptional<z.ZodString>;
     /**
      * Toggle background auto-update. When true (default), code-shell checks
      * npm for newer versions and — if the npm global prefix is writable —
@@ -860,135 +1844,215 @@ export declare const SettingsSchema: z.ZodObject<{
      * Can also be disabled via env var `DISABLE_AUTOUPDATER=1`.
      */
     autoUpdates: z.ZodDefault<z.ZodBoolean>;
-    model: z.ZodDefault<z.ZodObject<{
-        provider: z.ZodDefault<z.ZodString>;
-        name: z.ZodDefault<z.ZodString>;
-        apiKey: z.ZodOptional<z.ZodString>;
-        baseUrl: z.ZodDefault<z.ZodString>;
-        temperature: z.ZodDefault<z.ZodNumber>;
-        maxTokens: z.ZodDefault<z.ZodNumber>;
+    /**
+     * Image generation is a general capability, decoupled from LLM providers
+     * (TODO 7.1): a vendor may use different keys/endpoints/models for chat vs
+     * image, and image vendors (Gemini, and later 国内 模型) don't fit the LLM
+     * `providers[].kind` enum. `imageGen.providers[]` is the canonical config;
+     * each entry has a user-chosen `id` (selected via GenerateImage's
+     * `provider` arg) and a `kind` that picks the adapter. When `imageGen` is
+     * absent, resolution falls back to scanning LLM `providers[]` for an
+     * image-capable kind — so existing configs keep working with no migration.
+     */
+    imageGen: z.ZodOptional<z.ZodObject<{
+        defaultProvider: z.ZodOptional<z.ZodString>;
+        providers: z.ZodDefault<z.ZodArray<z.ZodObject<{
+            /** User-chosen instance name; GenerateImage(provider) selects by this. */
+            id: z.ZodString;
+            /** Adapter selector — e.g. "openai", "google". */
+            kind: z.ZodString;
+            baseUrl: z.ZodString;
+            apiKey: z.ZodOptional<z.ZodString>;
+            /** Default model for this instance when the call omits `model`. */
+            defaultModel: z.ZodOptional<z.ZodString>;
+            /** Catalog template this instance was created from (for paramsDoc / displayName回显). */
+            catalogId: z.ZodOptional<z.ZodString>;
+            /** Reuse another instance's key: id of the instance whose apiKey to use (when apiKey is empty). */
+            apiKeyRef: z.ZodOptional<z.ZodString>;
+        }, "strip", z.ZodTypeAny, {
+            id: string;
+            kind: string;
+            baseUrl: string;
+            apiKey?: string | undefined;
+            defaultModel?: string | undefined;
+            catalogId?: string | undefined;
+            apiKeyRef?: string | undefined;
+        }, {
+            id: string;
+            kind: string;
+            baseUrl: string;
+            apiKey?: string | undefined;
+            defaultModel?: string | undefined;
+            catalogId?: string | undefined;
+            apiKeyRef?: string | undefined;
+        }>, "many">>;
     }, "strip", z.ZodTypeAny, {
-        provider: string;
-        name: string;
-        temperature: number;
-        baseUrl: string;
-        maxTokens: number;
-        apiKey?: string | undefined;
+        providers: {
+            id: string;
+            kind: string;
+            baseUrl: string;
+            apiKey?: string | undefined;
+            defaultModel?: string | undefined;
+            catalogId?: string | undefined;
+            apiKeyRef?: string | undefined;
+        }[];
+        defaultProvider?: string | undefined;
     }, {
-        provider?: string | undefined;
-        name?: string | undefined;
-        temperature?: number | undefined;
-        baseUrl?: string | undefined;
-        apiKey?: string | undefined;
-        maxTokens?: number | undefined;
+        defaultProvider?: string | undefined;
+        providers?: {
+            id: string;
+            kind: string;
+            baseUrl: string;
+            apiKey?: string | undefined;
+            defaultModel?: string | undefined;
+            catalogId?: string | undefined;
+            apiKeyRef?: string | undefined;
+        }[] | undefined;
     }>>;
-    providers: z.ZodDefault<z.ZodArray<z.ZodObject<{
-        key: z.ZodString;
-        label: z.ZodOptional<z.ZodString>;
-        kind: z.ZodEnum<["openai", "anthropic", "deepseek", "zai", "xai", "mistral", "groq", "google", "openrouter", "ollama", "custom"]>;
-        baseUrl: z.ZodString;
-        apiKey: z.ZodOptional<z.ZodString>;
-        protocol: z.ZodOptional<z.ZodEnum<["openai-compat", "anthropic-style"]>>;
-        modelsPath: z.ZodOptional<z.ZodString>;
-        /**
-         * DeepSeek V4 thinking-mode default for this provider. "enabled"
-         * matches endpoint default; "disabled" makes V4 calls run in
-         * non-thinking mode (faster, cheaper). Ignored by every provider
-         * other than DeepSeek V4. Per-call overrides still win.
-         */
-        thinking: z.ZodOptional<z.ZodEnum<["enabled", "disabled"]>>;
+    /**
+     * Video generation config (TODO 7.1) — same shape as imageGen, decoupled
+     * from LLM providers. `videoGen.providers[]` each carry an `id` (selected
+     * via GenerateVideo's `provider` arg) + a `kind` picking the adapter. With
+     * no real adapters wired yet, this is config-ready: a future getVideoProvider
+     * case lights it up. Falls back to scanning LLM providers[] when absent.
+     */
+    videoGen: z.ZodOptional<z.ZodObject<{
+        defaultProvider: z.ZodOptional<z.ZodString>;
+        providers: z.ZodDefault<z.ZodArray<z.ZodObject<{
+            id: z.ZodString;
+            kind: z.ZodString;
+            baseUrl: z.ZodString;
+            apiKey: z.ZodOptional<z.ZodString>;
+            defaultModel: z.ZodOptional<z.ZodString>;
+            /** Catalog template this instance was created from (for paramsDoc / displayName回显). */
+            catalogId: z.ZodOptional<z.ZodString>;
+            /** Reuse another instance's key: id of the instance whose apiKey to use (when apiKey is empty). */
+            apiKeyRef: z.ZodOptional<z.ZodString>;
+        }, "strip", z.ZodTypeAny, {
+            id: string;
+            kind: string;
+            baseUrl: string;
+            apiKey?: string | undefined;
+            defaultModel?: string | undefined;
+            catalogId?: string | undefined;
+            apiKeyRef?: string | undefined;
+        }, {
+            id: string;
+            kind: string;
+            baseUrl: string;
+            apiKey?: string | undefined;
+            defaultModel?: string | undefined;
+            catalogId?: string | undefined;
+            apiKeyRef?: string | undefined;
+        }>, "many">>;
     }, "strip", z.ZodTypeAny, {
-        key: string;
-        kind: "anthropic" | "openai" | "deepseek" | "zai" | "xai" | "mistral" | "groq" | "google" | "openrouter" | "ollama" | "custom";
-        baseUrl: string;
-        thinking?: "enabled" | "disabled" | undefined;
-        label?: string | undefined;
-        apiKey?: string | undefined;
-        protocol?: "openai-compat" | "anthropic-style" | undefined;
-        modelsPath?: string | undefined;
-    }, {
-        key: string;
-        kind: "anthropic" | "openai" | "deepseek" | "zai" | "xai" | "mistral" | "groq" | "google" | "openrouter" | "ollama" | "custom";
-        baseUrl: string;
-        thinking?: "enabled" | "disabled" | undefined;
-        label?: string | undefined;
-        apiKey?: string | undefined;
-        protocol?: "openai-compat" | "anthropic-style" | undefined;
-        modelsPath?: string | undefined;
-    }>, "many">>;
-    models: z.ZodDefault<z.ZodArray<z.ZodEffects<z.ZodObject<{
-        key: z.ZodString;
-        label: z.ZodOptional<z.ZodString>;
-        providerKey: z.ZodOptional<z.ZodString>;
-        model: z.ZodString;
-        maxOutputTokens: z.ZodOptional<z.ZodNumber>;
-        maxContextTokens: z.ZodOptional<z.ZodNumber>;
-        /**
-         * Which LLM client to use ("openai" or "anthropic"). New name —
-         * the legacy field is `provider`, which we still accept and
-         * fold into `protocol` below so old configs keep working.
-         * NOT the brand/vendor — that's providerKey above.
-         */
-        protocol: z.ZodOptional<z.ZodString>;
-        provider: z.ZodOptional<z.ZodString>;
-        baseUrl: z.ZodOptional<z.ZodString>;
+        providers: {
+            id: string;
+            kind: string;
+            baseUrl: string;
+            apiKey?: string | undefined;
+            defaultModel?: string | undefined;
+            catalogId?: string | undefined;
+            apiKeyRef?: string | undefined;
+        }[];
+        defaultProvider?: string | undefined;
+    }, {
+        defaultProvider?: string | undefined;
+        providers?: {
+            id: string;
+            kind: string;
+            baseUrl: string;
+            apiKey?: string | undefined;
+            defaultModel?: string | undefined;
+            catalogId?: string | undefined;
+            apiKeyRef?: string | undefined;
+        }[] | undefined;
+    }>>;
+    /**
+     * Credentials — independent key entities (统一模型接入方案 §3.3). A key
+     * lives here, not inlined on a connection, so deleting a connection never
+     * loses a key and many connections share one key by referencing the same
+     * credential id (LiteLLM credential_list model).
+     */
+    credentials: z.ZodDefault<z.ZodArray<z.ZodObject<{
+        /** User-chosen unique credential name. */
+        id: z.ZodString;
+        /** Catalog template this credential is for (a key belongs to one provider). */
+        catalogId: z.ZodString;
         apiKey: z.ZodOptional<z.ZodString>;
-        /**
-         * Per-model thinking override. Wins over the provider-level
-         * setting (settings.providers[].thinking). Use this when
-         * different models under the same provider need different
-         * defaults — e.g. DeepSeek V4 Pro off (faster) but V4 Flash on.
-         */
-        thinking: z.ZodOptional<z.ZodEnum<["enabled", "disabled"]>>;
+        baseUrl: z.ZodOptional<z.ZodString>;
     }, "strip", z.ZodTypeAny, {
-        model: string;
-        key: string;
-        provider?: string | undefined;
-        thinking?: "enabled" | "disabled" | undefined;
-        label?: string | undefined;
+        id: string;
+        catalogId: string;
         baseUrl?: string | undefined;
         apiKey?: string | undefined;
-        protocol?: string | undefined;
-        providerKey?: string | undefined;
-        maxOutputTokens?: number | undefined;
-        maxContextTokens?: number | undefined;
     }, {
-        model: string;
-        key: string;
-        provider?: string | undefined;
-        thinking?: "enabled" | "disabled" | undefined;
-        label?: string | undefined;
+        id: string;
+        catalogId: string;
         baseUrl?: string | undefined;
         apiKey?: string | undefined;
-        protocol?: string | undefined;
-        providerKey?: string | undefined;
-        maxOutputTokens?: number | undefined;
-        maxContextTokens?: number | undefined;
-    }>, {
-        protocol: string | undefined;
-        provider: string | undefined;
+    }>, "many">>;
+    /**
+     * Unified instance layer (统一模型接入方案, see
+     * docs/superpowers/specs/2026-06-15-unified-model-catalog-design.md §3.3).
+     * One store for text/image/video connections, each pointing at a catalog
+     * entry (catalogId), a credential (credentialId), its chosen model, and the
+     * param values the user picked. Replaces the legacy split of
+     * providers[]/models[]/imageGen/videoGen.
+     */
+    modelConnections: z.ZodDefault<z.ZodArray<z.ZodObject<{
+        /** User-chosen unique instance name. */
+        id: z.ZodString;
+        /** Catalog template this instance was created from. */
+        catalogId: z.ZodString;
+        tag: z.ZodEnum<["text", "image", "video", "audio"]>;
+        /** Selected modelId (from the entry's modelPresets). */
+        model: z.ZodString;
+        /** Per-connection baseUrl override (else the credential's / catalog's). */
+        baseUrl: z.ZodOptional<z.ZodString>;
+        /** Which credential supplies this connection's key. */
+        credentialId: z.ZodOptional<z.ZodString>;
+        /** Values the user picked for the model's params, e.g. { reasoning: "high" }. */
+        paramValues: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+    }, "strip", z.ZodTypeAny, {
+        id: string;
         model: string;
-        key: string;
-        thinking?: "enabled" | "disabled" | undefined;
-        label?: string | undefined;
+        catalogId: string;
+        tag: "text" | "image" | "video" | "audio";
         baseUrl?: string | undefined;
-        apiKey?: string | undefined;
-        providerKey?: string | undefined;
-        maxOutputTokens?: number | undefined;
-        maxContextTokens?: number | undefined;
+        credentialId?: string | undefined;
+        paramValues?: Record<string, unknown> | undefined;
     }, {
+        id: string;
         model: string;
-        key: string;
-        provider?: string | undefined;
-        thinking?: "enabled" | "disabled" | undefined;
-        label?: string | undefined;
+        catalogId: string;
+        tag: "text" | "image" | "video" | "audio";
         baseUrl?: string | undefined;
-        apiKey?: string | undefined;
-        protocol?: string | undefined;
-        providerKey?: string | undefined;
-        maxOutputTokens?: number | undefined;
-        maxContextTokens?: number | undefined;
+        credentialId?: string | undefined;
+        paramValues?: Record<string, unknown> | undefined;
     }>, "many">>;
+    /** Default instance id per tag (replaces activeKey / defaultProvider). */
+    defaults: z.ZodDefault<z.ZodObject<{
+        text: z.ZodOptional<z.ZodString>;
+        image: z.ZodOptional<z.ZodString>;
+        video: z.ZodOptional<z.ZodString>;
+        /** Default speech-to-text (voice input) connection. */
+        audio: z.ZodOptional<z.ZodString>;
+        /** Background-task model (replaces auxModelKey). */
+        auxText: z.ZodOptional<z.ZodString>;
+    }, "strip", z.ZodTypeAny, {
+        text?: string | undefined;
+        image?: string | undefined;
+        video?: string | undefined;
+        audio?: string | undefined;
+        auxText?: string | undefined;
+    }, {
+        text?: string | undefined;
+        image?: string | undefined;
+        video?: string | undefined;
+        audio?: string | undefined;
+        auxText?: string | undefined;
+    }>>;
     permissions: z.ZodDefault<z.ZodObject<{
         defaultMode: z.ZodDefault<z.ZodEnum<["default", "acceptEdits", "dontAsk", "bypassPermissions", "auto", "plan"]>>;
         rules: z.ZodDefault<z.ZodArray<z.ZodObject<{
@@ -1008,7 +2072,7 @@ export declare const SettingsSchema: z.ZodObject<{
             argsPattern?: Record<string, string> | undefined;
         }>, "many">>;
     }, "strip", z.ZodTypeAny, {
-        defaultMode: "default" | "acceptEdits" | "dontAsk" | "bypassPermissions" | "auto" | "plan";
+        defaultMode: "auto" | "default" | "acceptEdits" | "dontAsk" | "bypassPermissions" | "plan";
         rules: {
             tool: string;
             decision: "allow" | "deny" | "ask";
@@ -1016,7 +2080,7 @@ export declare const SettingsSchema: z.ZodObject<{
             argsPattern?: Record<string, string> | undefined;
         }[];
     }, {
-        defaultMode?: "default" | "acceptEdits" | "dontAsk" | "bypassPermissions" | "auto" | "plan" | undefined;
+        defaultMode?: "auto" | "default" | "acceptEdits" | "dontAsk" | "bypassPermissions" | "plan" | undefined;
         rules?: {
             tool: string;
             decision: "allow" | "deny" | "ask";
@@ -1028,14 +2092,17 @@ export declare const SettingsSchema: z.ZodObject<{
         maxTokens: z.ZodDefault<z.ZodNumber>;
         compactAtRatio: z.ZodDefault<z.ZodNumber>;
         summarizeAtRatio: z.ZodDefault<z.ZodNumber>;
+        microcompactFloorRatio: z.ZodDefault<z.ZodNumber>;
     }, "strip", z.ZodTypeAny, {
         maxTokens: number;
         compactAtRatio: number;
         summarizeAtRatio: number;
+        microcompactFloorRatio: number;
     }, {
         maxTokens?: number | undefined;
         compactAtRatio?: number | undefined;
         summarizeAtRatio?: number | undefined;
+        microcompactFloorRatio?: number | undefined;
     }>>;
     session: z.ZodDefault<z.ZodObject<{
         storageDir: z.ZodOptional<z.ZodString>;
@@ -1047,7 +2114,7 @@ export declare const SettingsSchema: z.ZodObject<{
         storageDir?: string | undefined;
         maxHistory?: number | undefined;
     }>>;
-    mcpServers: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodObject<{
+    mcpServers: z.ZodDefault<z.ZodEffects<z.ZodRecord<z.ZodString, z.ZodObject<{
         name: z.ZodString;
         command: z.ZodOptional<z.ZodString>;
         args: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
@@ -1055,22 +2122,76 @@ export declare const SettingsSchema: z.ZodObject<{
         url: z.ZodOptional<z.ZodString>;
         transport: z.ZodOptional<z.ZodEnum<["stdio", "sse", "streamable-http", "inprocess"]>>;
         headers: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+        envVars: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        bearerTokenEnvVar: z.ZodOptional<z.ZodString>;
+        envHeaders: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+        credentialRef: z.ZodOptional<z.ZodString>;
+        enabled: z.ZodOptional<z.ZodBoolean>;
     }, "strip", z.ZodTypeAny, {
         name: string;
+        enabled?: boolean | undefined;
         url?: string | undefined;
         args?: string[] | undefined;
-        env?: Record<string, string> | undefined;
         command?: string | undefined;
+        env?: Record<string, string> | undefined;
         transport?: "stdio" | "sse" | "streamable-http" | "inprocess" | undefined;
         headers?: Record<string, string> | undefined;
+        envVars?: string[] | undefined;
+        bearerTokenEnvVar?: string | undefined;
+        envHeaders?: Record<string, string> | undefined;
+        credentialRef?: string | undefined;
     }, {
         name: string;
+        enabled?: boolean | undefined;
         url?: string | undefined;
         args?: string[] | undefined;
+        command?: string | undefined;
         env?: Record<string, string> | undefined;
+        transport?: "stdio" | "sse" | "streamable-http" | "inprocess" | undefined;
+        headers?: Record<string, string> | undefined;
+        envVars?: string[] | undefined;
+        bearerTokenEnvVar?: string | undefined;
+        envHeaders?: Record<string, string> | undefined;
+        credentialRef?: string | undefined;
+    }>>, Record<string, {
+        name: string;
+        enabled?: boolean | undefined;
+        url?: string | undefined;
+        args?: string[] | undefined;
         command?: string | undefined;
+        env?: Record<string, string> | undefined;
         transport?: "stdio" | "sse" | "streamable-http" | "inprocess" | undefined;
         headers?: Record<string, string> | undefined;
+        envVars?: string[] | undefined;
+        bearerTokenEnvVar?: string | undefined;
+        envHeaders?: Record<string, string> | undefined;
+        credentialRef?: string | undefined;
+    }>, unknown>>;
+    /**
+     * User supplements for PLUGIN-provided MCP servers, keyed by the server's
+     * `<plugin>:<server>` name. Layered onto the plugin config at merge time
+     * (mergePluginMcpServers). Only env/credential fields are accepted —
+     * command/args/url/transport are intentionally absent and `.strict()`
+     * rejects them, so a plugin update is never shadowed by a stale copy.
+     */
+    mcpServerOverrides: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodObject<{
+        env: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+        envVars: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        credentialRef: z.ZodOptional<z.ZodString>;
+        bearerTokenEnvVar: z.ZodOptional<z.ZodString>;
+        envHeaders: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+    }, "strict", z.ZodTypeAny, {
+        env?: Record<string, string> | undefined;
+        envVars?: string[] | undefined;
+        bearerTokenEnvVar?: string | undefined;
+        envHeaders?: Record<string, string> | undefined;
+        credentialRef?: string | undefined;
+    }, {
+        env?: Record<string, string> | undefined;
+        envVars?: string[] | undefined;
+        bearerTokenEnvVar?: string | undefined;
+        envHeaders?: Record<string, string> | undefined;
+        credentialRef?: string | undefined;
     }>>>;
     /**
      * Skill names hidden from the LLM. Names include the full
@@ -1086,6 +2207,82 @@ export declare const SettingsSchema: z.ZodObject<{
      * names (no colon suffix). See scanSkills(opts.disabledPlugins).
      */
     disabledPlugins: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+    /**
+     * Sub-agent role names (the `name` in .code-shell/agents/*.md) to
+     * hide from the registry. A disabled role is filtered out at load
+     * so it never appears in registry.list()/get() — the Agent tool's
+     * agent_type list won't show it and the LLM can't pick it. Mirrors
+     * disabledSkills / disabledPlugins.
+     */
+    disabledAgents: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+    /**
+     * Project-scoped tri-state capability overlay. Only meaningful in
+     * ${cwd}/.code-shell/settings.json; layered over the global baseline at
+     * capability-assembly time. Optional — absence === everything inherits.
+     */
+    capabilityOverrides: z.ZodOptional<z.ZodObject<{
+        skills: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodEnum<["inherit", "on", "off"]>>>;
+        plugins: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodEnum<["inherit", "on", "off"]>>>;
+        agents: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodEnum<["inherit", "on", "off"]>>>;
+        mcp: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodEnum<["inherit", "on", "off"]>>>;
+        builtin: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodEnum<["inherit", "on", "off"]>>>;
+        /**
+         * Per-hook overlay for PLUGIN-provided hooks, keyed by
+         * `pluginHookKey()` (`<plugin>:<RawEvent>:<command>`). Finer-grained
+         * than `plugins` (which kills a whole plugin): "off" suppresses one
+         * hook for this project only. Only "off" is meaningful today — plugin
+         * hooks have no global disable list to force back "on" from.
+         */
+        pluginHooks: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodEnum<["inherit", "on", "off"]>>>;
+    }, "strip", z.ZodTypeAny, {
+        builtin?: Record<string, "off" | "on" | "inherit"> | undefined;
+        mcp?: Record<string, "off" | "on" | "inherit"> | undefined;
+        skills?: Record<string, "off" | "on" | "inherit"> | undefined;
+        plugins?: Record<string, "off" | "on" | "inherit"> | undefined;
+        agents?: Record<string, "off" | "on" | "inherit"> | undefined;
+        pluginHooks?: Record<string, "off" | "on" | "inherit"> | undefined;
+    }, {
+        builtin?: Record<string, "off" | "on" | "inherit"> | undefined;
+        mcp?: Record<string, "off" | "on" | "inherit"> | undefined;
+        skills?: Record<string, "off" | "on" | "inherit"> | undefined;
+        plugins?: Record<string, "off" | "on" | "inherit"> | undefined;
+        agents?: Record<string, "off" | "on" | "inherit"> | undefined;
+        pluginHooks?: Record<string, "off" | "on" | "inherit"> | undefined;
+    }>>;
+    /**
+     * Feature flags overlay: a map of flag name → boolean that overrides the
+     * compiled-in defaults (see settings/feature-flags.ts FEATURE_FLAGS).
+     * Project settings override user settings via the normal merge, so a flag
+     * can be flipped per-workspace. Unknown flag names are tolerated (kept as
+     * data) for forward-compat; consumers only read known flags via
+     * isFeatureEnabled(). Passthrough record — values coerced to boolean.
+     */
+    featureFlags: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodBoolean>>;
+    /**
+     * Cross-session memory knobs. Optional — absence keeps the built-in
+     * defaults (see services/extract-memories.ts). `maxCount` caps memories
+     * accepted per extraction pass; `maxAge`/`extractionModel` are reserved
+     * for the consolidation/extraction pipeline.
+     */
+    memories: z.ZodOptional<z.ZodObject<{
+        maxCount: z.ZodOptional<z.ZodNumber>;
+        maxAge: z.ZodOptional<z.ZodNumber>;
+        extractionModel: z.ZodOptional<z.ZodString>;
+        /** Master switch for end-of-session automatic memory extraction.
+         *  Absent/true = extract (current behavior); false = skip extraction
+         *  while keeping session summaries and Dream untouched. */
+        autoExtract: z.ZodOptional<z.ZodBoolean>;
+    }, "strip", z.ZodTypeAny, {
+        maxCount?: number | undefined;
+        maxAge?: number | undefined;
+        extractionModel?: string | undefined;
+        autoExtract?: boolean | undefined;
+    }, {
+        maxCount?: number | undefined;
+        maxAge?: number | undefined;
+        extractionModel?: string | undefined;
+        autoExtract?: boolean | undefined;
+    }>>;
     instructions: z.ZodDefault<z.ZodObject<{
         fileName: z.ZodDefault<z.ZodString>;
         scanDirs: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
@@ -1110,30 +2307,30 @@ export declare const SettingsSchema: z.ZodObject<{
             apiKey: z.ZodOptional<z.ZodString>;
             baseUrl: z.ZodOptional<z.ZodString>;
         }, "strip", z.ZodTypeAny, {
-            model: string;
             name: string;
+            model: string;
             provider?: string | undefined;
             baseUrl?: string | undefined;
             apiKey?: string | undefined;
         }, {
-            model: string;
             name: string;
+            model: string;
             provider?: string | undefined;
             baseUrl?: string | undefined;
             apiKey?: string | undefined;
         }>]>, "many">>;
     }, "strip", z.ZodTypeAny, {
         participants: (string | {
-            model: string;
             name: string;
+            model: string;
             provider?: string | undefined;
             baseUrl?: string | undefined;
             apiKey?: string | undefined;
         })[];
     }, {
         participants?: (string | {
-            model: string;
             name: string;
+            model: string;
             provider?: string | undefined;
             baseUrl?: string | undefined;
             apiKey?: string | undefined;
@@ -1153,12 +2350,45 @@ export declare const SettingsSchema: z.ZodObject<{
         providers: z.ZodOptional<z.ZodRecord<z.ZodEnum<["serper", "tavily", "searxng"]>, z.ZodObject<{
             apiKey: z.ZodOptional<z.ZodString>;
             baseUrl: z.ZodOptional<z.ZodString>;
+            lastProbe: z.ZodOptional<z.ZodObject<{
+                status: z.ZodEnum<["ok", "error", "unconfigured"]>;
+                sampleTitles: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+                errorMessage: z.ZodOptional<z.ZodString>;
+                errorDetail: z.ZodOptional<z.ZodString>;
+                lastProbedAt: z.ZodString;
+            }, "strip", z.ZodTypeAny, {
+                status: "error" | "ok" | "unconfigured";
+                lastProbedAt: string;
+                sampleTitles?: string[] | undefined;
+                errorMessage?: string | undefined;
+                errorDetail?: string | undefined;
+            }, {
+                status: "error" | "ok" | "unconfigured";
+                lastProbedAt: string;
+                sampleTitles?: string[] | undefined;
+                errorMessage?: string | undefined;
+                errorDetail?: string | undefined;
+            }>>;
         }, "strip", z.ZodTypeAny, {
             baseUrl?: string | undefined;
             apiKey?: string | undefined;
+            lastProbe?: {
+                status: "error" | "ok" | "unconfigured";
+                lastProbedAt: string;
+                sampleTitles?: string[] | undefined;
+                errorMessage?: string | undefined;
+                errorDetail?: string | undefined;
+            } | undefined;
         }, {
             baseUrl?: string | undefined;
             apiKey?: string | undefined;
+            lastProbe?: {
+                status: "error" | "ok" | "unconfigured";
+                lastProbedAt: string;
+                sampleTitles?: string[] | undefined;
+                errorMessage?: string | undefined;
+                errorDetail?: string | undefined;
+            } | undefined;
         }>>>;
     }, "strip", z.ZodTypeAny, {
         provider: "serper" | "tavily" | "searxng";
@@ -1167,6 +2397,13 @@ export declare const SettingsSchema: z.ZodObject<{
         providers?: Partial<Record<"serper" | "tavily" | "searxng", {
             baseUrl?: string | undefined;
             apiKey?: string | undefined;
+            lastProbe?: {
+                status: "error" | "ok" | "unconfigured";
+                lastProbedAt: string;
+                sampleTitles?: string[] | undefined;
+                errorMessage?: string | undefined;
+                errorDetail?: string | undefined;
+            } | undefined;
         }>> | undefined;
     }, {
         provider?: "serper" | "tavily" | "searxng" | undefined;
@@ -1175,6 +2412,13 @@ export declare const SettingsSchema: z.ZodObject<{
         providers?: Partial<Record<"serper" | "tavily" | "searxng", {
             baseUrl?: string | undefined;
             apiKey?: string | undefined;
+            lastProbe?: {
+                status: "error" | "ok" | "unconfigured";
+                lastProbedAt: string;
+                sampleTitles?: string[] | undefined;
+                errorMessage?: string | undefined;
+                errorDetail?: string | undefined;
+            } | undefined;
         }>> | undefined;
     }>>;
     output: z.ZodDefault<z.ZodObject<{
@@ -1184,6 +2428,26 @@ export declare const SettingsSchema: z.ZodObject<{
     }, {
         format?: "text" | "json" | "jsonl" | "stream-json" | undefined;
     }>>;
+    /**
+     * Image attachment handling. Sub-fields:
+     *   - detail: provider-agnostic image clarity. Drives the
+     *     renderer-side downscale (low→~1024 / standard→~1568 /
+     *     high→~2576 px long edge) so BOTH providers save tokens
+     *     before send. Legacy "original" is migrated to "high".
+     *   - mcpImageTokenBudget: per-turn cap on token cost of images
+     *     returned by MCP tools. Codex doesn't enforce this; CC uses
+     *     25 000. Set to 0 to disable.
+     */
+    images: z.ZodOptional<z.ZodObject<{
+        detail: z.ZodOptional<z.ZodEffects<z.ZodEnum<["low", "standard", "high"]>, "low" | "high" | "standard", unknown>>;
+        mcpImageTokenBudget: z.ZodOptional<z.ZodNumber>;
+    }, "strip", z.ZodTypeAny, {
+        detail?: "low" | "high" | "standard" | undefined;
+        mcpImageTokenBudget?: number | undefined;
+    }, {
+        detail?: unknown;
+        mcpImageTokenBudget?: number | undefined;
+    }>>;
     /**
      * OS-level sandbox for shell-tool execution. "auto" picks per platform:
      * Seatbelt on macOS, bubblewrap on Linux when installed, otherwise off.
@@ -1196,16 +2460,103 @@ export declare const SettingsSchema: z.ZodObject<{
         deniedReads: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
         network: z.ZodOptional<z.ZodEnum<["allow", "deny"]>>;
     }, "strip", z.ZodTypeAny, {
-        mode?: "auto" | "seatbelt" | "bwrap" | "off" | undefined;
+        mode?: "auto" | "off" | "seatbelt" | "bwrap" | undefined;
         writableRoots?: string[] | undefined;
         deniedReads?: string[] | undefined;
         network?: "allow" | "deny" | undefined;
     }, {
-        mode?: "auto" | "seatbelt" | "bwrap" | "off" | undefined;
+        mode?: "auto" | "off" | "seatbelt" | "bwrap" | undefined;
         writableRoots?: string[] | undefined;
         deniedReads?: string[] | undefined;
         network?: "allow" | "deny" | undefined;
     }>>;
+    /**
+     * Top-level environment variables injected into tool subprocesses (the
+     * Bash tool, background shells). Mirrors Claude Code's `env` field: a
+     * KEY=VALUE map that can be set globally (~/.code-shell/settings.json) and
+     * overridden per-project (.code-shell/settings.json). The canonical home
+     * for API keys (e.g. OPENAI_API_KEY) that a skill's script reads — configure
+     * once globally and every project's skills can use it.
+     *
+     * Precedence when merged into the spawn env (lowest → highest):
+     *   project localEnvironment.env  →  global env  →  project env
+     * None of these is filtered through the deny regex (see mergeShellEnv):
+     * they are values the user typed deliberately, a different trust class from
+     * the host process.env passthrough the deny machinery guards against.
+     */
+    env: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+    /**
+     * Project-local environment profile. Mirrors Codex's local-environment
+     * shape at the settings layer: setup/cleanup scripts can be customized per
+     * platform, and env values are stored as KEY=VALUE pairs. Runtime wiring is
+     * intentionally separate from the MCP server env model above.
+     */
+    localEnvironment: z.ZodOptional<z.ZodObject<{
+        name: z.ZodOptional<z.ZodString>;
+        setupScripts: z.ZodOptional<z.ZodObject<{
+            default: z.ZodOptional<z.ZodString>;
+            macos: z.ZodOptional<z.ZodString>;
+            linux: z.ZodOptional<z.ZodString>;
+            windows: z.ZodOptional<z.ZodString>;
+        }, "strip", z.ZodTypeAny, {
+            default?: string | undefined;
+            linux?: string | undefined;
+            macos?: string | undefined;
+            windows?: string | undefined;
+        }, {
+            default?: string | undefined;
+            linux?: string | undefined;
+            macos?: string | undefined;
+            windows?: string | undefined;
+        }>>;
+        cleanupScripts: z.ZodOptional<z.ZodObject<{
+            default: z.ZodOptional<z.ZodString>;
+            macos: z.ZodOptional<z.ZodString>;
+            linux: z.ZodOptional<z.ZodString>;
+            windows: z.ZodOptional<z.ZodString>;
+        }, "strip", z.ZodTypeAny, {
+            default?: string | undefined;
+            linux?: string | undefined;
+            macos?: string | undefined;
+            windows?: string | undefined;
+        }, {
+            default?: string | undefined;
+            linux?: string | undefined;
+            macos?: string | undefined;
+            windows?: string | undefined;
+        }>>;
+        env: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+    }, "strip", z.ZodTypeAny, {
+        name?: string | undefined;
+        env?: Record<string, string> | undefined;
+        setupScripts?: {
+            default?: string | undefined;
+            linux?: string | undefined;
+            macos?: string | undefined;
+            windows?: string | undefined;
+        } | undefined;
+        cleanupScripts?: {
+            default?: string | undefined;
+            linux?: string | undefined;
+            macos?: string | undefined;
+            windows?: string | undefined;
+        } | undefined;
+    }, {
+        name?: string | undefined;
+        env?: Record<string, string> | undefined;
+        setupScripts?: {
+            default?: string | undefined;
+            linux?: string | undefined;
+            macos?: string | undefined;
+            windows?: string | undefined;
+        } | undefined;
+        cleanupScripts?: {
+            default?: string | undefined;
+            linux?: string | undefined;
+            macos?: string | undefined;
+            windows?: string | undefined;
+        } | undefined;
+    }>>;
     /**
      * Shell-hook configuration. Each entry binds a HookEventName to a
      * shell command; the command receives ctx JSON on stdin and returns
@@ -1222,19 +2573,99 @@ export declare const SettingsSchema: z.ZodObject<{
         matcher: z.ZodOptional<z.ZodString>;
         timeout_ms: z.ZodOptional<z.ZodNumber>;
         cwd: z.ZodOptional<z.ZodString>;
+        /** Soft off-switch: the entry stays in the file (and the UI) but
+         *  registerSettingsHooks skips it. Absent = enabled. */
+        disabled: z.ZodOptional<z.ZodBoolean>;
     }, "strip", z.ZodTypeAny, {
         command: string;
         event: string;
-        cwd?: string | undefined;
+        disabled?: boolean | undefined;
         matcher?: string | undefined;
         timeout_ms?: number | undefined;
+        cwd?: string | undefined;
     }, {
         command: string;
         event: string;
-        cwd?: string | undefined;
+        disabled?: boolean | undefined;
         matcher?: string | undefined;
         timeout_ms?: number | undefined;
+        cwd?: string | undefined;
     }>, "many">>;
+    /**
+     * External coding-agent orchestration (Claude Code / Codex CLI).
+     * Used by the Mobile Web Remote to launch managed jobs. dangerousArgs
+     * is config-provided (not hardcoded) so it tracks CLI flag changes;
+     * project-default dangerous mode only applies inside trustedWorkspaces.
+     */
+    externalAgents: z.ZodOptional<z.ZodObject<{
+        claudeCode: z.ZodOptional<z.ZodObject<{
+            command: z.ZodOptional<z.ZodString>;
+            defaultMode: z.ZodOptional<z.ZodEnum<["safe", "dangerous"]>>;
+            dangerousArgs: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+            trustedWorkspaces: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+            autoStartInTrustedWorkspaces: z.ZodOptional<z.ZodBoolean>;
+        }, "strip", z.ZodTypeAny, {
+            defaultMode?: "safe" | "dangerous" | undefined;
+            command?: string | undefined;
+            dangerousArgs?: string[] | undefined;
+            trustedWorkspaces?: string[] | undefined;
+            autoStartInTrustedWorkspaces?: boolean | undefined;
+        }, {
+            defaultMode?: "safe" | "dangerous" | undefined;
+            command?: string | undefined;
+            dangerousArgs?: string[] | undefined;
+            trustedWorkspaces?: string[] | undefined;
+            autoStartInTrustedWorkspaces?: boolean | undefined;
+        }>>;
+        codex: z.ZodOptional<z.ZodObject<{
+            command: z.ZodOptional<z.ZodString>;
+            args: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        }, "strip", z.ZodTypeAny, {
+            args?: string[] | undefined;
+            command?: string | undefined;
+        }, {
+            args?: string[] | undefined;
+            command?: string | undefined;
+        }>>;
+    }, "strip", z.ZodTypeAny, {
+        claudeCode?: {
+            defaultMode?: "safe" | "dangerous" | undefined;
+            command?: string | undefined;
+            dangerousArgs?: string[] | undefined;
+            trustedWorkspaces?: string[] | undefined;
+            autoStartInTrustedWorkspaces?: boolean | undefined;
+        } | undefined;
+        codex?: {
+            args?: string[] | undefined;
+            command?: string | undefined;
+        } | undefined;
+    }, {
+        claudeCode?: {
+            defaultMode?: "safe" | "dangerous" | undefined;
+            command?: string | undefined;
+            dangerousArgs?: string[] | undefined;
+            trustedWorkspaces?: string[] | undefined;
+            autoStartInTrustedWorkspaces?: boolean | undefined;
+        } | undefined;
+        codex?: {
+            args?: string[] | undefined;
+            command?: string | undefined;
+        } | undefined;
+    }>>;
+    /**
+     * Credential-use gate (凭证模块第二期). Controls whether the AI's
+     * `UseCredential` tool prompts before handing a stored credential to a
+     * command. `autoApprove: true` skips the prompt entirely (默认关 — every
+     * use asks, or is remembered for the session). See
+     * docs/superpowers/specs/2026-06-16-credential-use-gate-design.md §5.
+     */
+    credentialUse: z.ZodOptional<z.ZodObject<{
+        autoApprove: z.ZodOptional<z.ZodBoolean>;
+    }, "strip", z.ZodTypeAny, {
+        autoApprove?: boolean | undefined;
+    }, {
+        autoApprove?: boolean | undefined;
+    }>>;
 }, z.ZodTypeAny, "passthrough">>;
 export type ValidatedSettings = z.infer<typeof SettingsSchema>;
 export declare function validateSettings(raw: unknown): ValidatedSettings;