@cjhyy/code-shell-core 0.7.1 → 0.8.0

package/dist/settings/schema.d.ts

@@ -20,6 +20,8 @@ export declare const CapabilityOverridesSchema: z.ZodOptional<z.ZodObject<{
     agents: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodEnum<["inherit", "on", "off"]>>>;
     mcp: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodEnum<["inherit", "on", "off"]>>>;
     builtin: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodEnum<["inherit", "on", "off"]>>>;
+    /** Per-project Pet capability preferences layered over the user baseline. */
+    pet: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodEnum<["inherit", "on", "off"]>>>;
     /**
      * Per-hook overlay for PLUGIN-provided hooks, keyed by
      * `pluginHookKey()` (`<plugin>:<RawEvent>:<command>`). Finer-grained
@@ -34,6 +36,7 @@ export declare const CapabilityOverridesSchema: z.ZodOptional<z.ZodObject<{
     skills?: Record<string, "off" | "on" | "inherit"> | undefined;
     plugins?: Record<string, "off" | "on" | "inherit"> | undefined;
     agents?: Record<string, "off" | "on" | "inherit"> | undefined;
+    pet?: Record<string, "off" | "on" | "inherit"> | undefined;
     pluginHooks?: Record<string, "off" | "on" | "inherit"> | undefined;
 }, {
     builtin?: Record<string, "off" | "on" | "inherit"> | undefined;
@@ -41,12 +44,13 @@ export declare const CapabilityOverridesSchema: z.ZodOptional<z.ZodObject<{
     skills?: Record<string, "off" | "on" | "inherit"> | undefined;
     plugins?: Record<string, "off" | "on" | "inherit"> | undefined;
     agents?: Record<string, "off" | "on" | "inherit"> | undefined;
+    pet?: Record<string, "off" | "on" | "inherit"> | undefined;
     pluginHooks?: Record<string, "off" | "on" | "inherit"> | undefined;
 }>>;
 export type CapabilityOverrides = z.infer<typeof CapabilityOverridesSchema>;
 export declare const SettingsSchema: z.ZodObject<{
     agent: z.ZodDefault<z.ZodObject<{
-        preset: z.ZodDefault<z.ZodString>;
+        preset: z.ZodOptional<z.ZodString>;
         enabledBuiltinTools: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
         disabledBuiltinTools: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
         customSystemPrompt: z.ZodOptional<z.ZodString>;
@@ -64,9 +68,9 @@ export declare const SettingsSchema: z.ZodObject<{
             compatCodex?: boolean | undefined;
         }>>;
     }, "strip", z.ZodTypeAny, {
-        preset: string;
         enabledBuiltinTools: string[];
         disabledBuiltinTools: string[];
+        preset?: string | undefined;
         customSystemPrompt?: string | undefined;
         appendSystemPrompt?: string | undefined;
         responseLanguage?: string | undefined;
@@ -96,6 +100,33 @@ export declare const SettingsSchema: z.ZodObject<{
      * Can also be disabled via env var `DISABLE_AUTOUPDATER=1`.
      */
     autoUpdates: z.ZodDefault<z.ZodBoolean>;
+    /**
+     * Pet (Mimi) global-view preferences.
+     */
+    pet: z.ZodDefault<z.ZodObject<{
+        /**
+         * Show external Codex CLI/App sessions in the Pet global view. When off,
+         * the host does not scan or tail Codex session files at all. Default off.
+         */
+        showExternalCodexSessions: z.ZodDefault<z.ZodBoolean>;
+        /** Same, for external Claude Code CLI sessions. Default off. */
+        showExternalClaudeSessions: z.ZodDefault<z.ZodBoolean>;
+        /**
+         * Auto-extract durable memories + an event-journal entry from each closed
+         * Mimi topic segment. When off, segment closure still archives the model
+         * context (so it cannot grow without bound) but writes no journal/memory.
+         * Default on.
+         */
+        memoryAutoExtract: z.ZodDefault<z.ZodBoolean>;
+    }, "strip", z.ZodTypeAny, {
+        showExternalCodexSessions: boolean;
+        showExternalClaudeSessions: boolean;
+        memoryAutoExtract: boolean;
+    }, {
+        showExternalCodexSessions?: boolean | undefined;
+        showExternalClaudeSessions?: boolean | undefined;
+        memoryAutoExtract?: boolean | undefined;
+    }>>;
     /**
      * Image generation is a general capability, decoupled from LLM providers
      * (TODO 7.1): a vendor may use different keys/endpoints/models for chat vs
@@ -269,16 +300,16 @@ export declare const SettingsSchema: z.ZodObject<{
     }, "strip", z.ZodTypeAny, {
         id: string;
         model: string;
-        catalogId: string;
         tag: "text" | "image" | "video" | "audio";
+        catalogId: string;
         baseUrl?: string | undefined;
         credentialId?: string | undefined;
         paramValues?: Record<string, unknown> | undefined;
     }, {
         id: string;
         model: string;
-        catalogId: string;
         tag: "text" | "image" | "video" | "audio";
+        catalogId: string;
         baseUrl?: string | undefined;
         credentialId?: string | undefined;
         paramValues?: Record<string, unknown> | undefined;
@@ -324,21 +355,21 @@ export declare const SettingsSchema: z.ZodObject<{
             argsPattern?: Record<string, string> | undefined;
         }>, "many">>;
     }, "strip", z.ZodTypeAny, {
-        defaultMode: "auto" | "default" | "acceptEdits" | "dontAsk" | "bypassPermissions" | "plan";
         rules: {
             tool: string;
             decision: "allow" | "deny" | "ask";
             reason?: string | undefined;
             argsPattern?: Record<string, string> | undefined;
         }[];
+        defaultMode: "default" | "auto" | "acceptEdits" | "dontAsk" | "bypassPermissions" | "plan";
     }, {
-        defaultMode?: "auto" | "default" | "acceptEdits" | "dontAsk" | "bypassPermissions" | "plan" | undefined;
         rules?: {
             tool: string;
             decision: "allow" | "deny" | "ask";
             reason?: string | undefined;
             argsPattern?: Record<string, string> | undefined;
         }[] | undefined;
+        defaultMode?: "default" | "auto" | "acceptEdits" | "dontAsk" | "bypassPermissions" | "plan" | undefined;
     }>>;
     context: z.ZodDefault<z.ZodObject<{
         maxTokens: z.ZodDefault<z.ZodNumber>;
@@ -386,71 +417,88 @@ export declare const SettingsSchema: z.ZodObject<{
         envHeaders: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
         credentialRef: z.ZodOptional<z.ZodString>;
         enabled: z.ZodOptional<z.ZodBoolean>;
+        allowedTools: z.ZodOptional<z.ZodArray<z.ZodEffects<z.ZodString, string, string>, "many">>;
+        disabledTools: z.ZodOptional<z.ZodArray<z.ZodEffects<z.ZodString, string, string>, "many">>;
     }, "strip", z.ZodTypeAny, {
         name: string;
         enabled?: boolean | undefined;
         url?: string | undefined;
         args?: string[] | undefined;
         command?: string | undefined;
+        credentialRef?: string | undefined;
         env?: Record<string, string> | undefined;
         transport?: "stdio" | "sse" | "streamable-http" | "inprocess" | undefined;
         headers?: Record<string, string> | undefined;
         envVars?: string[] | undefined;
         bearerTokenEnvVar?: string | undefined;
         envHeaders?: Record<string, string> | undefined;
-        credentialRef?: string | undefined;
+        allowedTools?: string[] | undefined;
+        disabledTools?: string[] | undefined;
     }, {
         name: string;
         enabled?: boolean | undefined;
         url?: string | undefined;
         args?: string[] | undefined;
         command?: string | undefined;
+        credentialRef?: string | undefined;
         env?: Record<string, string> | undefined;
         transport?: "stdio" | "sse" | "streamable-http" | "inprocess" | undefined;
         headers?: Record<string, string> | undefined;
         envVars?: string[] | undefined;
         bearerTokenEnvVar?: string | undefined;
         envHeaders?: Record<string, string> | undefined;
-        credentialRef?: string | undefined;
+        allowedTools?: string[] | undefined;
+        disabledTools?: string[] | undefined;
     }>>, Record<string, {
         name: string;
         enabled?: boolean | undefined;
         url?: string | undefined;
         args?: string[] | undefined;
         command?: string | undefined;
+        credentialRef?: string | undefined;
         env?: Record<string, string> | undefined;
         transport?: "stdio" | "sse" | "streamable-http" | "inprocess" | undefined;
         headers?: Record<string, string> | undefined;
         envVars?: string[] | undefined;
         bearerTokenEnvVar?: string | undefined;
         envHeaders?: Record<string, string> | undefined;
-        credentialRef?: string | undefined;
+        allowedTools?: string[] | undefined;
+        disabledTools?: string[] | undefined;
     }>, unknown>>;
     /**
-     * User supplements for PLUGIN-provided MCP servers, keyed by the server's
-     * `<plugin>:<server>` name. Layered onto the plugin config at merge time
-     * (mergePluginMcpServers). Only env/credential fields are accepted —
-     * command/args/url/transport are intentionally absent and `.strict()`
-     * rejects them, so a plugin update is never shadowed by a stale copy.
+     * User policy/supplements for PLUGIN-provided MCP servers, keyed by the
+     * server's `<plugin>:<server>` name. Layered onto the plugin config at merge
+     * time (mergePluginMcpServers). Only server/tool policy + env/credential
+     * fields are accepted — command/args/url/transport are intentionally absent and
+     * `.strict()` rejects them, so an update is never shadowed by a stale copy.
      */
     mcpServerOverrides: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodObject<{
+        enabled: z.ZodOptional<z.ZodBoolean>;
+        allowedTools: z.ZodOptional<z.ZodArray<z.ZodEffects<z.ZodString, string, string>, "many">>;
+        disabledTools: z.ZodOptional<z.ZodArray<z.ZodEffects<z.ZodString, string, string>, "many">>;
         env: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
         envVars: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
         credentialRef: z.ZodOptional<z.ZodString>;
         bearerTokenEnvVar: z.ZodOptional<z.ZodString>;
         envHeaders: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
     }, "strict", z.ZodTypeAny, {
+        enabled?: boolean | undefined;
+        credentialRef?: string | undefined;
         env?: Record<string, string> | undefined;
         envVars?: string[] | undefined;
         bearerTokenEnvVar?: string | undefined;
         envHeaders?: Record<string, string> | undefined;
-        credentialRef?: string | undefined;
+        allowedTools?: string[] | undefined;
+        disabledTools?: string[] | undefined;
     }, {
+        enabled?: boolean | undefined;
+        credentialRef?: string | undefined;
         env?: Record<string, string> | undefined;
         envVars?: string[] | undefined;
         bearerTokenEnvVar?: string | undefined;
         envHeaders?: Record<string, string> | undefined;
-        credentialRef?: string | undefined;
+        allowedTools?: string[] | undefined;
+        disabledTools?: string[] | undefined;
     }>>>;
     /**
      * Skill names hidden from the LLM. Names include the full
@@ -466,6 +514,19 @@ export declare const SettingsSchema: z.ZodObject<{
      * names (no colon suffix). See scanSkills(opts.disabledPlugins).
      */
     disabledPlugins: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+    /** Globally disabled Panel Apps, including their declared tools and bundled Skills. */
+    disabledPanelApps: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+    /**
+     * Explicit project binding for installed Panel Apps. Installed apps form a
+     * global catalog, but only IDs in this project-owned list contribute panel
+     * UI, Agent tools, bundled Skills, or project-scoped storage.
+     */
+    panelAppBindings: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+    /**
+     * Legacy per-project Panel App policy. `on` is read as an explicit binding
+     * during migration; new writes use panelAppBindings.
+     */
+    panelAppOverrides: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodEnum<["inherit", "on", "off"]>>>;
     /**
      * Sub-agent role names (the `name` in .code-shell/agents/*.md) to
      * hide from the registry. A disabled role is filtered out at load
@@ -485,6 +546,8 @@ export declare const SettingsSchema: z.ZodObject<{
         agents: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodEnum<["inherit", "on", "off"]>>>;
         mcp: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodEnum<["inherit", "on", "off"]>>>;
         builtin: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodEnum<["inherit", "on", "off"]>>>;
+        /** Per-project Pet capability preferences layered over the user baseline. */
+        pet: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodEnum<["inherit", "on", "off"]>>>;
         /**
          * Per-hook overlay for PLUGIN-provided hooks, keyed by
          * `pluginHookKey()` (`<plugin>:<RawEvent>:<command>`). Finer-grained
@@ -499,6 +562,7 @@ export declare const SettingsSchema: z.ZodObject<{
         skills?: Record<string, "off" | "on" | "inherit"> | undefined;
         plugins?: Record<string, "off" | "on" | "inherit"> | undefined;
         agents?: Record<string, "off" | "on" | "inherit"> | undefined;
+        pet?: Record<string, "off" | "on" | "inherit"> | undefined;
         pluginHooks?: Record<string, "off" | "on" | "inherit"> | undefined;
     }, {
         builtin?: Record<string, "off" | "on" | "inherit"> | undefined;
@@ -506,8 +570,95 @@ export declare const SettingsSchema: z.ZodObject<{
         skills?: Record<string, "off" | "on" | "inherit"> | undefined;
         plugins?: Record<string, "off" | "on" | "inherit"> | undefined;
         agents?: Record<string, "off" | "on" | "inherit"> | undefined;
+        pet?: Record<string, "off" | "on" | "inherit"> | undefined;
         pluginHooks?: Record<string, "off" | "on" | "inherit"> | undefined;
     }>>;
+    /**
+     * 由 WorkspaceProfile 激活事务整体拥有的子树（profile/activation.ts）。
+     * 激活/切换 = 原子全量重写本子树；关闭 = 删除本子树。
+     * `overrides` 是 profile 声明展开的 force-enable 快照，折叠时排在
+     * 用户手写 capabilityOverrides 之下（用户按 key 永远赢，见 overlay.ts
+     * 的 effectiveProjectOverrides）。只存在于 PROJECT settings。
+     */
+    profile: z.ZodOptional<z.ZodObject<{
+        active: z.ZodString;
+        preset: z.ZodOptional<z.ZodString>;
+        overrides: z.ZodOptional<z.ZodObject<{
+            skills: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodEnum<["inherit", "on", "off"]>>>;
+            plugins: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodEnum<["inherit", "on", "off"]>>>;
+            agents: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodEnum<["inherit", "on", "off"]>>>;
+            mcp: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodEnum<["inherit", "on", "off"]>>>;
+            builtin: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodEnum<["inherit", "on", "off"]>>>;
+            /** Per-project Pet capability preferences layered over the user baseline. */
+            pet: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodEnum<["inherit", "on", "off"]>>>;
+            /**
+             * Per-hook overlay for PLUGIN-provided hooks, keyed by
+             * `pluginHookKey()` (`<plugin>:<RawEvent>:<command>`). Finer-grained
+             * than `plugins` (which kills a whole plugin): "off" suppresses one
+             * hook for this project only. Only "off" is meaningful today — plugin
+             * hooks have no global disable list to force back "on" from.
+             */
+            pluginHooks: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodEnum<["inherit", "on", "off"]>>>;
+        }, "strip", z.ZodTypeAny, {
+            builtin?: Record<string, "off" | "on" | "inherit"> | undefined;
+            mcp?: Record<string, "off" | "on" | "inherit"> | undefined;
+            skills?: Record<string, "off" | "on" | "inherit"> | undefined;
+            plugins?: Record<string, "off" | "on" | "inherit"> | undefined;
+            agents?: Record<string, "off" | "on" | "inherit"> | undefined;
+            pet?: Record<string, "off" | "on" | "inherit"> | undefined;
+            pluginHooks?: Record<string, "off" | "on" | "inherit"> | undefined;
+        }, {
+            builtin?: Record<string, "off" | "on" | "inherit"> | undefined;
+            mcp?: Record<string, "off" | "on" | "inherit"> | undefined;
+            skills?: Record<string, "off" | "on" | "inherit"> | undefined;
+            plugins?: Record<string, "off" | "on" | "inherit"> | undefined;
+            agents?: Record<string, "off" | "on" | "inherit"> | undefined;
+            pet?: Record<string, "off" | "on" | "inherit"> | undefined;
+            pluginHooks?: Record<string, "off" | "on" | "inherit"> | undefined;
+        }>>;
+    }, "strip", z.ZodTypeAny, {
+        active: string;
+        preset?: string | undefined;
+        overrides?: {
+            builtin?: Record<string, "off" | "on" | "inherit"> | undefined;
+            mcp?: Record<string, "off" | "on" | "inherit"> | undefined;
+            skills?: Record<string, "off" | "on" | "inherit"> | undefined;
+            plugins?: Record<string, "off" | "on" | "inherit"> | undefined;
+            agents?: Record<string, "off" | "on" | "inherit"> | undefined;
+            pet?: Record<string, "off" | "on" | "inherit"> | undefined;
+            pluginHooks?: Record<string, "off" | "on" | "inherit"> | undefined;
+        } | undefined;
+    }, {
+        active: string;
+        preset?: string | undefined;
+        overrides?: {
+            builtin?: Record<string, "off" | "on" | "inherit"> | undefined;
+            mcp?: Record<string, "off" | "on" | "inherit"> | undefined;
+            skills?: Record<string, "off" | "on" | "inherit"> | undefined;
+            plugins?: Record<string, "off" | "on" | "inherit"> | undefined;
+            agents?: Record<string, "off" | "on" | "inherit"> | undefined;
+            pet?: Record<string, "off" | "on" | "inherit"> | undefined;
+            pluginHooks?: Record<string, "off" | "on" | "inherit"> | undefined;
+        } | undefined;
+    }>>;
+    /**
+     * Workspace 数据源绑定（只存 ref/scope/readPolicy，绝不存 secret）。
+     * 语义见 docs/todo/workspace-datasource-binding-adr.md §1.2。
+     * 只存在于 PROJECT settings。
+     */
+    sources: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        sourceId: z.ZodString;
+        scopes: z.ZodArray<z.ZodString, "many">;
+        readPolicy: z.ZodDefault<z.ZodEnum<["ask", "deny"]>>;
+    }, "strip", z.ZodTypeAny, {
+        sourceId: string;
+        scopes: string[];
+        readPolicy: "deny" | "ask";
+    }, {
+        sourceId: string;
+        scopes: string[];
+        readPolicy?: "deny" | "ask" | undefined;
+    }>, "many">>;
     /**
      * Feature flags overlay: a map of flag name → boolean that overrides the
      * compiled-in defaults (see settings/feature-flags.ts FEATURE_FLAGS).
@@ -558,43 +709,6 @@ export declare const SettingsSchema: z.ZodObject<{
         compatFileNames?: string[] | undefined;
         ignoreGitBoundary?: boolean | undefined;
     }>>;
-    arena: z.ZodDefault<z.ZodObject<{
-        participants: z.ZodDefault<z.ZodArray<z.ZodUnion<[z.ZodString, z.ZodObject<{
-            name: z.ZodString;
-            model: z.ZodString;
-            provider: z.ZodOptional<z.ZodString>;
-            apiKey: z.ZodOptional<z.ZodString>;
-            baseUrl: z.ZodOptional<z.ZodString>;
-        }, "strip", z.ZodTypeAny, {
-            name: string;
-            model: string;
-            provider?: string | undefined;
-            baseUrl?: string | undefined;
-            apiKey?: string | undefined;
-        }, {
-            name: string;
-            model: string;
-            provider?: string | undefined;
-            baseUrl?: string | undefined;
-            apiKey?: string | undefined;
-        }>]>, "many">>;
-    }, "strip", z.ZodTypeAny, {
-        participants: (string | {
-            name: string;
-            model: string;
-            provider?: string | undefined;
-            baseUrl?: string | undefined;
-            apiKey?: string | undefined;
-        })[];
-    }, {
-        participants?: (string | {
-            name: string;
-            model: string;
-            provider?: string | undefined;
-            baseUrl?: string | undefined;
-            apiKey?: string | undefined;
-        })[] | undefined;
-    }>>;
     search: z.ZodDefault<z.ZodObject<{
         provider: z.ZodDefault<z.ZodEnum<["serper", "tavily", "searxng"]>>;
         apiKey: z.ZodOptional<z.ZodString>;
@@ -839,16 +953,16 @@ export declare const SettingsSchema: z.ZodObject<{
         command: string;
         event: string;
         disabled?: boolean | undefined;
+        cwd?: string | undefined;
         matcher?: string | undefined;
         timeout_ms?: number | undefined;
-        cwd?: string | undefined;
     }, {
         command: string;
         event: string;
         disabled?: boolean | undefined;
+        cwd?: string | undefined;
         matcher?: string | undefined;
         timeout_ms?: number | undefined;
-        cwd?: string | undefined;
     }>, "many">>;
     /**
      * External coding-agent orchestration (Claude Code / Codex CLI).
@@ -864,14 +978,14 @@ export declare const SettingsSchema: z.ZodObject<{
             trustedWorkspaces: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
             autoStartInTrustedWorkspaces: z.ZodOptional<z.ZodBoolean>;
         }, "strip", z.ZodTypeAny, {
-            defaultMode?: "safe" | "dangerous" | undefined;
             command?: string | undefined;
+            defaultMode?: "dangerous" | "safe" | undefined;
             dangerousArgs?: string[] | undefined;
             trustedWorkspaces?: string[] | undefined;
             autoStartInTrustedWorkspaces?: boolean | undefined;
         }, {
-            defaultMode?: "safe" | "dangerous" | undefined;
             command?: string | undefined;
+            defaultMode?: "dangerous" | "safe" | undefined;
             dangerousArgs?: string[] | undefined;
             trustedWorkspaces?: string[] | undefined;
             autoStartInTrustedWorkspaces?: boolean | undefined;
@@ -888,8 +1002,8 @@ export declare const SettingsSchema: z.ZodObject<{
         }>>;
     }, "strip", z.ZodTypeAny, {
         claudeCode?: {
-            defaultMode?: "safe" | "dangerous" | undefined;
             command?: string | undefined;
+            defaultMode?: "dangerous" | "safe" | undefined;
             dangerousArgs?: string[] | undefined;
             trustedWorkspaces?: string[] | undefined;
             autoStartInTrustedWorkspaces?: boolean | undefined;
@@ -900,8 +1014,8 @@ export declare const SettingsSchema: z.ZodObject<{
         } | undefined;
     }, {
         claudeCode?: {
-            defaultMode?: "safe" | "dangerous" | undefined;
             command?: string | undefined;
+            defaultMode?: "dangerous" | "safe" | undefined;
             dangerousArgs?: string[] | undefined;
             trustedWorkspaces?: string[] | undefined;
             autoStartInTrustedWorkspaces?: boolean | undefined;
@@ -927,7 +1041,7 @@ export declare const SettingsSchema: z.ZodObject<{
     }>>;
 }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
     agent: z.ZodDefault<z.ZodObject<{
-        preset: z.ZodDefault<z.ZodString>;
+        preset: z.ZodOptional<z.ZodString>;
         enabledBuiltinTools: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
         disabledBuiltinTools: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
         customSystemPrompt: z.ZodOptional<z.ZodString>;
@@ -945,9 +1059,9 @@ export declare const SettingsSchema: z.ZodObject<{
             compatCodex?: boolean | undefined;
         }>>;
     }, "strip", z.ZodTypeAny, {
-        preset: string;
         enabledBuiltinTools: string[];
         disabledBuiltinTools: string[];
+        preset?: string | undefined;
         customSystemPrompt?: string | undefined;
         appendSystemPrompt?: string | undefined;
         responseLanguage?: string | undefined;
@@ -977,6 +1091,33 @@ export declare const SettingsSchema: z.ZodObject<{
      * Can also be disabled via env var `DISABLE_AUTOUPDATER=1`.
      */
     autoUpdates: z.ZodDefault<z.ZodBoolean>;
+    /**
+     * Pet (Mimi) global-view preferences.
+     */
+    pet: z.ZodDefault<z.ZodObject<{
+        /**
+         * Show external Codex CLI/App sessions in the Pet global view. When off,
+         * the host does not scan or tail Codex session files at all. Default off.
+         */
+        showExternalCodexSessions: z.ZodDefault<z.ZodBoolean>;
+        /** Same, for external Claude Code CLI sessions. Default off. */
+        showExternalClaudeSessions: z.ZodDefault<z.ZodBoolean>;
+        /**
+         * Auto-extract durable memories + an event-journal entry from each closed
+         * Mimi topic segment. When off, segment closure still archives the model
+         * context (so it cannot grow without bound) but writes no journal/memory.
+         * Default on.
+         */
+        memoryAutoExtract: z.ZodDefault<z.ZodBoolean>;
+    }, "strip", z.ZodTypeAny, {
+        showExternalCodexSessions: boolean;
+        showExternalClaudeSessions: boolean;
+        memoryAutoExtract: boolean;
+    }, {
+        showExternalCodexSessions?: boolean | undefined;
+        showExternalClaudeSessions?: boolean | undefined;
+        memoryAutoExtract?: boolean | undefined;
+    }>>;
     /**
      * Image generation is a general capability, decoupled from LLM providers
      * (TODO 7.1): a vendor may use different keys/endpoints/models for chat vs
@@ -1150,16 +1291,16 @@ export declare const SettingsSchema: z.ZodObject<{
     }, "strip", z.ZodTypeAny, {
         id: string;
         model: string;
-        catalogId: string;
         tag: "text" | "image" | "video" | "audio";
+        catalogId: string;
         baseUrl?: string | undefined;
         credentialId?: string | undefined;
         paramValues?: Record<string, unknown> | undefined;
     }, {
         id: string;
         model: string;
-        catalogId: string;
         tag: "text" | "image" | "video" | "audio";
+        catalogId: string;
         baseUrl?: string | undefined;
         credentialId?: string | undefined;
         paramValues?: Record<string, unknown> | undefined;
@@ -1205,21 +1346,21 @@ export declare const SettingsSchema: z.ZodObject<{
             argsPattern?: Record<string, string> | undefined;
         }>, "many">>;
     }, "strip", z.ZodTypeAny, {
-        defaultMode: "auto" | "default" | "acceptEdits" | "dontAsk" | "bypassPermissions" | "plan";
         rules: {
             tool: string;
             decision: "allow" | "deny" | "ask";
             reason?: string | undefined;
             argsPattern?: Record<string, string> | undefined;
         }[];
+        defaultMode: "default" | "auto" | "acceptEdits" | "dontAsk" | "bypassPermissions" | "plan";
     }, {
-        defaultMode?: "auto" | "default" | "acceptEdits" | "dontAsk" | "bypassPermissions" | "plan" | undefined;
         rules?: {
             tool: string;
             decision: "allow" | "deny" | "ask";
             reason?: string | undefined;
             argsPattern?: Record<string, string> | undefined;
         }[] | undefined;
+        defaultMode?: "default" | "auto" | "acceptEdits" | "dontAsk" | "bypassPermissions" | "plan" | undefined;
     }>>;
     context: z.ZodDefault<z.ZodObject<{
         maxTokens: z.ZodDefault<z.ZodNumber>;
@@ -1267,71 +1408,88 @@ export declare const SettingsSchema: z.ZodObject<{
         envHeaders: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
         credentialRef: z.ZodOptional<z.ZodString>;
         enabled: z.ZodOptional<z.ZodBoolean>;
+        allowedTools: z.ZodOptional<z.ZodArray<z.ZodEffects<z.ZodString, string, string>, "many">>;
+        disabledTools: z.ZodOptional<z.ZodArray<z.ZodEffects<z.ZodString, string, string>, "many">>;
     }, "strip", z.ZodTypeAny, {
         name: string;
         enabled?: boolean | undefined;
         url?: string | undefined;
         args?: string[] | undefined;
         command?: string | undefined;
+        credentialRef?: string | undefined;
         env?: Record<string, string> | undefined;
         transport?: "stdio" | "sse" | "streamable-http" | "inprocess" | undefined;
         headers?: Record<string, string> | undefined;
         envVars?: string[] | undefined;
         bearerTokenEnvVar?: string | undefined;
         envHeaders?: Record<string, string> | undefined;
-        credentialRef?: string | undefined;
+        allowedTools?: string[] | undefined;
+        disabledTools?: string[] | undefined;
     }, {
         name: string;
         enabled?: boolean | undefined;
         url?: string | undefined;
         args?: string[] | undefined;
         command?: string | undefined;
+        credentialRef?: string | undefined;
         env?: Record<string, string> | undefined;
         transport?: "stdio" | "sse" | "streamable-http" | "inprocess" | undefined;
         headers?: Record<string, string> | undefined;
         envVars?: string[] | undefined;
         bearerTokenEnvVar?: string | undefined;
         envHeaders?: Record<string, string> | undefined;
-        credentialRef?: string | undefined;
+        allowedTools?: string[] | undefined;
+        disabledTools?: string[] | undefined;
     }>>, Record<string, {
         name: string;
         enabled?: boolean | undefined;
         url?: string | undefined;
         args?: string[] | undefined;
         command?: string | undefined;
+        credentialRef?: string | undefined;
         env?: Record<string, string> | undefined;
         transport?: "stdio" | "sse" | "streamable-http" | "inprocess" | undefined;
         headers?: Record<string, string> | undefined;
         envVars?: string[] | undefined;
         bearerTokenEnvVar?: string | undefined;
         envHeaders?: Record<string, string> | undefined;
-        credentialRef?: string | undefined;
+        allowedTools?: string[] | undefined;
+        disabledTools?: string[] | undefined;
     }>, unknown>>;
     /**
-     * User supplements for PLUGIN-provided MCP servers, keyed by the server's
-     * `<plugin>:<server>` name. Layered onto the plugin config at merge time
-     * (mergePluginMcpServers). Only env/credential fields are accepted —
-     * command/args/url/transport are intentionally absent and `.strict()`
-     * rejects them, so a plugin update is never shadowed by a stale copy.
+     * User policy/supplements for PLUGIN-provided MCP servers, keyed by the
+     * server's `<plugin>:<server>` name. Layered onto the plugin config at merge
+     * time (mergePluginMcpServers). Only server/tool policy + env/credential
+     * fields are accepted — command/args/url/transport are intentionally absent and
+     * `.strict()` rejects them, so an update is never shadowed by a stale copy.
      */
     mcpServerOverrides: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodObject<{
+        enabled: z.ZodOptional<z.ZodBoolean>;
+        allowedTools: z.ZodOptional<z.ZodArray<z.ZodEffects<z.ZodString, string, string>, "many">>;
+        disabledTools: z.ZodOptional<z.ZodArray<z.ZodEffects<z.ZodString, string, string>, "many">>;
         env: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
         envVars: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
         credentialRef: z.ZodOptional<z.ZodString>;
         bearerTokenEnvVar: z.ZodOptional<z.ZodString>;
         envHeaders: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
     }, "strict", z.ZodTypeAny, {
+        enabled?: boolean | undefined;
+        credentialRef?: string | undefined;
         env?: Record<string, string> | undefined;
         envVars?: string[] | undefined;
         bearerTokenEnvVar?: string | undefined;
         envHeaders?: Record<string, string> | undefined;
-        credentialRef?: string | undefined;
+        allowedTools?: string[] | undefined;
+        disabledTools?: string[] | undefined;
     }, {
+        enabled?: boolean | undefined;
+        credentialRef?: string | undefined;
         env?: Record<string, string> | undefined;
         envVars?: string[] | undefined;
         bearerTokenEnvVar?: string | undefined;
         envHeaders?: Record<string, string> | undefined;
-        credentialRef?: string | undefined;
+        allowedTools?: string[] | undefined;
+        disabledTools?: string[] | undefined;
     }>>>;
     /**
      * Skill names hidden from the LLM. Names include the full
@@ -1347,6 +1505,19 @@ export declare const SettingsSchema: z.ZodObject<{
      * names (no colon suffix). See scanSkills(opts.disabledPlugins).
      */
     disabledPlugins: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+    /** Globally disabled Panel Apps, including their declared tools and bundled Skills. */
+    disabledPanelApps: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+    /**
+     * Explicit project binding for installed Panel Apps. Installed apps form a
+     * global catalog, but only IDs in this project-owned list contribute panel
+     * UI, Agent tools, bundled Skills, or project-scoped storage.
+     */
+    panelAppBindings: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+    /**
+     * Legacy per-project Panel App policy. `on` is read as an explicit binding
+     * during migration; new writes use panelAppBindings.
+     */
+    panelAppOverrides: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodEnum<["inherit", "on", "off"]>>>;
     /**
      * Sub-agent role names (the `name` in .code-shell/agents/*.md) to
      * hide from the registry. A disabled role is filtered out at load
@@ -1366,6 +1537,8 @@ export declare const SettingsSchema: z.ZodObject<{
         agents: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodEnum<["inherit", "on", "off"]>>>;
         mcp: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodEnum<["inherit", "on", "off"]>>>;
         builtin: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodEnum<["inherit", "on", "off"]>>>;
+        /** Per-project Pet capability preferences layered over the user baseline. */
+        pet: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodEnum<["inherit", "on", "off"]>>>;
         /**
          * Per-hook overlay for PLUGIN-provided hooks, keyed by
          * `pluginHookKey()` (`<plugin>:<RawEvent>:<command>`). Finer-grained
@@ -1380,6 +1553,7 @@ export declare const SettingsSchema: z.ZodObject<{
         skills?: Record<string, "off" | "on" | "inherit"> | undefined;
         plugins?: Record<string, "off" | "on" | "inherit"> | undefined;
         agents?: Record<string, "off" | "on" | "inherit"> | undefined;
+        pet?: Record<string, "off" | "on" | "inherit"> | undefined;
         pluginHooks?: Record<string, "off" | "on" | "inherit"> | undefined;
     }, {
         builtin?: Record<string, "off" | "on" | "inherit"> | undefined;
@@ -1387,8 +1561,95 @@ export declare const SettingsSchema: z.ZodObject<{
         skills?: Record<string, "off" | "on" | "inherit"> | undefined;
         plugins?: Record<string, "off" | "on" | "inherit"> | undefined;
         agents?: Record<string, "off" | "on" | "inherit"> | undefined;
+        pet?: Record<string, "off" | "on" | "inherit"> | undefined;
         pluginHooks?: Record<string, "off" | "on" | "inherit"> | undefined;
     }>>;
+    /**
+     * 由 WorkspaceProfile 激活事务整体拥有的子树（profile/activation.ts）。
+     * 激活/切换 = 原子全量重写本子树；关闭 = 删除本子树。
+     * `overrides` 是 profile 声明展开的 force-enable 快照，折叠时排在
+     * 用户手写 capabilityOverrides 之下（用户按 key 永远赢，见 overlay.ts
+     * 的 effectiveProjectOverrides）。只存在于 PROJECT settings。
+     */
+    profile: z.ZodOptional<z.ZodObject<{
+        active: z.ZodString;
+        preset: z.ZodOptional<z.ZodString>;
+        overrides: z.ZodOptional<z.ZodObject<{
+            skills: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodEnum<["inherit", "on", "off"]>>>;
+            plugins: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodEnum<["inherit", "on", "off"]>>>;
+            agents: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodEnum<["inherit", "on", "off"]>>>;
+            mcp: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodEnum<["inherit", "on", "off"]>>>;
+            builtin: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodEnum<["inherit", "on", "off"]>>>;
+            /** Per-project Pet capability preferences layered over the user baseline. */
+            pet: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodEnum<["inherit", "on", "off"]>>>;
+            /**
+             * Per-hook overlay for PLUGIN-provided hooks, keyed by
+             * `pluginHookKey()` (`<plugin>:<RawEvent>:<command>`). Finer-grained
+             * than `plugins` (which kills a whole plugin): "off" suppresses one
+             * hook for this project only. Only "off" is meaningful today — plugin
+             * hooks have no global disable list to force back "on" from.
+             */
+            pluginHooks: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodEnum<["inherit", "on", "off"]>>>;
+        }, "strip", z.ZodTypeAny, {
+            builtin?: Record<string, "off" | "on" | "inherit"> | undefined;
+            mcp?: Record<string, "off" | "on" | "inherit"> | undefined;
+            skills?: Record<string, "off" | "on" | "inherit"> | undefined;
+            plugins?: Record<string, "off" | "on" | "inherit"> | undefined;
+            agents?: Record<string, "off" | "on" | "inherit"> | undefined;
+            pet?: Record<string, "off" | "on" | "inherit"> | undefined;
+            pluginHooks?: Record<string, "off" | "on" | "inherit"> | undefined;
+        }, {
+            builtin?: Record<string, "off" | "on" | "inherit"> | undefined;
+            mcp?: Record<string, "off" | "on" | "inherit"> | undefined;
+            skills?: Record<string, "off" | "on" | "inherit"> | undefined;
+            plugins?: Record<string, "off" | "on" | "inherit"> | undefined;
+            agents?: Record<string, "off" | "on" | "inherit"> | undefined;
+            pet?: Record<string, "off" | "on" | "inherit"> | undefined;
+            pluginHooks?: Record<string, "off" | "on" | "inherit"> | undefined;
+        }>>;
+    }, "strip", z.ZodTypeAny, {
+        active: string;
+        preset?: string | undefined;
+        overrides?: {
+            builtin?: Record<string, "off" | "on" | "inherit"> | undefined;
+            mcp?: Record<string, "off" | "on" | "inherit"> | undefined;
+            skills?: Record<string, "off" | "on" | "inherit"> | undefined;
+            plugins?: Record<string, "off" | "on" | "inherit"> | undefined;
+            agents?: Record<string, "off" | "on" | "inherit"> | undefined;
+            pet?: Record<string, "off" | "on" | "inherit"> | undefined;
+            pluginHooks?: Record<string, "off" | "on" | "inherit"> | undefined;
+        } | undefined;
+    }, {
+        active: string;
+        preset?: string | undefined;
+        overrides?: {
+            builtin?: Record<string, "off" | "on" | "inherit"> | undefined;
+            mcp?: Record<string, "off" | "on" | "inherit"> | undefined;
+            skills?: Record<string, "off" | "on" | "inherit"> | undefined;
+            plugins?: Record<string, "off" | "on" | "inherit"> | undefined;
+            agents?: Record<string, "off" | "on" | "inherit"> | undefined;
+            pet?: Record<string, "off" | "on" | "inherit"> | undefined;
+            pluginHooks?: Record<string, "off" | "on" | "inherit"> | undefined;
+        } | undefined;
+    }>>;
+    /**
+     * Workspace 数据源绑定（只存 ref/scope/readPolicy，绝不存 secret）。
+     * 语义见 docs/todo/workspace-datasource-binding-adr.md §1.2。
+     * 只存在于 PROJECT settings。
+     */
+    sources: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        sourceId: z.ZodString;
+        scopes: z.ZodArray<z.ZodString, "many">;
+        readPolicy: z.ZodDefault<z.ZodEnum<["ask", "deny"]>>;
+    }, "strip", z.ZodTypeAny, {
+        sourceId: string;
+        scopes: string[];
+        readPolicy: "deny" | "ask";
+    }, {
+        sourceId: string;
+        scopes: string[];
+        readPolicy?: "deny" | "ask" | undefined;
+    }>, "many">>;
     /**
      * Feature flags overlay: a map of flag name → boolean that overrides the
      * compiled-in defaults (see settings/feature-flags.ts FEATURE_FLAGS).
@@ -1439,43 +1700,6 @@ export declare const SettingsSchema: z.ZodObject<{
         compatFileNames?: string[] | undefined;
         ignoreGitBoundary?: boolean | undefined;
     }>>;
-    arena: z.ZodDefault<z.ZodObject<{
-        participants: z.ZodDefault<z.ZodArray<z.ZodUnion<[z.ZodString, z.ZodObject<{
-            name: z.ZodString;
-            model: z.ZodString;
-            provider: z.ZodOptional<z.ZodString>;
-            apiKey: z.ZodOptional<z.ZodString>;
-            baseUrl: z.ZodOptional<z.ZodString>;
-        }, "strip", z.ZodTypeAny, {
-            name: string;
-            model: string;
-            provider?: string | undefined;
-            baseUrl?: string | undefined;
-            apiKey?: string | undefined;
-        }, {
-            name: string;
-            model: string;
-            provider?: string | undefined;
-            baseUrl?: string | undefined;
-            apiKey?: string | undefined;
-        }>]>, "many">>;
-    }, "strip", z.ZodTypeAny, {
-        participants: (string | {
-            name: string;
-            model: string;
-            provider?: string | undefined;
-            baseUrl?: string | undefined;
-            apiKey?: string | undefined;
-        })[];
-    }, {
-        participants?: (string | {
-            name: string;
-            model: string;
-            provider?: string | undefined;
-            baseUrl?: string | undefined;
-            apiKey?: string | undefined;
-        })[] | undefined;
-    }>>;
     search: z.ZodDefault<z.ZodObject<{
         provider: z.ZodDefault<z.ZodEnum<["serper", "tavily", "searxng"]>>;
         apiKey: z.ZodOptional<z.ZodString>;
@@ -1720,16 +1944,16 @@ export declare const SettingsSchema: z.ZodObject<{
         command: string;
         event: string;
         disabled?: boolean | undefined;
+        cwd?: string | undefined;
         matcher?: string | undefined;
         timeout_ms?: number | undefined;
-        cwd?: string | undefined;
     }, {
         command: string;
         event: string;
         disabled?: boolean | undefined;
+        cwd?: string | undefined;
         matcher?: string | undefined;
         timeout_ms?: number | undefined;
-        cwd?: string | undefined;
     }>, "many">>;
     /**
      * External coding-agent orchestration (Claude Code / Codex CLI).
@@ -1745,14 +1969,14 @@ export declare const SettingsSchema: z.ZodObject<{
             trustedWorkspaces: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
             autoStartInTrustedWorkspaces: z.ZodOptional<z.ZodBoolean>;
         }, "strip", z.ZodTypeAny, {
-            defaultMode?: "safe" | "dangerous" | undefined;
             command?: string | undefined;
+            defaultMode?: "dangerous" | "safe" | undefined;
             dangerousArgs?: string[] | undefined;
             trustedWorkspaces?: string[] | undefined;
             autoStartInTrustedWorkspaces?: boolean | undefined;
         }, {
-            defaultMode?: "safe" | "dangerous" | undefined;
             command?: string | undefined;
+            defaultMode?: "dangerous" | "safe" | undefined;
             dangerousArgs?: string[] | undefined;
             trustedWorkspaces?: string[] | undefined;
             autoStartInTrustedWorkspaces?: boolean | undefined;
@@ -1769,8 +1993,8 @@ export declare const SettingsSchema: z.ZodObject<{
         }>>;
     }, "strip", z.ZodTypeAny, {
         claudeCode?: {
-            defaultMode?: "safe" | "dangerous" | undefined;
             command?: string | undefined;
+            defaultMode?: "dangerous" | "safe" | undefined;
             dangerousArgs?: string[] | undefined;
             trustedWorkspaces?: string[] | undefined;
             autoStartInTrustedWorkspaces?: boolean | undefined;
@@ -1781,8 +2005,8 @@ export declare const SettingsSchema: z.ZodObject<{
         } | undefined;
     }, {
         claudeCode?: {
-            defaultMode?: "safe" | "dangerous" | undefined;
             command?: string | undefined;
+            defaultMode?: "dangerous" | "safe" | undefined;
             dangerousArgs?: string[] | undefined;
             trustedWorkspaces?: string[] | undefined;
             autoStartInTrustedWorkspaces?: boolean | undefined;
@@ -1808,7 +2032,7 @@ export declare const SettingsSchema: z.ZodObject<{
     }>>;
 }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
     agent: z.ZodDefault<z.ZodObject<{
-        preset: z.ZodDefault<z.ZodString>;
+        preset: z.ZodOptional<z.ZodString>;
         enabledBuiltinTools: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
         disabledBuiltinTools: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
         customSystemPrompt: z.ZodOptional<z.ZodString>;
@@ -1826,9 +2050,9 @@ export declare const SettingsSchema: z.ZodObject<{
             compatCodex?: boolean | undefined;
         }>>;
     }, "strip", z.ZodTypeAny, {
-        preset: string;
         enabledBuiltinTools: string[];
         disabledBuiltinTools: string[];
+        preset?: string | undefined;
         customSystemPrompt?: string | undefined;
         appendSystemPrompt?: string | undefined;
         responseLanguage?: string | undefined;
@@ -1858,6 +2082,33 @@ export declare const SettingsSchema: z.ZodObject<{
      * Can also be disabled via env var `DISABLE_AUTOUPDATER=1`.
      */
     autoUpdates: z.ZodDefault<z.ZodBoolean>;
+    /**
+     * Pet (Mimi) global-view preferences.
+     */
+    pet: z.ZodDefault<z.ZodObject<{
+        /**
+         * Show external Codex CLI/App sessions in the Pet global view. When off,
+         * the host does not scan or tail Codex session files at all. Default off.
+         */
+        showExternalCodexSessions: z.ZodDefault<z.ZodBoolean>;
+        /** Same, for external Claude Code CLI sessions. Default off. */
+        showExternalClaudeSessions: z.ZodDefault<z.ZodBoolean>;
+        /**
+         * Auto-extract durable memories + an event-journal entry from each closed
+         * Mimi topic segment. When off, segment closure still archives the model
+         * context (so it cannot grow without bound) but writes no journal/memory.
+         * Default on.
+         */
+        memoryAutoExtract: z.ZodDefault<z.ZodBoolean>;
+    }, "strip", z.ZodTypeAny, {
+        showExternalCodexSessions: boolean;
+        showExternalClaudeSessions: boolean;
+        memoryAutoExtract: boolean;
+    }, {
+        showExternalCodexSessions?: boolean | undefined;
+        showExternalClaudeSessions?: boolean | undefined;
+        memoryAutoExtract?: boolean | undefined;
+    }>>;
     /**
      * Image generation is a general capability, decoupled from LLM providers
      * (TODO 7.1): a vendor may use different keys/endpoints/models for chat vs
@@ -2031,16 +2282,16 @@ export declare const SettingsSchema: z.ZodObject<{
     }, "strip", z.ZodTypeAny, {
         id: string;
         model: string;
-        catalogId: string;
         tag: "text" | "image" | "video" | "audio";
+        catalogId: string;
         baseUrl?: string | undefined;
         credentialId?: string | undefined;
         paramValues?: Record<string, unknown> | undefined;
     }, {
         id: string;
         model: string;
-        catalogId: string;
         tag: "text" | "image" | "video" | "audio";
+        catalogId: string;
         baseUrl?: string | undefined;
         credentialId?: string | undefined;
         paramValues?: Record<string, unknown> | undefined;
@@ -2086,21 +2337,21 @@ export declare const SettingsSchema: z.ZodObject<{
             argsPattern?: Record<string, string> | undefined;
         }>, "many">>;
     }, "strip", z.ZodTypeAny, {
-        defaultMode: "auto" | "default" | "acceptEdits" | "dontAsk" | "bypassPermissions" | "plan";
         rules: {
             tool: string;
             decision: "allow" | "deny" | "ask";
             reason?: string | undefined;
             argsPattern?: Record<string, string> | undefined;
         }[];
+        defaultMode: "default" | "auto" | "acceptEdits" | "dontAsk" | "bypassPermissions" | "plan";
     }, {
-        defaultMode?: "auto" | "default" | "acceptEdits" | "dontAsk" | "bypassPermissions" | "plan" | undefined;
         rules?: {
             tool: string;
             decision: "allow" | "deny" | "ask";
             reason?: string | undefined;
             argsPattern?: Record<string, string> | undefined;
         }[] | undefined;
+        defaultMode?: "default" | "auto" | "acceptEdits" | "dontAsk" | "bypassPermissions" | "plan" | undefined;
     }>>;
     context: z.ZodDefault<z.ZodObject<{
         maxTokens: z.ZodDefault<z.ZodNumber>;
@@ -2148,71 +2399,88 @@ export declare const SettingsSchema: z.ZodObject<{
         envHeaders: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
         credentialRef: z.ZodOptional<z.ZodString>;
         enabled: z.ZodOptional<z.ZodBoolean>;
+        allowedTools: z.ZodOptional<z.ZodArray<z.ZodEffects<z.ZodString, string, string>, "many">>;
+        disabledTools: z.ZodOptional<z.ZodArray<z.ZodEffects<z.ZodString, string, string>, "many">>;
     }, "strip", z.ZodTypeAny, {
         name: string;
         enabled?: boolean | undefined;
         url?: string | undefined;
         args?: string[] | undefined;
         command?: string | undefined;
+        credentialRef?: string | undefined;
         env?: Record<string, string> | undefined;
         transport?: "stdio" | "sse" | "streamable-http" | "inprocess" | undefined;
         headers?: Record<string, string> | undefined;
         envVars?: string[] | undefined;
         bearerTokenEnvVar?: string | undefined;
         envHeaders?: Record<string, string> | undefined;
-        credentialRef?: string | undefined;
+        allowedTools?: string[] | undefined;
+        disabledTools?: string[] | undefined;
     }, {
         name: string;
         enabled?: boolean | undefined;
         url?: string | undefined;
         args?: string[] | undefined;
         command?: string | undefined;
+        credentialRef?: string | undefined;
         env?: Record<string, string> | undefined;
         transport?: "stdio" | "sse" | "streamable-http" | "inprocess" | undefined;
         headers?: Record<string, string> | undefined;
         envVars?: string[] | undefined;
         bearerTokenEnvVar?: string | undefined;
         envHeaders?: Record<string, string> | undefined;
-        credentialRef?: string | undefined;
+        allowedTools?: string[] | undefined;
+        disabledTools?: string[] | undefined;
     }>>, Record<string, {
         name: string;
         enabled?: boolean | undefined;
         url?: string | undefined;
         args?: string[] | undefined;
         command?: string | undefined;
+        credentialRef?: string | undefined;
         env?: Record<string, string> | undefined;
         transport?: "stdio" | "sse" | "streamable-http" | "inprocess" | undefined;
         headers?: Record<string, string> | undefined;
         envVars?: string[] | undefined;
         bearerTokenEnvVar?: string | undefined;
         envHeaders?: Record<string, string> | undefined;
-        credentialRef?: string | undefined;
+        allowedTools?: string[] | undefined;
+        disabledTools?: string[] | undefined;
     }>, unknown>>;
     /**
-     * User supplements for PLUGIN-provided MCP servers, keyed by the server's
-     * `<plugin>:<server>` name. Layered onto the plugin config at merge time
-     * (mergePluginMcpServers). Only env/credential fields are accepted —
-     * command/args/url/transport are intentionally absent and `.strict()`
-     * rejects them, so a plugin update is never shadowed by a stale copy.
+     * User policy/supplements for PLUGIN-provided MCP servers, keyed by the
+     * server's `<plugin>:<server>` name. Layered onto the plugin config at merge
+     * time (mergePluginMcpServers). Only server/tool policy + env/credential
+     * fields are accepted — command/args/url/transport are intentionally absent and
+     * `.strict()` rejects them, so an update is never shadowed by a stale copy.
      */
     mcpServerOverrides: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodObject<{
+        enabled: z.ZodOptional<z.ZodBoolean>;
+        allowedTools: z.ZodOptional<z.ZodArray<z.ZodEffects<z.ZodString, string, string>, "many">>;
+        disabledTools: z.ZodOptional<z.ZodArray<z.ZodEffects<z.ZodString, string, string>, "many">>;
         env: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
         envVars: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
         credentialRef: z.ZodOptional<z.ZodString>;
         bearerTokenEnvVar: z.ZodOptional<z.ZodString>;
         envHeaders: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
     }, "strict", z.ZodTypeAny, {
+        enabled?: boolean | undefined;
+        credentialRef?: string | undefined;
         env?: Record<string, string> | undefined;
         envVars?: string[] | undefined;
         bearerTokenEnvVar?: string | undefined;
         envHeaders?: Record<string, string> | undefined;
-        credentialRef?: string | undefined;
+        allowedTools?: string[] | undefined;
+        disabledTools?: string[] | undefined;
     }, {
+        enabled?: boolean | undefined;
+        credentialRef?: string | undefined;
         env?: Record<string, string> | undefined;
         envVars?: string[] | undefined;
         bearerTokenEnvVar?: string | undefined;
         envHeaders?: Record<string, string> | undefined;
-        credentialRef?: string | undefined;
+        allowedTools?: string[] | undefined;
+        disabledTools?: string[] | undefined;
     }>>>;
     /**
      * Skill names hidden from the LLM. Names include the full
@@ -2228,6 +2496,19 @@ export declare const SettingsSchema: z.ZodObject<{
      * names (no colon suffix). See scanSkills(opts.disabledPlugins).
      */
     disabledPlugins: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+    /** Globally disabled Panel Apps, including their declared tools and bundled Skills. */
+    disabledPanelApps: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+    /**
+     * Explicit project binding for installed Panel Apps. Installed apps form a
+     * global catalog, but only IDs in this project-owned list contribute panel
+     * UI, Agent tools, bundled Skills, or project-scoped storage.
+     */
+    panelAppBindings: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+    /**
+     * Legacy per-project Panel App policy. `on` is read as an explicit binding
+     * during migration; new writes use panelAppBindings.
+     */
+    panelAppOverrides: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodEnum<["inherit", "on", "off"]>>>;
     /**
      * Sub-agent role names (the `name` in .code-shell/agents/*.md) to
      * hide from the registry. A disabled role is filtered out at load
@@ -2247,6 +2528,8 @@ export declare const SettingsSchema: z.ZodObject<{
         agents: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodEnum<["inherit", "on", "off"]>>>;
         mcp: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodEnum<["inherit", "on", "off"]>>>;
         builtin: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodEnum<["inherit", "on", "off"]>>>;
+        /** Per-project Pet capability preferences layered over the user baseline. */
+        pet: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodEnum<["inherit", "on", "off"]>>>;
         /**
          * Per-hook overlay for PLUGIN-provided hooks, keyed by
          * `pluginHookKey()` (`<plugin>:<RawEvent>:<command>`). Finer-grained
@@ -2261,6 +2544,7 @@ export declare const SettingsSchema: z.ZodObject<{
         skills?: Record<string, "off" | "on" | "inherit"> | undefined;
         plugins?: Record<string, "off" | "on" | "inherit"> | undefined;
         agents?: Record<string, "off" | "on" | "inherit"> | undefined;
+        pet?: Record<string, "off" | "on" | "inherit"> | undefined;
         pluginHooks?: Record<string, "off" | "on" | "inherit"> | undefined;
     }, {
         builtin?: Record<string, "off" | "on" | "inherit"> | undefined;
@@ -2268,8 +2552,95 @@ export declare const SettingsSchema: z.ZodObject<{
         skills?: Record<string, "off" | "on" | "inherit"> | undefined;
         plugins?: Record<string, "off" | "on" | "inherit"> | undefined;
         agents?: Record<string, "off" | "on" | "inherit"> | undefined;
+        pet?: Record<string, "off" | "on" | "inherit"> | undefined;
         pluginHooks?: Record<string, "off" | "on" | "inherit"> | undefined;
     }>>;
+    /**
+     * 由 WorkspaceProfile 激活事务整体拥有的子树（profile/activation.ts）。
+     * 激活/切换 = 原子全量重写本子树；关闭 = 删除本子树。
+     * `overrides` 是 profile 声明展开的 force-enable 快照，折叠时排在
+     * 用户手写 capabilityOverrides 之下（用户按 key 永远赢，见 overlay.ts
+     * 的 effectiveProjectOverrides）。只存在于 PROJECT settings。
+     */
+    profile: z.ZodOptional<z.ZodObject<{
+        active: z.ZodString;
+        preset: z.ZodOptional<z.ZodString>;
+        overrides: z.ZodOptional<z.ZodObject<{
+            skills: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodEnum<["inherit", "on", "off"]>>>;
+            plugins: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodEnum<["inherit", "on", "off"]>>>;
+            agents: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodEnum<["inherit", "on", "off"]>>>;
+            mcp: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodEnum<["inherit", "on", "off"]>>>;
+            builtin: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodEnum<["inherit", "on", "off"]>>>;
+            /** Per-project Pet capability preferences layered over the user baseline. */
+            pet: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodEnum<["inherit", "on", "off"]>>>;
+            /**
+             * Per-hook overlay for PLUGIN-provided hooks, keyed by
+             * `pluginHookKey()` (`<plugin>:<RawEvent>:<command>`). Finer-grained
+             * than `plugins` (which kills a whole plugin): "off" suppresses one
+             * hook for this project only. Only "off" is meaningful today — plugin
+             * hooks have no global disable list to force back "on" from.
+             */
+            pluginHooks: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodEnum<["inherit", "on", "off"]>>>;
+        }, "strip", z.ZodTypeAny, {
+            builtin?: Record<string, "off" | "on" | "inherit"> | undefined;
+            mcp?: Record<string, "off" | "on" | "inherit"> | undefined;
+            skills?: Record<string, "off" | "on" | "inherit"> | undefined;
+            plugins?: Record<string, "off" | "on" | "inherit"> | undefined;
+            agents?: Record<string, "off" | "on" | "inherit"> | undefined;
+            pet?: Record<string, "off" | "on" | "inherit"> | undefined;
+            pluginHooks?: Record<string, "off" | "on" | "inherit"> | undefined;
+        }, {
+            builtin?: Record<string, "off" | "on" | "inherit"> | undefined;
+            mcp?: Record<string, "off" | "on" | "inherit"> | undefined;
+            skills?: Record<string, "off" | "on" | "inherit"> | undefined;
+            plugins?: Record<string, "off" | "on" | "inherit"> | undefined;
+            agents?: Record<string, "off" | "on" | "inherit"> | undefined;
+            pet?: Record<string, "off" | "on" | "inherit"> | undefined;
+            pluginHooks?: Record<string, "off" | "on" | "inherit"> | undefined;
+        }>>;
+    }, "strip", z.ZodTypeAny, {
+        active: string;
+        preset?: string | undefined;
+        overrides?: {
+            builtin?: Record<string, "off" | "on" | "inherit"> | undefined;
+            mcp?: Record<string, "off" | "on" | "inherit"> | undefined;
+            skills?: Record<string, "off" | "on" | "inherit"> | undefined;
+            plugins?: Record<string, "off" | "on" | "inherit"> | undefined;
+            agents?: Record<string, "off" | "on" | "inherit"> | undefined;
+            pet?: Record<string, "off" | "on" | "inherit"> | undefined;
+            pluginHooks?: Record<string, "off" | "on" | "inherit"> | undefined;
+        } | undefined;
+    }, {
+        active: string;
+        preset?: string | undefined;
+        overrides?: {
+            builtin?: Record<string, "off" | "on" | "inherit"> | undefined;
+            mcp?: Record<string, "off" | "on" | "inherit"> | undefined;
+            skills?: Record<string, "off" | "on" | "inherit"> | undefined;
+            plugins?: Record<string, "off" | "on" | "inherit"> | undefined;
+            agents?: Record<string, "off" | "on" | "inherit"> | undefined;
+            pet?: Record<string, "off" | "on" | "inherit"> | undefined;
+            pluginHooks?: Record<string, "off" | "on" | "inherit"> | undefined;
+        } | undefined;
+    }>>;
+    /**
+     * Workspace 数据源绑定（只存 ref/scope/readPolicy，绝不存 secret）。
+     * 语义见 docs/todo/workspace-datasource-binding-adr.md §1.2。
+     * 只存在于 PROJECT settings。
+     */
+    sources: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        sourceId: z.ZodString;
+        scopes: z.ZodArray<z.ZodString, "many">;
+        readPolicy: z.ZodDefault<z.ZodEnum<["ask", "deny"]>>;
+    }, "strip", z.ZodTypeAny, {
+        sourceId: string;
+        scopes: string[];
+        readPolicy: "deny" | "ask";
+    }, {
+        sourceId: string;
+        scopes: string[];
+        readPolicy?: "deny" | "ask" | undefined;
+    }>, "many">>;
     /**
      * Feature flags overlay: a map of flag name → boolean that overrides the
      * compiled-in defaults (see settings/feature-flags.ts FEATURE_FLAGS).
@@ -2320,43 +2691,6 @@ export declare const SettingsSchema: z.ZodObject<{
         compatFileNames?: string[] | undefined;
         ignoreGitBoundary?: boolean | undefined;
     }>>;
-    arena: z.ZodDefault<z.ZodObject<{
-        participants: z.ZodDefault<z.ZodArray<z.ZodUnion<[z.ZodString, z.ZodObject<{
-            name: z.ZodString;
-            model: z.ZodString;
-            provider: z.ZodOptional<z.ZodString>;
-            apiKey: z.ZodOptional<z.ZodString>;
-            baseUrl: z.ZodOptional<z.ZodString>;
-        }, "strip", z.ZodTypeAny, {
-            name: string;
-            model: string;
-            provider?: string | undefined;
-            baseUrl?: string | undefined;
-            apiKey?: string | undefined;
-        }, {
-            name: string;
-            model: string;
-            provider?: string | undefined;
-            baseUrl?: string | undefined;
-            apiKey?: string | undefined;
-        }>]>, "many">>;
-    }, "strip", z.ZodTypeAny, {
-        participants: (string | {
-            name: string;
-            model: string;
-            provider?: string | undefined;
-            baseUrl?: string | undefined;
-            apiKey?: string | undefined;
-        })[];
-    }, {
-        participants?: (string | {
-            name: string;
-            model: string;
-            provider?: string | undefined;
-            baseUrl?: string | undefined;
-            apiKey?: string | undefined;
-        })[] | undefined;
-    }>>;
     search: z.ZodDefault<z.ZodObject<{
         provider: z.ZodDefault<z.ZodEnum<["serper", "tavily", "searxng"]>>;
         apiKey: z.ZodOptional<z.ZodString>;
@@ -2601,16 +2935,16 @@ export declare const SettingsSchema: z.ZodObject<{
         command: string;
         event: string;
         disabled?: boolean | undefined;
+        cwd?: string | undefined;
         matcher?: string | undefined;
         timeout_ms?: number | undefined;
-        cwd?: string | undefined;
     }, {
         command: string;
         event: string;
         disabled?: boolean | undefined;
+        cwd?: string | undefined;
         matcher?: string | undefined;
         timeout_ms?: number | undefined;
-        cwd?: string | undefined;
     }>, "many">>;
     /**
      * External coding-agent orchestration (Claude Code / Codex CLI).
@@ -2626,14 +2960,14 @@ export declare const SettingsSchema: z.ZodObject<{
             trustedWorkspaces: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
             autoStartInTrustedWorkspaces: z.ZodOptional<z.ZodBoolean>;
         }, "strip", z.ZodTypeAny, {
-            defaultMode?: "safe" | "dangerous" | undefined;
             command?: string | undefined;
+            defaultMode?: "dangerous" | "safe" | undefined;
             dangerousArgs?: string[] | undefined;
             trustedWorkspaces?: string[] | undefined;
             autoStartInTrustedWorkspaces?: boolean | undefined;
         }, {
-            defaultMode?: "safe" | "dangerous" | undefined;
             command?: string | undefined;
+            defaultMode?: "dangerous" | "safe" | undefined;
             dangerousArgs?: string[] | undefined;
             trustedWorkspaces?: string[] | undefined;
             autoStartInTrustedWorkspaces?: boolean | undefined;
@@ -2650,8 +2984,8 @@ export declare const SettingsSchema: z.ZodObject<{
         }>>;
     }, "strip", z.ZodTypeAny, {
         claudeCode?: {
-            defaultMode?: "safe" | "dangerous" | undefined;
             command?: string | undefined;
+            defaultMode?: "dangerous" | "safe" | undefined;
             dangerousArgs?: string[] | undefined;
             trustedWorkspaces?: string[] | undefined;
             autoStartInTrustedWorkspaces?: boolean | undefined;
@@ -2662,8 +2996,8 @@ export declare const SettingsSchema: z.ZodObject<{
         } | undefined;
     }, {
         claudeCode?: {
-            defaultMode?: "safe" | "dangerous" | undefined;
             command?: string | undefined;
+            defaultMode?: "dangerous" | "safe" | undefined;
             dangerousArgs?: string[] | undefined;
             trustedWorkspaces?: string[] | undefined;
             autoStartInTrustedWorkspaces?: boolean | undefined;