@gaunt-sloth/core 2.0.0-alpha.24 → 2.0.0-alpha.26

package/dist/config/schema.d.ts

@@ -35,6 +35,165 @@
  * is additive and legitimately differs (no deprecated fields).
  */
 import { z } from 'zod';
+/**
+ * EXT-71 §3.1 — the **subject** axis of a rule entry, and only that: `shell` is a command, `tool`
+ * a built-in or custom in-process tool, `mcpTool` a server's tool. The hand-written twin is
+ * `ApprovalEntryType` in `shell-policy.ts`. What holds the two together is
+ * `approvalEntrySchema.spec.ts`, where a list of `ApprovalEntry`-typed literals is parsed by this
+ * schema: a value either side stops accepting fails there. That is a weaker pin than a direct
+ * equality assertion — it catches a narrowing, not a widening on one side alone.
+ */
+export declare const APPROVAL_ENTRY_TYPES: readonly ['shell', 'tool', 'mcpTool'];
+/**
+ * EXT-71 §3.1 — the **comparison** axis of a rule entry, and only that. `exact`/`glob`/`regexp`
+ * take a string pattern; `hint` takes an object over the annotation names and is valid on tool
+ * subjects only (on `shell` it is a config error — see {@link shellEntrySchema}).
+ */
+export declare const APPROVAL_ENTRY_MATCHERS: readonly ['exact', 'glob', 'regexp', 'hint'];
+/**
+ * EXT-71 §3.1 / §4.7 — the four MCP `ToolAnnotations` booleans a `hint` pattern may name, and the
+ * names a user may list in `approvals.mcp.*.trustAnnotations` (§4.7.1). This is the whole
+ * vocabulary: an unknown name is a config error, never an ignored key, because a hint pattern that
+ * quietly drops a constraint matches MORE than its author wrote, and a trust list that quietly
+ * drops one reads as working while believing something else.
+ *
+ * **The runtime twin `TOOL_ANNOTATION_HINTS` in `shell-policy.ts` is a deliberate duplicate, and
+ * the reason is layering, not oversight.** Neither file may import the other. This module must stay
+ * pure and cwd/fs-independent because it feeds `z.toJSONSchema()` (see the header), and importing
+ * `shell-policy.ts` would pull `core/types.js` and the whole runtime policy surface into it;
+ * importing this module from there would in turn pull zod into every module that only wanted a
+ * policy type. So the vocabulary is written once per layer on purpose — do not "simplify" it by
+ * making one import the other. The equality assertion in `mcpApprovalsBlock.spec.ts` is what fails
+ * when they drift.
+ */
+export declare const HINT_ANNOTATION_KEYS: readonly ['readOnlyHint', 'destructiveHint', 'idempotentHint', 'openWorldHint'];
+/**
+ * EXT-71 §3.1 — the length cap on a `regexp` pattern, enforced when the config LOADS.
+ *
+ * 200 characters. The longest pattern the spec itself writes is under 40, and every rule entry
+ * names one command or tool shape rather than a grammar, so 200 is an order of magnitude of
+ * headroom over real use while still bounding what the matcher can ever be handed. The cap is a
+ * cheap load-time bound, NOT a backtracking defence — a short pattern can backtrack
+ * catastrophically too, and the run-time match budget is the separate backstop for that. What the
+ * cap buys is that a pattern nobody could have read and reviewed cannot be smuggled past load.
+ */
+export declare const APPROVAL_REGEXP_MAX_LENGTH = 200;
+/**
+ * EXT-71 §3.1 — **one** entry in `allow`, `deny` or `escalate`. All three lists take the same
+ * shape, so there is one schema and the list a rule sits in decides only what a match DOES.
+ *
+ * `type`, `matcher` and `pattern` are required on every arm: no field is inferred, and no entry
+ * reads two ways. Every arm is a strict object, so any field the grammar does not define — a typo,
+ * a `server` on a `shell` entry, a `host` on a `shell` entry — is an unrecognized-key error rather
+ * than a silently-ignored key that would widen what the entry matches.
+ *
+ * The `id` is what makes the emitted JSON Schema hoist this union into `$defs` and reference it,
+ * instead of inlining all eleven arms into each of the twenty-four places a rule list appears
+ * (three lists × the root plus seven commands). That is the difference between a schema an editor loads
+ * and one it chokes on, and `$ref` is the standard spelling every JSON Schema consumer already
+ * understands.
+ */
+export declare const approvalEntrySchema: z.ZodDiscriminatedUnion<[z.ZodDiscriminatedUnion<[z.ZodObject<{
+    rate: z.ZodOptional<z.ZodBoolean>;
+    type: z.ZodLiteral<"shell">;
+    matcher: z.ZodLiteral<"exact">;
+    pattern: z.ZodString;
+}, z.core.$strict>, z.ZodObject<{
+    rate: z.ZodOptional<z.ZodBoolean>;
+    type: z.ZodLiteral<"shell">;
+    matcher: z.ZodLiteral<"glob">;
+    pattern: z.ZodString;
+}, z.core.$strict>, z.ZodObject<{
+    rate: z.ZodOptional<z.ZodBoolean>;
+    type: z.ZodLiteral<"shell">;
+    matcher: z.ZodLiteral<"regexp">;
+    pattern: z.ZodString;
+}, z.core.$strict>], "matcher">, z.ZodDiscriminatedUnion<[z.ZodObject<{
+    rate: z.ZodOptional<z.ZodBoolean>;
+    host: z.ZodOptional<z.ZodString>;
+    type: z.ZodLiteral<"tool">;
+    matcher: z.ZodLiteral<"exact">;
+    pattern: z.ZodString;
+}, z.core.$strict>, z.ZodObject<{
+    rate: z.ZodOptional<z.ZodBoolean>;
+    host: z.ZodOptional<z.ZodString>;
+    type: z.ZodLiteral<"tool">;
+    matcher: z.ZodLiteral<"glob">;
+    pattern: z.ZodString;
+}, z.core.$strict>, z.ZodObject<{
+    rate: z.ZodOptional<z.ZodBoolean>;
+    host: z.ZodOptional<z.ZodString>;
+    type: z.ZodLiteral<"tool">;
+    matcher: z.ZodLiteral<"regexp">;
+    pattern: z.ZodString;
+}, z.core.$strict>, z.ZodObject<{
+    rate: z.ZodOptional<z.ZodBoolean>;
+    host: z.ZodOptional<z.ZodString>;
+    type: z.ZodLiteral<"tool">;
+    matcher: z.ZodLiteral<"hint">;
+    pattern: z.ZodObject<{
+        readOnlyHint: z.ZodOptional<z.ZodBoolean>;
+        destructiveHint: z.ZodOptional<z.ZodBoolean>;
+        idempotentHint: z.ZodOptional<z.ZodBoolean>;
+        openWorldHint: z.ZodOptional<z.ZodBoolean>;
+    }, z.core.$strict>;
+}, z.core.$strict>], "matcher">, z.ZodDiscriminatedUnion<[z.ZodObject<{
+    rate: z.ZodOptional<z.ZodBoolean>;
+    host: z.ZodOptional<z.ZodString>;
+    type: z.ZodLiteral<"mcpTool">;
+    matcher: z.ZodLiteral<"exact">;
+    server: z.ZodString;
+    pattern: z.ZodString;
+}, z.core.$strict>, z.ZodObject<{
+    rate: z.ZodOptional<z.ZodBoolean>;
+    host: z.ZodOptional<z.ZodString>;
+    type: z.ZodLiteral<"mcpTool">;
+    matcher: z.ZodLiteral<"glob">;
+    server: z.ZodString;
+    pattern: z.ZodString;
+}, z.core.$strict>, z.ZodObject<{
+    rate: z.ZodOptional<z.ZodBoolean>;
+    host: z.ZodOptional<z.ZodString>;
+    type: z.ZodLiteral<"mcpTool">;
+    matcher: z.ZodLiteral<"regexp">;
+    server: z.ZodString;
+    pattern: z.ZodString;
+}, z.core.$strict>, z.ZodObject<{
+    rate: z.ZodOptional<z.ZodBoolean>;
+    host: z.ZodOptional<z.ZodString>;
+    type: z.ZodLiteral<"mcpTool">;
+    matcher: z.ZodLiteral<"hint">;
+    server: z.ZodString;
+    pattern: z.ZodObject<{
+        readOnlyHint: z.ZodOptional<z.ZodBoolean>;
+        destructiveHint: z.ZodOptional<z.ZodBoolean>;
+        idempotentHint: z.ZodOptional<z.ZodBoolean>;
+        openWorldHint: z.ZodOptional<z.ZodBoolean>;
+    }, z.core.$strict>;
+}, z.core.$strict>], "matcher">], "type">;
+/**
+ * EXT-71 §3.1 — render an entry in the object form the user would write in a config file, with the
+ * fields in grammar order (`type`, `server`, `matcher`, `pattern`, then the optional bounds).
+ *
+ * The ONE place that spelling is produced, because it is shown in two very different moments that
+ * must agree: the load-time error that tells a user what to write instead of their bare string, and
+ * the escalation menu's *this is what will be stored* line (§6). A grant the menu describes one way
+ * and stores another is exactly the drift this design cannot afford.
+ */
+export declare function renderApprovalEntryObject(entry: {
+    type: string;
+    matcher: string;
+    pattern: unknown;
+    server?: string;
+    host?: string;
+    rate?: boolean;
+}): string;
+/**
+ * EXT-71 §2.3/§9.1 — render the object form of a bare string found in a rule list, so the
+ * migration error shows the user the entry they should have written *for their own string*
+ * rather than a generic example.
+ */
+export declare function renderApprovalEntryForString(pattern: string): string;
 /**
  * Zod schema for the raw, on-disk Gaunt Sloth config. Loose at the top level so
  * unknown keys are preserved (warn-only via {@link findUnknownTopLevelKeys}).
@@ -153,25 +312,280 @@ export declare const rawGthConfigSchema: z.ZodObject<{
         command: z.ZodOptional<z.ZodString>;
         timeout: z.ZodOptional<z.ZodNumber>;
         maxOutputBytes: z.ZodOptional<z.ZodNumber>;
-        allowlist: z.ZodOptional<z.ZodBoolean>;
-        persistAllowlist: z.ZodOptional<z.ZodBoolean>;
-        judge: z.ZodOptional<z.ZodUnion<readonly [z.ZodBoolean, z.ZodObject<{
-            enabled: z.ZodOptional<z.ZodBoolean>;
-            autoApproveLow: z.ZodOptional<z.ZodBoolean>;
-            blockHigh: z.ZodOptional<z.ZodBoolean>;
-            model: z.ZodOptional<z.ZodObject<{
-                type: z.ZodOptional<z.ZodString>;
-                model: z.ZodOptional<z.ZodString>;
-                configuration: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
-                apiKeyEnvironmentVariable: z.ZodOptional<z.ZodString>;
-            }, z.core.$loose>>;
-        }, z.core.$strip>]>>;
-        yolo: z.ZodOptional<z.ZodBoolean>;
         fileSet: z.ZodOptional<z.ZodEnum<{
             all: "all";
             gitignore: "gitignore";
         }>>;
     }, z.core.$strip>]>>]>>;
+    approvals: z.ZodOptional<z.ZodUnion<readonly [z.ZodEnum<{
+        "auto-safe": "auto-safe";
+        bypass: "bypass";
+        "full-auto": "full-auto";
+        "read-only": "read-only";
+        write: "write";
+    }>, z.ZodObject<{
+        mode: z.ZodOptional<z.ZodEnum<{
+            "auto-safe": "auto-safe";
+            bypass: "bypass";
+            "full-auto": "full-auto";
+            "read-only": "read-only";
+            write: "write";
+        }>>;
+        rater: z.ZodOptional<z.ZodString>;
+        allow: z.ZodOptional<z.ZodArray<z.ZodDiscriminatedUnion<[z.ZodDiscriminatedUnion<[z.ZodObject<{
+            rate: z.ZodOptional<z.ZodBoolean>;
+            type: z.ZodLiteral<"shell">;
+            matcher: z.ZodLiteral<"exact">;
+            pattern: z.ZodString;
+        }, z.core.$strict>, z.ZodObject<{
+            rate: z.ZodOptional<z.ZodBoolean>;
+            type: z.ZodLiteral<"shell">;
+            matcher: z.ZodLiteral<"glob">;
+            pattern: z.ZodString;
+        }, z.core.$strict>, z.ZodObject<{
+            rate: z.ZodOptional<z.ZodBoolean>;
+            type: z.ZodLiteral<"shell">;
+            matcher: z.ZodLiteral<"regexp">;
+            pattern: z.ZodString;
+        }, z.core.$strict>], "matcher">, z.ZodDiscriminatedUnion<[z.ZodObject<{
+            rate: z.ZodOptional<z.ZodBoolean>;
+            host: z.ZodOptional<z.ZodString>;
+            type: z.ZodLiteral<"tool">;
+            matcher: z.ZodLiteral<"exact">;
+            pattern: z.ZodString;
+        }, z.core.$strict>, z.ZodObject<{
+            rate: z.ZodOptional<z.ZodBoolean>;
+            host: z.ZodOptional<z.ZodString>;
+            type: z.ZodLiteral<"tool">;
+            matcher: z.ZodLiteral<"glob">;
+            pattern: z.ZodString;
+        }, z.core.$strict>, z.ZodObject<{
+            rate: z.ZodOptional<z.ZodBoolean>;
+            host: z.ZodOptional<z.ZodString>;
+            type: z.ZodLiteral<"tool">;
+            matcher: z.ZodLiteral<"regexp">;
+            pattern: z.ZodString;
+        }, z.core.$strict>, z.ZodObject<{
+            rate: z.ZodOptional<z.ZodBoolean>;
+            host: z.ZodOptional<z.ZodString>;
+            type: z.ZodLiteral<"tool">;
+            matcher: z.ZodLiteral<"hint">;
+            pattern: z.ZodObject<{
+                readOnlyHint: z.ZodOptional<z.ZodBoolean>;
+                destructiveHint: z.ZodOptional<z.ZodBoolean>;
+                idempotentHint: z.ZodOptional<z.ZodBoolean>;
+                openWorldHint: z.ZodOptional<z.ZodBoolean>;
+            }, z.core.$strict>;
+        }, z.core.$strict>], "matcher">, z.ZodDiscriminatedUnion<[z.ZodObject<{
+            rate: z.ZodOptional<z.ZodBoolean>;
+            host: z.ZodOptional<z.ZodString>;
+            type: z.ZodLiteral<"mcpTool">;
+            matcher: z.ZodLiteral<"exact">;
+            server: z.ZodString;
+            pattern: z.ZodString;
+        }, z.core.$strict>, z.ZodObject<{
+            rate: z.ZodOptional<z.ZodBoolean>;
+            host: z.ZodOptional<z.ZodString>;
+            type: z.ZodLiteral<"mcpTool">;
+            matcher: z.ZodLiteral<"glob">;
+            server: z.ZodString;
+            pattern: z.ZodString;
+        }, z.core.$strict>, z.ZodObject<{
+            rate: z.ZodOptional<z.ZodBoolean>;
+            host: z.ZodOptional<z.ZodString>;
+            type: z.ZodLiteral<"mcpTool">;
+            matcher: z.ZodLiteral<"regexp">;
+            server: z.ZodString;
+            pattern: z.ZodString;
+        }, z.core.$strict>, z.ZodObject<{
+            rate: z.ZodOptional<z.ZodBoolean>;
+            host: z.ZodOptional<z.ZodString>;
+            type: z.ZodLiteral<"mcpTool">;
+            matcher: z.ZodLiteral<"hint">;
+            server: z.ZodString;
+            pattern: z.ZodObject<{
+                readOnlyHint: z.ZodOptional<z.ZodBoolean>;
+                destructiveHint: z.ZodOptional<z.ZodBoolean>;
+                idempotentHint: z.ZodOptional<z.ZodBoolean>;
+                openWorldHint: z.ZodOptional<z.ZodBoolean>;
+            }, z.core.$strict>;
+        }, z.core.$strict>], "matcher">], "type">>>;
+        deny: z.ZodOptional<z.ZodArray<z.ZodDiscriminatedUnion<[z.ZodDiscriminatedUnion<[z.ZodObject<{
+            rate: z.ZodOptional<z.ZodBoolean>;
+            type: z.ZodLiteral<"shell">;
+            matcher: z.ZodLiteral<"exact">;
+            pattern: z.ZodString;
+        }, z.core.$strict>, z.ZodObject<{
+            rate: z.ZodOptional<z.ZodBoolean>;
+            type: z.ZodLiteral<"shell">;
+            matcher: z.ZodLiteral<"glob">;
+            pattern: z.ZodString;
+        }, z.core.$strict>, z.ZodObject<{
+            rate: z.ZodOptional<z.ZodBoolean>;
+            type: z.ZodLiteral<"shell">;
+            matcher: z.ZodLiteral<"regexp">;
+            pattern: z.ZodString;
+        }, z.core.$strict>], "matcher">, z.ZodDiscriminatedUnion<[z.ZodObject<{
+            rate: z.ZodOptional<z.ZodBoolean>;
+            host: z.ZodOptional<z.ZodString>;
+            type: z.ZodLiteral<"tool">;
+            matcher: z.ZodLiteral<"exact">;
+            pattern: z.ZodString;
+        }, z.core.$strict>, z.ZodObject<{
+            rate: z.ZodOptional<z.ZodBoolean>;
+            host: z.ZodOptional<z.ZodString>;
+            type: z.ZodLiteral<"tool">;
+            matcher: z.ZodLiteral<"glob">;
+            pattern: z.ZodString;
+        }, z.core.$strict>, z.ZodObject<{
+            rate: z.ZodOptional<z.ZodBoolean>;
+            host: z.ZodOptional<z.ZodString>;
+            type: z.ZodLiteral<"tool">;
+            matcher: z.ZodLiteral<"regexp">;
+            pattern: z.ZodString;
+        }, z.core.$strict>, z.ZodObject<{
+            rate: z.ZodOptional<z.ZodBoolean>;
+            host: z.ZodOptional<z.ZodString>;
+            type: z.ZodLiteral<"tool">;
+            matcher: z.ZodLiteral<"hint">;
+            pattern: z.ZodObject<{
+                readOnlyHint: z.ZodOptional<z.ZodBoolean>;
+                destructiveHint: z.ZodOptional<z.ZodBoolean>;
+                idempotentHint: z.ZodOptional<z.ZodBoolean>;
+                openWorldHint: z.ZodOptional<z.ZodBoolean>;
+            }, z.core.$strict>;
+        }, z.core.$strict>], "matcher">, z.ZodDiscriminatedUnion<[z.ZodObject<{
+            rate: z.ZodOptional<z.ZodBoolean>;
+            host: z.ZodOptional<z.ZodString>;
+            type: z.ZodLiteral<"mcpTool">;
+            matcher: z.ZodLiteral<"exact">;
+            server: z.ZodString;
+            pattern: z.ZodString;
+        }, z.core.$strict>, z.ZodObject<{
+            rate: z.ZodOptional<z.ZodBoolean>;
+            host: z.ZodOptional<z.ZodString>;
+            type: z.ZodLiteral<"mcpTool">;
+            matcher: z.ZodLiteral<"glob">;
+            server: z.ZodString;
+            pattern: z.ZodString;
+        }, z.core.$strict>, z.ZodObject<{
+            rate: z.ZodOptional<z.ZodBoolean>;
+            host: z.ZodOptional<z.ZodString>;
+            type: z.ZodLiteral<"mcpTool">;
+            matcher: z.ZodLiteral<"regexp">;
+            server: z.ZodString;
+            pattern: z.ZodString;
+        }, z.core.$strict>, z.ZodObject<{
+            rate: z.ZodOptional<z.ZodBoolean>;
+            host: z.ZodOptional<z.ZodString>;
+            type: z.ZodLiteral<"mcpTool">;
+            matcher: z.ZodLiteral<"hint">;
+            server: z.ZodString;
+            pattern: z.ZodObject<{
+                readOnlyHint: z.ZodOptional<z.ZodBoolean>;
+                destructiveHint: z.ZodOptional<z.ZodBoolean>;
+                idempotentHint: z.ZodOptional<z.ZodBoolean>;
+                openWorldHint: z.ZodOptional<z.ZodBoolean>;
+            }, z.core.$strict>;
+        }, z.core.$strict>], "matcher">], "type">>>;
+        escalate: z.ZodOptional<z.ZodArray<z.ZodDiscriminatedUnion<[z.ZodDiscriminatedUnion<[z.ZodObject<{
+            rate: z.ZodOptional<z.ZodBoolean>;
+            type: z.ZodLiteral<"shell">;
+            matcher: z.ZodLiteral<"exact">;
+            pattern: z.ZodString;
+        }, z.core.$strict>, z.ZodObject<{
+            rate: z.ZodOptional<z.ZodBoolean>;
+            type: z.ZodLiteral<"shell">;
+            matcher: z.ZodLiteral<"glob">;
+            pattern: z.ZodString;
+        }, z.core.$strict>, z.ZodObject<{
+            rate: z.ZodOptional<z.ZodBoolean>;
+            type: z.ZodLiteral<"shell">;
+            matcher: z.ZodLiteral<"regexp">;
+            pattern: z.ZodString;
+        }, z.core.$strict>], "matcher">, z.ZodDiscriminatedUnion<[z.ZodObject<{
+            rate: z.ZodOptional<z.ZodBoolean>;
+            host: z.ZodOptional<z.ZodString>;
+            type: z.ZodLiteral<"tool">;
+            matcher: z.ZodLiteral<"exact">;
+            pattern: z.ZodString;
+        }, z.core.$strict>, z.ZodObject<{
+            rate: z.ZodOptional<z.ZodBoolean>;
+            host: z.ZodOptional<z.ZodString>;
+            type: z.ZodLiteral<"tool">;
+            matcher: z.ZodLiteral<"glob">;
+            pattern: z.ZodString;
+        }, z.core.$strict>, z.ZodObject<{
+            rate: z.ZodOptional<z.ZodBoolean>;
+            host: z.ZodOptional<z.ZodString>;
+            type: z.ZodLiteral<"tool">;
+            matcher: z.ZodLiteral<"regexp">;
+            pattern: z.ZodString;
+        }, z.core.$strict>, z.ZodObject<{
+            rate: z.ZodOptional<z.ZodBoolean>;
+            host: z.ZodOptional<z.ZodString>;
+            type: z.ZodLiteral<"tool">;
+            matcher: z.ZodLiteral<"hint">;
+            pattern: z.ZodObject<{
+                readOnlyHint: z.ZodOptional<z.ZodBoolean>;
+                destructiveHint: z.ZodOptional<z.ZodBoolean>;
+                idempotentHint: z.ZodOptional<z.ZodBoolean>;
+                openWorldHint: z.ZodOptional<z.ZodBoolean>;
+            }, z.core.$strict>;
+        }, z.core.$strict>], "matcher">, z.ZodDiscriminatedUnion<[z.ZodObject<{
+            rate: z.ZodOptional<z.ZodBoolean>;
+            host: z.ZodOptional<z.ZodString>;
+            type: z.ZodLiteral<"mcpTool">;
+            matcher: z.ZodLiteral<"exact">;
+            server: z.ZodString;
+            pattern: z.ZodString;
+        }, z.core.$strict>, z.ZodObject<{
+            rate: z.ZodOptional<z.ZodBoolean>;
+            host: z.ZodOptional<z.ZodString>;
+            type: z.ZodLiteral<"mcpTool">;
+            matcher: z.ZodLiteral<"glob">;
+            server: z.ZodString;
+            pattern: z.ZodString;
+        }, z.core.$strict>, z.ZodObject<{
+            rate: z.ZodOptional<z.ZodBoolean>;
+            host: z.ZodOptional<z.ZodString>;
+            type: z.ZodLiteral<"mcpTool">;
+            matcher: z.ZodLiteral<"regexp">;
+            server: z.ZodString;
+            pattern: z.ZodString;
+        }, z.core.$strict>, z.ZodObject<{
+            rate: z.ZodOptional<z.ZodBoolean>;
+            host: z.ZodOptional<z.ZodString>;
+            type: z.ZodLiteral<"mcpTool">;
+            matcher: z.ZodLiteral<"hint">;
+            server: z.ZodString;
+            pattern: z.ZodObject<{
+                readOnlyHint: z.ZodOptional<z.ZodBoolean>;
+                destructiveHint: z.ZodOptional<z.ZodBoolean>;
+                idempotentHint: z.ZodOptional<z.ZodBoolean>;
+                openWorldHint: z.ZodOptional<z.ZodBoolean>;
+            }, z.core.$strict>;
+        }, z.core.$strict>], "matcher">], "type">>>;
+        raterTimeoutMs: z.ZodOptional<z.ZodNumber>;
+        mcp: z.ZodOptional<z.ZodObject<{
+            defaults: z.ZodOptional<z.ZodObject<{
+                trustAnnotations: z.ZodOptional<z.ZodArray<z.ZodEnum<{
+                    destructiveHint: "destructiveHint";
+                    idempotentHint: "idempotentHint";
+                    openWorldHint: "openWorldHint";
+                    readOnlyHint: "readOnlyHint";
+                }>>>;
+            }, z.core.$strict>>;
+            servers: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
+                trustAnnotations: z.ZodOptional<z.ZodArray<z.ZodEnum<{
+                    destructiveHint: "destructiveHint";
+                    idempotentHint: "idempotentHint";
+                    openWorldHint: "openWorldHint";
+                    readOnlyHint: "readOnlyHint";
+                }>>>;
+            }, z.core.$strict>>>;
+        }, z.core.$strict>>;
+    }, z.core.$strip>]>>;
     tools: z.ZodOptional<z.ZodArray<z.ZodUnknown>>;
     allowedTools: z.ZodOptional<z.ZodArray<z.ZodString>>;
     middleware: z.ZodOptional<z.ZodArray<z.ZodUnknown>>;
@@ -179,6 +593,7 @@ export declare const rawGthConfigSchema: z.ZodObject<{
     writeOutputToFile: z.ZodOptional<z.ZodUnion<readonly [z.ZodBoolean, z.ZodString]>>;
     writeBinaryOutputsToFile: z.ZodOptional<z.ZodBoolean>;
     useColour: z.ZodOptional<z.ZodBoolean>;
+    useMouse: z.ZodOptional<z.ZodBoolean>;
     streamSessionInferenceLog: z.ZodOptional<z.ZodBoolean>;
     canInterruptInferenceWithEsc: z.ZodOptional<z.ZodBoolean>;
     debugLog: z.ZodOptional<z.ZodBoolean>;
@@ -223,25 +638,280 @@ export declare const rawGthConfigSchema: z.ZodObject<{
                 command: z.ZodOptional<z.ZodString>;
                 timeout: z.ZodOptional<z.ZodNumber>;
                 maxOutputBytes: z.ZodOptional<z.ZodNumber>;
-                allowlist: z.ZodOptional<z.ZodBoolean>;
-                persistAllowlist: z.ZodOptional<z.ZodBoolean>;
-                judge: z.ZodOptional<z.ZodUnion<readonly [z.ZodBoolean, z.ZodObject<{
-                    enabled: z.ZodOptional<z.ZodBoolean>;
-                    autoApproveLow: z.ZodOptional<z.ZodBoolean>;
-                    blockHigh: z.ZodOptional<z.ZodBoolean>;
-                    model: z.ZodOptional<z.ZodObject<{
-                        type: z.ZodOptional<z.ZodString>;
-                        model: z.ZodOptional<z.ZodString>;
-                        configuration: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
-                        apiKeyEnvironmentVariable: z.ZodOptional<z.ZodString>;
-                    }, z.core.$loose>>;
-                }, z.core.$strip>]>>;
-                yolo: z.ZodOptional<z.ZodBoolean>;
                 fileSet: z.ZodOptional<z.ZodEnum<{
                     all: "all";
                     gitignore: "gitignore";
                 }>>;
             }, z.core.$strip>]>>]>>;
+            approvals: z.ZodOptional<z.ZodUnion<readonly [z.ZodEnum<{
+                "auto-safe": "auto-safe";
+                bypass: "bypass";
+                "full-auto": "full-auto";
+                "read-only": "read-only";
+                write: "write";
+            }>, z.ZodObject<{
+                mode: z.ZodOptional<z.ZodEnum<{
+                    "auto-safe": "auto-safe";
+                    bypass: "bypass";
+                    "full-auto": "full-auto";
+                    "read-only": "read-only";
+                    write: "write";
+                }>>;
+                rater: z.ZodOptional<z.ZodString>;
+                allow: z.ZodOptional<z.ZodArray<z.ZodDiscriminatedUnion<[z.ZodDiscriminatedUnion<[z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    type: z.ZodLiteral<"shell">;
+                    matcher: z.ZodLiteral<"exact">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    type: z.ZodLiteral<"shell">;
+                    matcher: z.ZodLiteral<"glob">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    type: z.ZodLiteral<"shell">;
+                    matcher: z.ZodLiteral<"regexp">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>], "matcher">, z.ZodDiscriminatedUnion<[z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"tool">;
+                    matcher: z.ZodLiteral<"exact">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"tool">;
+                    matcher: z.ZodLiteral<"glob">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"tool">;
+                    matcher: z.ZodLiteral<"regexp">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"tool">;
+                    matcher: z.ZodLiteral<"hint">;
+                    pattern: z.ZodObject<{
+                        readOnlyHint: z.ZodOptional<z.ZodBoolean>;
+                        destructiveHint: z.ZodOptional<z.ZodBoolean>;
+                        idempotentHint: z.ZodOptional<z.ZodBoolean>;
+                        openWorldHint: z.ZodOptional<z.ZodBoolean>;
+                    }, z.core.$strict>;
+                }, z.core.$strict>], "matcher">, z.ZodDiscriminatedUnion<[z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"mcpTool">;
+                    matcher: z.ZodLiteral<"exact">;
+                    server: z.ZodString;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"mcpTool">;
+                    matcher: z.ZodLiteral<"glob">;
+                    server: z.ZodString;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"mcpTool">;
+                    matcher: z.ZodLiteral<"regexp">;
+                    server: z.ZodString;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"mcpTool">;
+                    matcher: z.ZodLiteral<"hint">;
+                    server: z.ZodString;
+                    pattern: z.ZodObject<{
+                        readOnlyHint: z.ZodOptional<z.ZodBoolean>;
+                        destructiveHint: z.ZodOptional<z.ZodBoolean>;
+                        idempotentHint: z.ZodOptional<z.ZodBoolean>;
+                        openWorldHint: z.ZodOptional<z.ZodBoolean>;
+                    }, z.core.$strict>;
+                }, z.core.$strict>], "matcher">], "type">>>;
+                deny: z.ZodOptional<z.ZodArray<z.ZodDiscriminatedUnion<[z.ZodDiscriminatedUnion<[z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    type: z.ZodLiteral<"shell">;
+                    matcher: z.ZodLiteral<"exact">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    type: z.ZodLiteral<"shell">;
+                    matcher: z.ZodLiteral<"glob">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    type: z.ZodLiteral<"shell">;
+                    matcher: z.ZodLiteral<"regexp">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>], "matcher">, z.ZodDiscriminatedUnion<[z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"tool">;
+                    matcher: z.ZodLiteral<"exact">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"tool">;
+                    matcher: z.ZodLiteral<"glob">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"tool">;
+                    matcher: z.ZodLiteral<"regexp">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"tool">;
+                    matcher: z.ZodLiteral<"hint">;
+                    pattern: z.ZodObject<{
+                        readOnlyHint: z.ZodOptional<z.ZodBoolean>;
+                        destructiveHint: z.ZodOptional<z.ZodBoolean>;
+                        idempotentHint: z.ZodOptional<z.ZodBoolean>;
+                        openWorldHint: z.ZodOptional<z.ZodBoolean>;
+                    }, z.core.$strict>;
+                }, z.core.$strict>], "matcher">, z.ZodDiscriminatedUnion<[z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"mcpTool">;
+                    matcher: z.ZodLiteral<"exact">;
+                    server: z.ZodString;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"mcpTool">;
+                    matcher: z.ZodLiteral<"glob">;
+                    server: z.ZodString;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"mcpTool">;
+                    matcher: z.ZodLiteral<"regexp">;
+                    server: z.ZodString;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"mcpTool">;
+                    matcher: z.ZodLiteral<"hint">;
+                    server: z.ZodString;
+                    pattern: z.ZodObject<{
+                        readOnlyHint: z.ZodOptional<z.ZodBoolean>;
+                        destructiveHint: z.ZodOptional<z.ZodBoolean>;
+                        idempotentHint: z.ZodOptional<z.ZodBoolean>;
+                        openWorldHint: z.ZodOptional<z.ZodBoolean>;
+                    }, z.core.$strict>;
+                }, z.core.$strict>], "matcher">], "type">>>;
+                escalate: z.ZodOptional<z.ZodArray<z.ZodDiscriminatedUnion<[z.ZodDiscriminatedUnion<[z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    type: z.ZodLiteral<"shell">;
+                    matcher: z.ZodLiteral<"exact">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    type: z.ZodLiteral<"shell">;
+                    matcher: z.ZodLiteral<"glob">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    type: z.ZodLiteral<"shell">;
+                    matcher: z.ZodLiteral<"regexp">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>], "matcher">, z.ZodDiscriminatedUnion<[z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"tool">;
+                    matcher: z.ZodLiteral<"exact">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"tool">;
+                    matcher: z.ZodLiteral<"glob">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"tool">;
+                    matcher: z.ZodLiteral<"regexp">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"tool">;
+                    matcher: z.ZodLiteral<"hint">;
+                    pattern: z.ZodObject<{
+                        readOnlyHint: z.ZodOptional<z.ZodBoolean>;
+                        destructiveHint: z.ZodOptional<z.ZodBoolean>;
+                        idempotentHint: z.ZodOptional<z.ZodBoolean>;
+                        openWorldHint: z.ZodOptional<z.ZodBoolean>;
+                    }, z.core.$strict>;
+                }, z.core.$strict>], "matcher">, z.ZodDiscriminatedUnion<[z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"mcpTool">;
+                    matcher: z.ZodLiteral<"exact">;
+                    server: z.ZodString;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"mcpTool">;
+                    matcher: z.ZodLiteral<"glob">;
+                    server: z.ZodString;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"mcpTool">;
+                    matcher: z.ZodLiteral<"regexp">;
+                    server: z.ZodString;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"mcpTool">;
+                    matcher: z.ZodLiteral<"hint">;
+                    server: z.ZodString;
+                    pattern: z.ZodObject<{
+                        readOnlyHint: z.ZodOptional<z.ZodBoolean>;
+                        destructiveHint: z.ZodOptional<z.ZodBoolean>;
+                        idempotentHint: z.ZodOptional<z.ZodBoolean>;
+                        openWorldHint: z.ZodOptional<z.ZodBoolean>;
+                    }, z.core.$strict>;
+                }, z.core.$strict>], "matcher">], "type">>>;
+                raterTimeoutMs: z.ZodOptional<z.ZodNumber>;
+                mcp: z.ZodOptional<z.ZodObject<{
+                    defaults: z.ZodOptional<z.ZodObject<{
+                        trustAnnotations: z.ZodOptional<z.ZodArray<z.ZodEnum<{
+                            destructiveHint: "destructiveHint";
+                            idempotentHint: "idempotentHint";
+                            openWorldHint: "openWorldHint";
+                            readOnlyHint: "readOnlyHint";
+                        }>>>;
+                    }, z.core.$strict>>;
+                    servers: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
+                        trustAnnotations: z.ZodOptional<z.ZodArray<z.ZodEnum<{
+                            destructiveHint: "destructiveHint";
+                            idempotentHint: "idempotentHint";
+                            openWorldHint: "openWorldHint";
+                            readOnlyHint: "readOnlyHint";
+                        }>>>;
+                    }, z.core.$strict>>>;
+                }, z.core.$strict>>;
+            }, z.core.$strip>]>>;
             customTools: z.ZodOptional<z.ZodUnion<readonly [z.ZodLiteral<false>, z.ZodRecord<z.ZodString, z.ZodObject<{
                 command: z.ZodString;
                 description: z.ZodString;
@@ -291,25 +961,280 @@ export declare const rawGthConfigSchema: z.ZodObject<{
                 command: z.ZodOptional<z.ZodString>;
                 timeout: z.ZodOptional<z.ZodNumber>;
                 maxOutputBytes: z.ZodOptional<z.ZodNumber>;
-                allowlist: z.ZodOptional<z.ZodBoolean>;
-                persistAllowlist: z.ZodOptional<z.ZodBoolean>;
-                judge: z.ZodOptional<z.ZodUnion<readonly [z.ZodBoolean, z.ZodObject<{
-                    enabled: z.ZodOptional<z.ZodBoolean>;
-                    autoApproveLow: z.ZodOptional<z.ZodBoolean>;
-                    blockHigh: z.ZodOptional<z.ZodBoolean>;
-                    model: z.ZodOptional<z.ZodObject<{
-                        type: z.ZodOptional<z.ZodString>;
-                        model: z.ZodOptional<z.ZodString>;
-                        configuration: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
-                        apiKeyEnvironmentVariable: z.ZodOptional<z.ZodString>;
-                    }, z.core.$loose>>;
-                }, z.core.$strip>]>>;
-                yolo: z.ZodOptional<z.ZodBoolean>;
                 fileSet: z.ZodOptional<z.ZodEnum<{
                     all: "all";
                     gitignore: "gitignore";
                 }>>;
             }, z.core.$strip>]>>]>>;
+            approvals: z.ZodOptional<z.ZodUnion<readonly [z.ZodEnum<{
+                "auto-safe": "auto-safe";
+                bypass: "bypass";
+                "full-auto": "full-auto";
+                "read-only": "read-only";
+                write: "write";
+            }>, z.ZodObject<{
+                mode: z.ZodOptional<z.ZodEnum<{
+                    "auto-safe": "auto-safe";
+                    bypass: "bypass";
+                    "full-auto": "full-auto";
+                    "read-only": "read-only";
+                    write: "write";
+                }>>;
+                rater: z.ZodOptional<z.ZodString>;
+                allow: z.ZodOptional<z.ZodArray<z.ZodDiscriminatedUnion<[z.ZodDiscriminatedUnion<[z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    type: z.ZodLiteral<"shell">;
+                    matcher: z.ZodLiteral<"exact">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    type: z.ZodLiteral<"shell">;
+                    matcher: z.ZodLiteral<"glob">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    type: z.ZodLiteral<"shell">;
+                    matcher: z.ZodLiteral<"regexp">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>], "matcher">, z.ZodDiscriminatedUnion<[z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"tool">;
+                    matcher: z.ZodLiteral<"exact">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"tool">;
+                    matcher: z.ZodLiteral<"glob">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"tool">;
+                    matcher: z.ZodLiteral<"regexp">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"tool">;
+                    matcher: z.ZodLiteral<"hint">;
+                    pattern: z.ZodObject<{
+                        readOnlyHint: z.ZodOptional<z.ZodBoolean>;
+                        destructiveHint: z.ZodOptional<z.ZodBoolean>;
+                        idempotentHint: z.ZodOptional<z.ZodBoolean>;
+                        openWorldHint: z.ZodOptional<z.ZodBoolean>;
+                    }, z.core.$strict>;
+                }, z.core.$strict>], "matcher">, z.ZodDiscriminatedUnion<[z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"mcpTool">;
+                    matcher: z.ZodLiteral<"exact">;
+                    server: z.ZodString;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"mcpTool">;
+                    matcher: z.ZodLiteral<"glob">;
+                    server: z.ZodString;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"mcpTool">;
+                    matcher: z.ZodLiteral<"regexp">;
+                    server: z.ZodString;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"mcpTool">;
+                    matcher: z.ZodLiteral<"hint">;
+                    server: z.ZodString;
+                    pattern: z.ZodObject<{
+                        readOnlyHint: z.ZodOptional<z.ZodBoolean>;
+                        destructiveHint: z.ZodOptional<z.ZodBoolean>;
+                        idempotentHint: z.ZodOptional<z.ZodBoolean>;
+                        openWorldHint: z.ZodOptional<z.ZodBoolean>;
+                    }, z.core.$strict>;
+                }, z.core.$strict>], "matcher">], "type">>>;
+                deny: z.ZodOptional<z.ZodArray<z.ZodDiscriminatedUnion<[z.ZodDiscriminatedUnion<[z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    type: z.ZodLiteral<"shell">;
+                    matcher: z.ZodLiteral<"exact">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    type: z.ZodLiteral<"shell">;
+                    matcher: z.ZodLiteral<"glob">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    type: z.ZodLiteral<"shell">;
+                    matcher: z.ZodLiteral<"regexp">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>], "matcher">, z.ZodDiscriminatedUnion<[z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"tool">;
+                    matcher: z.ZodLiteral<"exact">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"tool">;
+                    matcher: z.ZodLiteral<"glob">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"tool">;
+                    matcher: z.ZodLiteral<"regexp">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"tool">;
+                    matcher: z.ZodLiteral<"hint">;
+                    pattern: z.ZodObject<{
+                        readOnlyHint: z.ZodOptional<z.ZodBoolean>;
+                        destructiveHint: z.ZodOptional<z.ZodBoolean>;
+                        idempotentHint: z.ZodOptional<z.ZodBoolean>;
+                        openWorldHint: z.ZodOptional<z.ZodBoolean>;
+                    }, z.core.$strict>;
+                }, z.core.$strict>], "matcher">, z.ZodDiscriminatedUnion<[z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"mcpTool">;
+                    matcher: z.ZodLiteral<"exact">;
+                    server: z.ZodString;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"mcpTool">;
+                    matcher: z.ZodLiteral<"glob">;
+                    server: z.ZodString;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"mcpTool">;
+                    matcher: z.ZodLiteral<"regexp">;
+                    server: z.ZodString;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"mcpTool">;
+                    matcher: z.ZodLiteral<"hint">;
+                    server: z.ZodString;
+                    pattern: z.ZodObject<{
+                        readOnlyHint: z.ZodOptional<z.ZodBoolean>;
+                        destructiveHint: z.ZodOptional<z.ZodBoolean>;
+                        idempotentHint: z.ZodOptional<z.ZodBoolean>;
+                        openWorldHint: z.ZodOptional<z.ZodBoolean>;
+                    }, z.core.$strict>;
+                }, z.core.$strict>], "matcher">], "type">>>;
+                escalate: z.ZodOptional<z.ZodArray<z.ZodDiscriminatedUnion<[z.ZodDiscriminatedUnion<[z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    type: z.ZodLiteral<"shell">;
+                    matcher: z.ZodLiteral<"exact">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    type: z.ZodLiteral<"shell">;
+                    matcher: z.ZodLiteral<"glob">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    type: z.ZodLiteral<"shell">;
+                    matcher: z.ZodLiteral<"regexp">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>], "matcher">, z.ZodDiscriminatedUnion<[z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"tool">;
+                    matcher: z.ZodLiteral<"exact">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"tool">;
+                    matcher: z.ZodLiteral<"glob">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"tool">;
+                    matcher: z.ZodLiteral<"regexp">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"tool">;
+                    matcher: z.ZodLiteral<"hint">;
+                    pattern: z.ZodObject<{
+                        readOnlyHint: z.ZodOptional<z.ZodBoolean>;
+                        destructiveHint: z.ZodOptional<z.ZodBoolean>;
+                        idempotentHint: z.ZodOptional<z.ZodBoolean>;
+                        openWorldHint: z.ZodOptional<z.ZodBoolean>;
+                    }, z.core.$strict>;
+                }, z.core.$strict>], "matcher">, z.ZodDiscriminatedUnion<[z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"mcpTool">;
+                    matcher: z.ZodLiteral<"exact">;
+                    server: z.ZodString;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"mcpTool">;
+                    matcher: z.ZodLiteral<"glob">;
+                    server: z.ZodString;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"mcpTool">;
+                    matcher: z.ZodLiteral<"regexp">;
+                    server: z.ZodString;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"mcpTool">;
+                    matcher: z.ZodLiteral<"hint">;
+                    server: z.ZodString;
+                    pattern: z.ZodObject<{
+                        readOnlyHint: z.ZodOptional<z.ZodBoolean>;
+                        destructiveHint: z.ZodOptional<z.ZodBoolean>;
+                        idempotentHint: z.ZodOptional<z.ZodBoolean>;
+                        openWorldHint: z.ZodOptional<z.ZodBoolean>;
+                    }, z.core.$strict>;
+                }, z.core.$strict>], "matcher">], "type">>>;
+                raterTimeoutMs: z.ZodOptional<z.ZodNumber>;
+                mcp: z.ZodOptional<z.ZodObject<{
+                    defaults: z.ZodOptional<z.ZodObject<{
+                        trustAnnotations: z.ZodOptional<z.ZodArray<z.ZodEnum<{
+                            destructiveHint: "destructiveHint";
+                            idempotentHint: "idempotentHint";
+                            openWorldHint: "openWorldHint";
+                            readOnlyHint: "readOnlyHint";
+                        }>>>;
+                    }, z.core.$strict>>;
+                    servers: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
+                        trustAnnotations: z.ZodOptional<z.ZodArray<z.ZodEnum<{
+                            destructiveHint: "destructiveHint";
+                            idempotentHint: "idempotentHint";
+                            openWorldHint: "openWorldHint";
+                            readOnlyHint: "readOnlyHint";
+                        }>>>;
+                    }, z.core.$strict>>>;
+                }, z.core.$strict>>;
+            }, z.core.$strip>]>>;
             customTools: z.ZodOptional<z.ZodUnion<readonly [z.ZodLiteral<false>, z.ZodRecord<z.ZodString, z.ZodObject<{
                 command: z.ZodString;
                 description: z.ZodString;
@@ -356,25 +1281,280 @@ export declare const rawGthConfigSchema: z.ZodObject<{
                 command: z.ZodOptional<z.ZodString>;
                 timeout: z.ZodOptional<z.ZodNumber>;
                 maxOutputBytes: z.ZodOptional<z.ZodNumber>;
-                allowlist: z.ZodOptional<z.ZodBoolean>;
-                persistAllowlist: z.ZodOptional<z.ZodBoolean>;
-                judge: z.ZodOptional<z.ZodUnion<readonly [z.ZodBoolean, z.ZodObject<{
-                    enabled: z.ZodOptional<z.ZodBoolean>;
-                    autoApproveLow: z.ZodOptional<z.ZodBoolean>;
-                    blockHigh: z.ZodOptional<z.ZodBoolean>;
-                    model: z.ZodOptional<z.ZodObject<{
-                        type: z.ZodOptional<z.ZodString>;
-                        model: z.ZodOptional<z.ZodString>;
-                        configuration: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
-                        apiKeyEnvironmentVariable: z.ZodOptional<z.ZodString>;
-                    }, z.core.$loose>>;
-                }, z.core.$strip>]>>;
-                yolo: z.ZodOptional<z.ZodBoolean>;
                 fileSet: z.ZodOptional<z.ZodEnum<{
                     all: "all";
                     gitignore: "gitignore";
                 }>>;
             }, z.core.$strip>]>>]>>;
+            approvals: z.ZodOptional<z.ZodUnion<readonly [z.ZodEnum<{
+                "auto-safe": "auto-safe";
+                bypass: "bypass";
+                "full-auto": "full-auto";
+                "read-only": "read-only";
+                write: "write";
+            }>, z.ZodObject<{
+                mode: z.ZodOptional<z.ZodEnum<{
+                    "auto-safe": "auto-safe";
+                    bypass: "bypass";
+                    "full-auto": "full-auto";
+                    "read-only": "read-only";
+                    write: "write";
+                }>>;
+                rater: z.ZodOptional<z.ZodString>;
+                allow: z.ZodOptional<z.ZodArray<z.ZodDiscriminatedUnion<[z.ZodDiscriminatedUnion<[z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    type: z.ZodLiteral<"shell">;
+                    matcher: z.ZodLiteral<"exact">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    type: z.ZodLiteral<"shell">;
+                    matcher: z.ZodLiteral<"glob">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    type: z.ZodLiteral<"shell">;
+                    matcher: z.ZodLiteral<"regexp">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>], "matcher">, z.ZodDiscriminatedUnion<[z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"tool">;
+                    matcher: z.ZodLiteral<"exact">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"tool">;
+                    matcher: z.ZodLiteral<"glob">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"tool">;
+                    matcher: z.ZodLiteral<"regexp">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"tool">;
+                    matcher: z.ZodLiteral<"hint">;
+                    pattern: z.ZodObject<{
+                        readOnlyHint: z.ZodOptional<z.ZodBoolean>;
+                        destructiveHint: z.ZodOptional<z.ZodBoolean>;
+                        idempotentHint: z.ZodOptional<z.ZodBoolean>;
+                        openWorldHint: z.ZodOptional<z.ZodBoolean>;
+                    }, z.core.$strict>;
+                }, z.core.$strict>], "matcher">, z.ZodDiscriminatedUnion<[z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"mcpTool">;
+                    matcher: z.ZodLiteral<"exact">;
+                    server: z.ZodString;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"mcpTool">;
+                    matcher: z.ZodLiteral<"glob">;
+                    server: z.ZodString;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"mcpTool">;
+                    matcher: z.ZodLiteral<"regexp">;
+                    server: z.ZodString;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"mcpTool">;
+                    matcher: z.ZodLiteral<"hint">;
+                    server: z.ZodString;
+                    pattern: z.ZodObject<{
+                        readOnlyHint: z.ZodOptional<z.ZodBoolean>;
+                        destructiveHint: z.ZodOptional<z.ZodBoolean>;
+                        idempotentHint: z.ZodOptional<z.ZodBoolean>;
+                        openWorldHint: z.ZodOptional<z.ZodBoolean>;
+                    }, z.core.$strict>;
+                }, z.core.$strict>], "matcher">], "type">>>;
+                deny: z.ZodOptional<z.ZodArray<z.ZodDiscriminatedUnion<[z.ZodDiscriminatedUnion<[z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    type: z.ZodLiteral<"shell">;
+                    matcher: z.ZodLiteral<"exact">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    type: z.ZodLiteral<"shell">;
+                    matcher: z.ZodLiteral<"glob">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    type: z.ZodLiteral<"shell">;
+                    matcher: z.ZodLiteral<"regexp">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>], "matcher">, z.ZodDiscriminatedUnion<[z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"tool">;
+                    matcher: z.ZodLiteral<"exact">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"tool">;
+                    matcher: z.ZodLiteral<"glob">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"tool">;
+                    matcher: z.ZodLiteral<"regexp">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"tool">;
+                    matcher: z.ZodLiteral<"hint">;
+                    pattern: z.ZodObject<{
+                        readOnlyHint: z.ZodOptional<z.ZodBoolean>;
+                        destructiveHint: z.ZodOptional<z.ZodBoolean>;
+                        idempotentHint: z.ZodOptional<z.ZodBoolean>;
+                        openWorldHint: z.ZodOptional<z.ZodBoolean>;
+                    }, z.core.$strict>;
+                }, z.core.$strict>], "matcher">, z.ZodDiscriminatedUnion<[z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"mcpTool">;
+                    matcher: z.ZodLiteral<"exact">;
+                    server: z.ZodString;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"mcpTool">;
+                    matcher: z.ZodLiteral<"glob">;
+                    server: z.ZodString;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"mcpTool">;
+                    matcher: z.ZodLiteral<"regexp">;
+                    server: z.ZodString;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"mcpTool">;
+                    matcher: z.ZodLiteral<"hint">;
+                    server: z.ZodString;
+                    pattern: z.ZodObject<{
+                        readOnlyHint: z.ZodOptional<z.ZodBoolean>;
+                        destructiveHint: z.ZodOptional<z.ZodBoolean>;
+                        idempotentHint: z.ZodOptional<z.ZodBoolean>;
+                        openWorldHint: z.ZodOptional<z.ZodBoolean>;
+                    }, z.core.$strict>;
+                }, z.core.$strict>], "matcher">], "type">>>;
+                escalate: z.ZodOptional<z.ZodArray<z.ZodDiscriminatedUnion<[z.ZodDiscriminatedUnion<[z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    type: z.ZodLiteral<"shell">;
+                    matcher: z.ZodLiteral<"exact">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    type: z.ZodLiteral<"shell">;
+                    matcher: z.ZodLiteral<"glob">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    type: z.ZodLiteral<"shell">;
+                    matcher: z.ZodLiteral<"regexp">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>], "matcher">, z.ZodDiscriminatedUnion<[z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"tool">;
+                    matcher: z.ZodLiteral<"exact">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"tool">;
+                    matcher: z.ZodLiteral<"glob">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"tool">;
+                    matcher: z.ZodLiteral<"regexp">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"tool">;
+                    matcher: z.ZodLiteral<"hint">;
+                    pattern: z.ZodObject<{
+                        readOnlyHint: z.ZodOptional<z.ZodBoolean>;
+                        destructiveHint: z.ZodOptional<z.ZodBoolean>;
+                        idempotentHint: z.ZodOptional<z.ZodBoolean>;
+                        openWorldHint: z.ZodOptional<z.ZodBoolean>;
+                    }, z.core.$strict>;
+                }, z.core.$strict>], "matcher">, z.ZodDiscriminatedUnion<[z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"mcpTool">;
+                    matcher: z.ZodLiteral<"exact">;
+                    server: z.ZodString;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"mcpTool">;
+                    matcher: z.ZodLiteral<"glob">;
+                    server: z.ZodString;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"mcpTool">;
+                    matcher: z.ZodLiteral<"regexp">;
+                    server: z.ZodString;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"mcpTool">;
+                    matcher: z.ZodLiteral<"hint">;
+                    server: z.ZodString;
+                    pattern: z.ZodObject<{
+                        readOnlyHint: z.ZodOptional<z.ZodBoolean>;
+                        destructiveHint: z.ZodOptional<z.ZodBoolean>;
+                        idempotentHint: z.ZodOptional<z.ZodBoolean>;
+                        openWorldHint: z.ZodOptional<z.ZodBoolean>;
+                    }, z.core.$strict>;
+                }, z.core.$strict>], "matcher">], "type">>>;
+                raterTimeoutMs: z.ZodOptional<z.ZodNumber>;
+                mcp: z.ZodOptional<z.ZodObject<{
+                    defaults: z.ZodOptional<z.ZodObject<{
+                        trustAnnotations: z.ZodOptional<z.ZodArray<z.ZodEnum<{
+                            destructiveHint: "destructiveHint";
+                            idempotentHint: "idempotentHint";
+                            openWorldHint: "openWorldHint";
+                            readOnlyHint: "readOnlyHint";
+                        }>>>;
+                    }, z.core.$strict>>;
+                    servers: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
+                        trustAnnotations: z.ZodOptional<z.ZodArray<z.ZodEnum<{
+                            destructiveHint: "destructiveHint";
+                            idempotentHint: "idempotentHint";
+                            openWorldHint: "openWorldHint";
+                            readOnlyHint: "readOnlyHint";
+                        }>>>;
+                    }, z.core.$strict>>>;
+                }, z.core.$strict>>;
+            }, z.core.$strip>]>>;
             customTools: z.ZodOptional<z.ZodUnion<readonly [z.ZodLiteral<false>, z.ZodRecord<z.ZodString, z.ZodObject<{
                 command: z.ZodString;
                 description: z.ZodString;
@@ -414,25 +1594,280 @@ export declare const rawGthConfigSchema: z.ZodObject<{
                 command: z.ZodOptional<z.ZodString>;
                 timeout: z.ZodOptional<z.ZodNumber>;
                 maxOutputBytes: z.ZodOptional<z.ZodNumber>;
-                allowlist: z.ZodOptional<z.ZodBoolean>;
-                persistAllowlist: z.ZodOptional<z.ZodBoolean>;
-                judge: z.ZodOptional<z.ZodUnion<readonly [z.ZodBoolean, z.ZodObject<{
-                    enabled: z.ZodOptional<z.ZodBoolean>;
-                    autoApproveLow: z.ZodOptional<z.ZodBoolean>;
-                    blockHigh: z.ZodOptional<z.ZodBoolean>;
-                    model: z.ZodOptional<z.ZodObject<{
-                        type: z.ZodOptional<z.ZodString>;
-                        model: z.ZodOptional<z.ZodString>;
-                        configuration: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
-                        apiKeyEnvironmentVariable: z.ZodOptional<z.ZodString>;
-                    }, z.core.$loose>>;
-                }, z.core.$strip>]>>;
-                yolo: z.ZodOptional<z.ZodBoolean>;
                 fileSet: z.ZodOptional<z.ZodEnum<{
                     all: "all";
                     gitignore: "gitignore";
                 }>>;
             }, z.core.$strip>]>>]>>;
+            approvals: z.ZodOptional<z.ZodUnion<readonly [z.ZodEnum<{
+                "auto-safe": "auto-safe";
+                bypass: "bypass";
+                "full-auto": "full-auto";
+                "read-only": "read-only";
+                write: "write";
+            }>, z.ZodObject<{
+                mode: z.ZodOptional<z.ZodEnum<{
+                    "auto-safe": "auto-safe";
+                    bypass: "bypass";
+                    "full-auto": "full-auto";
+                    "read-only": "read-only";
+                    write: "write";
+                }>>;
+                rater: z.ZodOptional<z.ZodString>;
+                allow: z.ZodOptional<z.ZodArray<z.ZodDiscriminatedUnion<[z.ZodDiscriminatedUnion<[z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    type: z.ZodLiteral<"shell">;
+                    matcher: z.ZodLiteral<"exact">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    type: z.ZodLiteral<"shell">;
+                    matcher: z.ZodLiteral<"glob">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    type: z.ZodLiteral<"shell">;
+                    matcher: z.ZodLiteral<"regexp">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>], "matcher">, z.ZodDiscriminatedUnion<[z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"tool">;
+                    matcher: z.ZodLiteral<"exact">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"tool">;
+                    matcher: z.ZodLiteral<"glob">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"tool">;
+                    matcher: z.ZodLiteral<"regexp">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"tool">;
+                    matcher: z.ZodLiteral<"hint">;
+                    pattern: z.ZodObject<{
+                        readOnlyHint: z.ZodOptional<z.ZodBoolean>;
+                        destructiveHint: z.ZodOptional<z.ZodBoolean>;
+                        idempotentHint: z.ZodOptional<z.ZodBoolean>;
+                        openWorldHint: z.ZodOptional<z.ZodBoolean>;
+                    }, z.core.$strict>;
+                }, z.core.$strict>], "matcher">, z.ZodDiscriminatedUnion<[z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"mcpTool">;
+                    matcher: z.ZodLiteral<"exact">;
+                    server: z.ZodString;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"mcpTool">;
+                    matcher: z.ZodLiteral<"glob">;
+                    server: z.ZodString;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"mcpTool">;
+                    matcher: z.ZodLiteral<"regexp">;
+                    server: z.ZodString;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"mcpTool">;
+                    matcher: z.ZodLiteral<"hint">;
+                    server: z.ZodString;
+                    pattern: z.ZodObject<{
+                        readOnlyHint: z.ZodOptional<z.ZodBoolean>;
+                        destructiveHint: z.ZodOptional<z.ZodBoolean>;
+                        idempotentHint: z.ZodOptional<z.ZodBoolean>;
+                        openWorldHint: z.ZodOptional<z.ZodBoolean>;
+                    }, z.core.$strict>;
+                }, z.core.$strict>], "matcher">], "type">>>;
+                deny: z.ZodOptional<z.ZodArray<z.ZodDiscriminatedUnion<[z.ZodDiscriminatedUnion<[z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    type: z.ZodLiteral<"shell">;
+                    matcher: z.ZodLiteral<"exact">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    type: z.ZodLiteral<"shell">;
+                    matcher: z.ZodLiteral<"glob">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    type: z.ZodLiteral<"shell">;
+                    matcher: z.ZodLiteral<"regexp">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>], "matcher">, z.ZodDiscriminatedUnion<[z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"tool">;
+                    matcher: z.ZodLiteral<"exact">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"tool">;
+                    matcher: z.ZodLiteral<"glob">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"tool">;
+                    matcher: z.ZodLiteral<"regexp">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"tool">;
+                    matcher: z.ZodLiteral<"hint">;
+                    pattern: z.ZodObject<{
+                        readOnlyHint: z.ZodOptional<z.ZodBoolean>;
+                        destructiveHint: z.ZodOptional<z.ZodBoolean>;
+                        idempotentHint: z.ZodOptional<z.ZodBoolean>;
+                        openWorldHint: z.ZodOptional<z.ZodBoolean>;
+                    }, z.core.$strict>;
+                }, z.core.$strict>], "matcher">, z.ZodDiscriminatedUnion<[z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"mcpTool">;
+                    matcher: z.ZodLiteral<"exact">;
+                    server: z.ZodString;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"mcpTool">;
+                    matcher: z.ZodLiteral<"glob">;
+                    server: z.ZodString;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"mcpTool">;
+                    matcher: z.ZodLiteral<"regexp">;
+                    server: z.ZodString;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"mcpTool">;
+                    matcher: z.ZodLiteral<"hint">;
+                    server: z.ZodString;
+                    pattern: z.ZodObject<{
+                        readOnlyHint: z.ZodOptional<z.ZodBoolean>;
+                        destructiveHint: z.ZodOptional<z.ZodBoolean>;
+                        idempotentHint: z.ZodOptional<z.ZodBoolean>;
+                        openWorldHint: z.ZodOptional<z.ZodBoolean>;
+                    }, z.core.$strict>;
+                }, z.core.$strict>], "matcher">], "type">>>;
+                escalate: z.ZodOptional<z.ZodArray<z.ZodDiscriminatedUnion<[z.ZodDiscriminatedUnion<[z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    type: z.ZodLiteral<"shell">;
+                    matcher: z.ZodLiteral<"exact">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    type: z.ZodLiteral<"shell">;
+                    matcher: z.ZodLiteral<"glob">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    type: z.ZodLiteral<"shell">;
+                    matcher: z.ZodLiteral<"regexp">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>], "matcher">, z.ZodDiscriminatedUnion<[z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"tool">;
+                    matcher: z.ZodLiteral<"exact">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"tool">;
+                    matcher: z.ZodLiteral<"glob">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"tool">;
+                    matcher: z.ZodLiteral<"regexp">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"tool">;
+                    matcher: z.ZodLiteral<"hint">;
+                    pattern: z.ZodObject<{
+                        readOnlyHint: z.ZodOptional<z.ZodBoolean>;
+                        destructiveHint: z.ZodOptional<z.ZodBoolean>;
+                        idempotentHint: z.ZodOptional<z.ZodBoolean>;
+                        openWorldHint: z.ZodOptional<z.ZodBoolean>;
+                    }, z.core.$strict>;
+                }, z.core.$strict>], "matcher">, z.ZodDiscriminatedUnion<[z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"mcpTool">;
+                    matcher: z.ZodLiteral<"exact">;
+                    server: z.ZodString;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"mcpTool">;
+                    matcher: z.ZodLiteral<"glob">;
+                    server: z.ZodString;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"mcpTool">;
+                    matcher: z.ZodLiteral<"regexp">;
+                    server: z.ZodString;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"mcpTool">;
+                    matcher: z.ZodLiteral<"hint">;
+                    server: z.ZodString;
+                    pattern: z.ZodObject<{
+                        readOnlyHint: z.ZodOptional<z.ZodBoolean>;
+                        destructiveHint: z.ZodOptional<z.ZodBoolean>;
+                        idempotentHint: z.ZodOptional<z.ZodBoolean>;
+                        openWorldHint: z.ZodOptional<z.ZodBoolean>;
+                    }, z.core.$strict>;
+                }, z.core.$strict>], "matcher">], "type">>>;
+                raterTimeoutMs: z.ZodOptional<z.ZodNumber>;
+                mcp: z.ZodOptional<z.ZodObject<{
+                    defaults: z.ZodOptional<z.ZodObject<{
+                        trustAnnotations: z.ZodOptional<z.ZodArray<z.ZodEnum<{
+                            destructiveHint: "destructiveHint";
+                            idempotentHint: "idempotentHint";
+                            openWorldHint: "openWorldHint";
+                            readOnlyHint: "readOnlyHint";
+                        }>>>;
+                    }, z.core.$strict>>;
+                    servers: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
+                        trustAnnotations: z.ZodOptional<z.ZodArray<z.ZodEnum<{
+                            destructiveHint: "destructiveHint";
+                            idempotentHint: "idempotentHint";
+                            openWorldHint: "openWorldHint";
+                            readOnlyHint: "readOnlyHint";
+                        }>>>;
+                    }, z.core.$strict>>>;
+                }, z.core.$strict>>;
+            }, z.core.$strip>]>>;
             customTools: z.ZodOptional<z.ZodUnion<readonly [z.ZodLiteral<false>, z.ZodRecord<z.ZodString, z.ZodObject<{
                 command: z.ZodString;
                 description: z.ZodString;
@@ -472,25 +1907,280 @@ export declare const rawGthConfigSchema: z.ZodObject<{
                 command: z.ZodOptional<z.ZodString>;
                 timeout: z.ZodOptional<z.ZodNumber>;
                 maxOutputBytes: z.ZodOptional<z.ZodNumber>;
-                allowlist: z.ZodOptional<z.ZodBoolean>;
-                persistAllowlist: z.ZodOptional<z.ZodBoolean>;
-                judge: z.ZodOptional<z.ZodUnion<readonly [z.ZodBoolean, z.ZodObject<{
-                    enabled: z.ZodOptional<z.ZodBoolean>;
-                    autoApproveLow: z.ZodOptional<z.ZodBoolean>;
-                    blockHigh: z.ZodOptional<z.ZodBoolean>;
-                    model: z.ZodOptional<z.ZodObject<{
-                        type: z.ZodOptional<z.ZodString>;
-                        model: z.ZodOptional<z.ZodString>;
-                        configuration: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
-                        apiKeyEnvironmentVariable: z.ZodOptional<z.ZodString>;
-                    }, z.core.$loose>>;
-                }, z.core.$strip>]>>;
-                yolo: z.ZodOptional<z.ZodBoolean>;
                 fileSet: z.ZodOptional<z.ZodEnum<{
                     all: "all";
                     gitignore: "gitignore";
                 }>>;
             }, z.core.$strip>]>>]>>;
+            approvals: z.ZodOptional<z.ZodUnion<readonly [z.ZodEnum<{
+                "auto-safe": "auto-safe";
+                bypass: "bypass";
+                "full-auto": "full-auto";
+                "read-only": "read-only";
+                write: "write";
+            }>, z.ZodObject<{
+                mode: z.ZodOptional<z.ZodEnum<{
+                    "auto-safe": "auto-safe";
+                    bypass: "bypass";
+                    "full-auto": "full-auto";
+                    "read-only": "read-only";
+                    write: "write";
+                }>>;
+                rater: z.ZodOptional<z.ZodString>;
+                allow: z.ZodOptional<z.ZodArray<z.ZodDiscriminatedUnion<[z.ZodDiscriminatedUnion<[z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    type: z.ZodLiteral<"shell">;
+                    matcher: z.ZodLiteral<"exact">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    type: z.ZodLiteral<"shell">;
+                    matcher: z.ZodLiteral<"glob">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    type: z.ZodLiteral<"shell">;
+                    matcher: z.ZodLiteral<"regexp">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>], "matcher">, z.ZodDiscriminatedUnion<[z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"tool">;
+                    matcher: z.ZodLiteral<"exact">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"tool">;
+                    matcher: z.ZodLiteral<"glob">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"tool">;
+                    matcher: z.ZodLiteral<"regexp">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"tool">;
+                    matcher: z.ZodLiteral<"hint">;
+                    pattern: z.ZodObject<{
+                        readOnlyHint: z.ZodOptional<z.ZodBoolean>;
+                        destructiveHint: z.ZodOptional<z.ZodBoolean>;
+                        idempotentHint: z.ZodOptional<z.ZodBoolean>;
+                        openWorldHint: z.ZodOptional<z.ZodBoolean>;
+                    }, z.core.$strict>;
+                }, z.core.$strict>], "matcher">, z.ZodDiscriminatedUnion<[z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"mcpTool">;
+                    matcher: z.ZodLiteral<"exact">;
+                    server: z.ZodString;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"mcpTool">;
+                    matcher: z.ZodLiteral<"glob">;
+                    server: z.ZodString;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"mcpTool">;
+                    matcher: z.ZodLiteral<"regexp">;
+                    server: z.ZodString;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"mcpTool">;
+                    matcher: z.ZodLiteral<"hint">;
+                    server: z.ZodString;
+                    pattern: z.ZodObject<{
+                        readOnlyHint: z.ZodOptional<z.ZodBoolean>;
+                        destructiveHint: z.ZodOptional<z.ZodBoolean>;
+                        idempotentHint: z.ZodOptional<z.ZodBoolean>;
+                        openWorldHint: z.ZodOptional<z.ZodBoolean>;
+                    }, z.core.$strict>;
+                }, z.core.$strict>], "matcher">], "type">>>;
+                deny: z.ZodOptional<z.ZodArray<z.ZodDiscriminatedUnion<[z.ZodDiscriminatedUnion<[z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    type: z.ZodLiteral<"shell">;
+                    matcher: z.ZodLiteral<"exact">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    type: z.ZodLiteral<"shell">;
+                    matcher: z.ZodLiteral<"glob">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    type: z.ZodLiteral<"shell">;
+                    matcher: z.ZodLiteral<"regexp">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>], "matcher">, z.ZodDiscriminatedUnion<[z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"tool">;
+                    matcher: z.ZodLiteral<"exact">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"tool">;
+                    matcher: z.ZodLiteral<"glob">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"tool">;
+                    matcher: z.ZodLiteral<"regexp">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"tool">;
+                    matcher: z.ZodLiteral<"hint">;
+                    pattern: z.ZodObject<{
+                        readOnlyHint: z.ZodOptional<z.ZodBoolean>;
+                        destructiveHint: z.ZodOptional<z.ZodBoolean>;
+                        idempotentHint: z.ZodOptional<z.ZodBoolean>;
+                        openWorldHint: z.ZodOptional<z.ZodBoolean>;
+                    }, z.core.$strict>;
+                }, z.core.$strict>], "matcher">, z.ZodDiscriminatedUnion<[z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"mcpTool">;
+                    matcher: z.ZodLiteral<"exact">;
+                    server: z.ZodString;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"mcpTool">;
+                    matcher: z.ZodLiteral<"glob">;
+                    server: z.ZodString;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"mcpTool">;
+                    matcher: z.ZodLiteral<"regexp">;
+                    server: z.ZodString;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"mcpTool">;
+                    matcher: z.ZodLiteral<"hint">;
+                    server: z.ZodString;
+                    pattern: z.ZodObject<{
+                        readOnlyHint: z.ZodOptional<z.ZodBoolean>;
+                        destructiveHint: z.ZodOptional<z.ZodBoolean>;
+                        idempotentHint: z.ZodOptional<z.ZodBoolean>;
+                        openWorldHint: z.ZodOptional<z.ZodBoolean>;
+                    }, z.core.$strict>;
+                }, z.core.$strict>], "matcher">], "type">>>;
+                escalate: z.ZodOptional<z.ZodArray<z.ZodDiscriminatedUnion<[z.ZodDiscriminatedUnion<[z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    type: z.ZodLiteral<"shell">;
+                    matcher: z.ZodLiteral<"exact">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    type: z.ZodLiteral<"shell">;
+                    matcher: z.ZodLiteral<"glob">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    type: z.ZodLiteral<"shell">;
+                    matcher: z.ZodLiteral<"regexp">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>], "matcher">, z.ZodDiscriminatedUnion<[z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"tool">;
+                    matcher: z.ZodLiteral<"exact">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"tool">;
+                    matcher: z.ZodLiteral<"glob">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"tool">;
+                    matcher: z.ZodLiteral<"regexp">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"tool">;
+                    matcher: z.ZodLiteral<"hint">;
+                    pattern: z.ZodObject<{
+                        readOnlyHint: z.ZodOptional<z.ZodBoolean>;
+                        destructiveHint: z.ZodOptional<z.ZodBoolean>;
+                        idempotentHint: z.ZodOptional<z.ZodBoolean>;
+                        openWorldHint: z.ZodOptional<z.ZodBoolean>;
+                    }, z.core.$strict>;
+                }, z.core.$strict>], "matcher">, z.ZodDiscriminatedUnion<[z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"mcpTool">;
+                    matcher: z.ZodLiteral<"exact">;
+                    server: z.ZodString;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"mcpTool">;
+                    matcher: z.ZodLiteral<"glob">;
+                    server: z.ZodString;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"mcpTool">;
+                    matcher: z.ZodLiteral<"regexp">;
+                    server: z.ZodString;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"mcpTool">;
+                    matcher: z.ZodLiteral<"hint">;
+                    server: z.ZodString;
+                    pattern: z.ZodObject<{
+                        readOnlyHint: z.ZodOptional<z.ZodBoolean>;
+                        destructiveHint: z.ZodOptional<z.ZodBoolean>;
+                        idempotentHint: z.ZodOptional<z.ZodBoolean>;
+                        openWorldHint: z.ZodOptional<z.ZodBoolean>;
+                    }, z.core.$strict>;
+                }, z.core.$strict>], "matcher">], "type">>>;
+                raterTimeoutMs: z.ZodOptional<z.ZodNumber>;
+                mcp: z.ZodOptional<z.ZodObject<{
+                    defaults: z.ZodOptional<z.ZodObject<{
+                        trustAnnotations: z.ZodOptional<z.ZodArray<z.ZodEnum<{
+                            destructiveHint: "destructiveHint";
+                            idempotentHint: "idempotentHint";
+                            openWorldHint: "openWorldHint";
+                            readOnlyHint: "readOnlyHint";
+                        }>>>;
+                    }, z.core.$strict>>;
+                    servers: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
+                        trustAnnotations: z.ZodOptional<z.ZodArray<z.ZodEnum<{
+                            destructiveHint: "destructiveHint";
+                            idempotentHint: "idempotentHint";
+                            openWorldHint: "openWorldHint";
+                            readOnlyHint: "readOnlyHint";
+                        }>>>;
+                    }, z.core.$strict>>>;
+                }, z.core.$strict>>;
+            }, z.core.$strip>]>>;
             customTools: z.ZodOptional<z.ZodUnion<readonly [z.ZodLiteral<false>, z.ZodRecord<z.ZodString, z.ZodObject<{
                 command: z.ZodString;
                 description: z.ZodString;
@@ -530,25 +2220,280 @@ export declare const rawGthConfigSchema: z.ZodObject<{
                 command: z.ZodOptional<z.ZodString>;
                 timeout: z.ZodOptional<z.ZodNumber>;
                 maxOutputBytes: z.ZodOptional<z.ZodNumber>;
-                allowlist: z.ZodOptional<z.ZodBoolean>;
-                persistAllowlist: z.ZodOptional<z.ZodBoolean>;
-                judge: z.ZodOptional<z.ZodUnion<readonly [z.ZodBoolean, z.ZodObject<{
-                    enabled: z.ZodOptional<z.ZodBoolean>;
-                    autoApproveLow: z.ZodOptional<z.ZodBoolean>;
-                    blockHigh: z.ZodOptional<z.ZodBoolean>;
-                    model: z.ZodOptional<z.ZodObject<{
-                        type: z.ZodOptional<z.ZodString>;
-                        model: z.ZodOptional<z.ZodString>;
-                        configuration: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
-                        apiKeyEnvironmentVariable: z.ZodOptional<z.ZodString>;
-                    }, z.core.$loose>>;
-                }, z.core.$strip>]>>;
-                yolo: z.ZodOptional<z.ZodBoolean>;
                 fileSet: z.ZodOptional<z.ZodEnum<{
                     all: "all";
                     gitignore: "gitignore";
                 }>>;
             }, z.core.$strip>]>>]>>;
+            approvals: z.ZodOptional<z.ZodUnion<readonly [z.ZodEnum<{
+                "auto-safe": "auto-safe";
+                bypass: "bypass";
+                "full-auto": "full-auto";
+                "read-only": "read-only";
+                write: "write";
+            }>, z.ZodObject<{
+                mode: z.ZodOptional<z.ZodEnum<{
+                    "auto-safe": "auto-safe";
+                    bypass: "bypass";
+                    "full-auto": "full-auto";
+                    "read-only": "read-only";
+                    write: "write";
+                }>>;
+                rater: z.ZodOptional<z.ZodString>;
+                allow: z.ZodOptional<z.ZodArray<z.ZodDiscriminatedUnion<[z.ZodDiscriminatedUnion<[z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    type: z.ZodLiteral<"shell">;
+                    matcher: z.ZodLiteral<"exact">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    type: z.ZodLiteral<"shell">;
+                    matcher: z.ZodLiteral<"glob">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    type: z.ZodLiteral<"shell">;
+                    matcher: z.ZodLiteral<"regexp">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>], "matcher">, z.ZodDiscriminatedUnion<[z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"tool">;
+                    matcher: z.ZodLiteral<"exact">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"tool">;
+                    matcher: z.ZodLiteral<"glob">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"tool">;
+                    matcher: z.ZodLiteral<"regexp">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"tool">;
+                    matcher: z.ZodLiteral<"hint">;
+                    pattern: z.ZodObject<{
+                        readOnlyHint: z.ZodOptional<z.ZodBoolean>;
+                        destructiveHint: z.ZodOptional<z.ZodBoolean>;
+                        idempotentHint: z.ZodOptional<z.ZodBoolean>;
+                        openWorldHint: z.ZodOptional<z.ZodBoolean>;
+                    }, z.core.$strict>;
+                }, z.core.$strict>], "matcher">, z.ZodDiscriminatedUnion<[z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"mcpTool">;
+                    matcher: z.ZodLiteral<"exact">;
+                    server: z.ZodString;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"mcpTool">;
+                    matcher: z.ZodLiteral<"glob">;
+                    server: z.ZodString;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"mcpTool">;
+                    matcher: z.ZodLiteral<"regexp">;
+                    server: z.ZodString;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"mcpTool">;
+                    matcher: z.ZodLiteral<"hint">;
+                    server: z.ZodString;
+                    pattern: z.ZodObject<{
+                        readOnlyHint: z.ZodOptional<z.ZodBoolean>;
+                        destructiveHint: z.ZodOptional<z.ZodBoolean>;
+                        idempotentHint: z.ZodOptional<z.ZodBoolean>;
+                        openWorldHint: z.ZodOptional<z.ZodBoolean>;
+                    }, z.core.$strict>;
+                }, z.core.$strict>], "matcher">], "type">>>;
+                deny: z.ZodOptional<z.ZodArray<z.ZodDiscriminatedUnion<[z.ZodDiscriminatedUnion<[z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    type: z.ZodLiteral<"shell">;
+                    matcher: z.ZodLiteral<"exact">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    type: z.ZodLiteral<"shell">;
+                    matcher: z.ZodLiteral<"glob">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    type: z.ZodLiteral<"shell">;
+                    matcher: z.ZodLiteral<"regexp">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>], "matcher">, z.ZodDiscriminatedUnion<[z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"tool">;
+                    matcher: z.ZodLiteral<"exact">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"tool">;
+                    matcher: z.ZodLiteral<"glob">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"tool">;
+                    matcher: z.ZodLiteral<"regexp">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"tool">;
+                    matcher: z.ZodLiteral<"hint">;
+                    pattern: z.ZodObject<{
+                        readOnlyHint: z.ZodOptional<z.ZodBoolean>;
+                        destructiveHint: z.ZodOptional<z.ZodBoolean>;
+                        idempotentHint: z.ZodOptional<z.ZodBoolean>;
+                        openWorldHint: z.ZodOptional<z.ZodBoolean>;
+                    }, z.core.$strict>;
+                }, z.core.$strict>], "matcher">, z.ZodDiscriminatedUnion<[z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"mcpTool">;
+                    matcher: z.ZodLiteral<"exact">;
+                    server: z.ZodString;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"mcpTool">;
+                    matcher: z.ZodLiteral<"glob">;
+                    server: z.ZodString;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"mcpTool">;
+                    matcher: z.ZodLiteral<"regexp">;
+                    server: z.ZodString;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"mcpTool">;
+                    matcher: z.ZodLiteral<"hint">;
+                    server: z.ZodString;
+                    pattern: z.ZodObject<{
+                        readOnlyHint: z.ZodOptional<z.ZodBoolean>;
+                        destructiveHint: z.ZodOptional<z.ZodBoolean>;
+                        idempotentHint: z.ZodOptional<z.ZodBoolean>;
+                        openWorldHint: z.ZodOptional<z.ZodBoolean>;
+                    }, z.core.$strict>;
+                }, z.core.$strict>], "matcher">], "type">>>;
+                escalate: z.ZodOptional<z.ZodArray<z.ZodDiscriminatedUnion<[z.ZodDiscriminatedUnion<[z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    type: z.ZodLiteral<"shell">;
+                    matcher: z.ZodLiteral<"exact">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    type: z.ZodLiteral<"shell">;
+                    matcher: z.ZodLiteral<"glob">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    type: z.ZodLiteral<"shell">;
+                    matcher: z.ZodLiteral<"regexp">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>], "matcher">, z.ZodDiscriminatedUnion<[z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"tool">;
+                    matcher: z.ZodLiteral<"exact">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"tool">;
+                    matcher: z.ZodLiteral<"glob">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"tool">;
+                    matcher: z.ZodLiteral<"regexp">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"tool">;
+                    matcher: z.ZodLiteral<"hint">;
+                    pattern: z.ZodObject<{
+                        readOnlyHint: z.ZodOptional<z.ZodBoolean>;
+                        destructiveHint: z.ZodOptional<z.ZodBoolean>;
+                        idempotentHint: z.ZodOptional<z.ZodBoolean>;
+                        openWorldHint: z.ZodOptional<z.ZodBoolean>;
+                    }, z.core.$strict>;
+                }, z.core.$strict>], "matcher">, z.ZodDiscriminatedUnion<[z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"mcpTool">;
+                    matcher: z.ZodLiteral<"exact">;
+                    server: z.ZodString;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"mcpTool">;
+                    matcher: z.ZodLiteral<"glob">;
+                    server: z.ZodString;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"mcpTool">;
+                    matcher: z.ZodLiteral<"regexp">;
+                    server: z.ZodString;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"mcpTool">;
+                    matcher: z.ZodLiteral<"hint">;
+                    server: z.ZodString;
+                    pattern: z.ZodObject<{
+                        readOnlyHint: z.ZodOptional<z.ZodBoolean>;
+                        destructiveHint: z.ZodOptional<z.ZodBoolean>;
+                        idempotentHint: z.ZodOptional<z.ZodBoolean>;
+                        openWorldHint: z.ZodOptional<z.ZodBoolean>;
+                    }, z.core.$strict>;
+                }, z.core.$strict>], "matcher">], "type">>>;
+                raterTimeoutMs: z.ZodOptional<z.ZodNumber>;
+                mcp: z.ZodOptional<z.ZodObject<{
+                    defaults: z.ZodOptional<z.ZodObject<{
+                        trustAnnotations: z.ZodOptional<z.ZodArray<z.ZodEnum<{
+                            destructiveHint: "destructiveHint";
+                            idempotentHint: "idempotentHint";
+                            openWorldHint: "openWorldHint";
+                            readOnlyHint: "readOnlyHint";
+                        }>>>;
+                    }, z.core.$strict>>;
+                    servers: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
+                        trustAnnotations: z.ZodOptional<z.ZodArray<z.ZodEnum<{
+                            destructiveHint: "destructiveHint";
+                            idempotentHint: "idempotentHint";
+                            openWorldHint: "openWorldHint";
+                            readOnlyHint: "readOnlyHint";
+                        }>>>;
+                    }, z.core.$strict>>>;
+                }, z.core.$strict>>;
+            }, z.core.$strip>]>>;
             customTools: z.ZodOptional<z.ZodUnion<readonly [z.ZodLiteral<false>, z.ZodRecord<z.ZodString, z.ZodObject<{
                 command: z.ZodString;
                 description: z.ZodString;
@@ -588,25 +2533,280 @@ export declare const rawGthConfigSchema: z.ZodObject<{
                 command: z.ZodOptional<z.ZodString>;
                 timeout: z.ZodOptional<z.ZodNumber>;
                 maxOutputBytes: z.ZodOptional<z.ZodNumber>;
-                allowlist: z.ZodOptional<z.ZodBoolean>;
-                persistAllowlist: z.ZodOptional<z.ZodBoolean>;
-                judge: z.ZodOptional<z.ZodUnion<readonly [z.ZodBoolean, z.ZodObject<{
-                    enabled: z.ZodOptional<z.ZodBoolean>;
-                    autoApproveLow: z.ZodOptional<z.ZodBoolean>;
-                    blockHigh: z.ZodOptional<z.ZodBoolean>;
-                    model: z.ZodOptional<z.ZodObject<{
-                        type: z.ZodOptional<z.ZodString>;
-                        model: z.ZodOptional<z.ZodString>;
-                        configuration: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
-                        apiKeyEnvironmentVariable: z.ZodOptional<z.ZodString>;
-                    }, z.core.$loose>>;
-                }, z.core.$strip>]>>;
-                yolo: z.ZodOptional<z.ZodBoolean>;
                 fileSet: z.ZodOptional<z.ZodEnum<{
                     all: "all";
                     gitignore: "gitignore";
                 }>>;
             }, z.core.$strip>]>>]>>;
+            approvals: z.ZodOptional<z.ZodUnion<readonly [z.ZodEnum<{
+                "auto-safe": "auto-safe";
+                bypass: "bypass";
+                "full-auto": "full-auto";
+                "read-only": "read-only";
+                write: "write";
+            }>, z.ZodObject<{
+                mode: z.ZodOptional<z.ZodEnum<{
+                    "auto-safe": "auto-safe";
+                    bypass: "bypass";
+                    "full-auto": "full-auto";
+                    "read-only": "read-only";
+                    write: "write";
+                }>>;
+                rater: z.ZodOptional<z.ZodString>;
+                allow: z.ZodOptional<z.ZodArray<z.ZodDiscriminatedUnion<[z.ZodDiscriminatedUnion<[z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    type: z.ZodLiteral<"shell">;
+                    matcher: z.ZodLiteral<"exact">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    type: z.ZodLiteral<"shell">;
+                    matcher: z.ZodLiteral<"glob">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    type: z.ZodLiteral<"shell">;
+                    matcher: z.ZodLiteral<"regexp">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>], "matcher">, z.ZodDiscriminatedUnion<[z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"tool">;
+                    matcher: z.ZodLiteral<"exact">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"tool">;
+                    matcher: z.ZodLiteral<"glob">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"tool">;
+                    matcher: z.ZodLiteral<"regexp">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"tool">;
+                    matcher: z.ZodLiteral<"hint">;
+                    pattern: z.ZodObject<{
+                        readOnlyHint: z.ZodOptional<z.ZodBoolean>;
+                        destructiveHint: z.ZodOptional<z.ZodBoolean>;
+                        idempotentHint: z.ZodOptional<z.ZodBoolean>;
+                        openWorldHint: z.ZodOptional<z.ZodBoolean>;
+                    }, z.core.$strict>;
+                }, z.core.$strict>], "matcher">, z.ZodDiscriminatedUnion<[z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"mcpTool">;
+                    matcher: z.ZodLiteral<"exact">;
+                    server: z.ZodString;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"mcpTool">;
+                    matcher: z.ZodLiteral<"glob">;
+                    server: z.ZodString;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"mcpTool">;
+                    matcher: z.ZodLiteral<"regexp">;
+                    server: z.ZodString;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"mcpTool">;
+                    matcher: z.ZodLiteral<"hint">;
+                    server: z.ZodString;
+                    pattern: z.ZodObject<{
+                        readOnlyHint: z.ZodOptional<z.ZodBoolean>;
+                        destructiveHint: z.ZodOptional<z.ZodBoolean>;
+                        idempotentHint: z.ZodOptional<z.ZodBoolean>;
+                        openWorldHint: z.ZodOptional<z.ZodBoolean>;
+                    }, z.core.$strict>;
+                }, z.core.$strict>], "matcher">], "type">>>;
+                deny: z.ZodOptional<z.ZodArray<z.ZodDiscriminatedUnion<[z.ZodDiscriminatedUnion<[z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    type: z.ZodLiteral<"shell">;
+                    matcher: z.ZodLiteral<"exact">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    type: z.ZodLiteral<"shell">;
+                    matcher: z.ZodLiteral<"glob">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    type: z.ZodLiteral<"shell">;
+                    matcher: z.ZodLiteral<"regexp">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>], "matcher">, z.ZodDiscriminatedUnion<[z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"tool">;
+                    matcher: z.ZodLiteral<"exact">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"tool">;
+                    matcher: z.ZodLiteral<"glob">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"tool">;
+                    matcher: z.ZodLiteral<"regexp">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"tool">;
+                    matcher: z.ZodLiteral<"hint">;
+                    pattern: z.ZodObject<{
+                        readOnlyHint: z.ZodOptional<z.ZodBoolean>;
+                        destructiveHint: z.ZodOptional<z.ZodBoolean>;
+                        idempotentHint: z.ZodOptional<z.ZodBoolean>;
+                        openWorldHint: z.ZodOptional<z.ZodBoolean>;
+                    }, z.core.$strict>;
+                }, z.core.$strict>], "matcher">, z.ZodDiscriminatedUnion<[z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"mcpTool">;
+                    matcher: z.ZodLiteral<"exact">;
+                    server: z.ZodString;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"mcpTool">;
+                    matcher: z.ZodLiteral<"glob">;
+                    server: z.ZodString;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"mcpTool">;
+                    matcher: z.ZodLiteral<"regexp">;
+                    server: z.ZodString;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"mcpTool">;
+                    matcher: z.ZodLiteral<"hint">;
+                    server: z.ZodString;
+                    pattern: z.ZodObject<{
+                        readOnlyHint: z.ZodOptional<z.ZodBoolean>;
+                        destructiveHint: z.ZodOptional<z.ZodBoolean>;
+                        idempotentHint: z.ZodOptional<z.ZodBoolean>;
+                        openWorldHint: z.ZodOptional<z.ZodBoolean>;
+                    }, z.core.$strict>;
+                }, z.core.$strict>], "matcher">], "type">>>;
+                escalate: z.ZodOptional<z.ZodArray<z.ZodDiscriminatedUnion<[z.ZodDiscriminatedUnion<[z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    type: z.ZodLiteral<"shell">;
+                    matcher: z.ZodLiteral<"exact">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    type: z.ZodLiteral<"shell">;
+                    matcher: z.ZodLiteral<"glob">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    type: z.ZodLiteral<"shell">;
+                    matcher: z.ZodLiteral<"regexp">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>], "matcher">, z.ZodDiscriminatedUnion<[z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"tool">;
+                    matcher: z.ZodLiteral<"exact">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"tool">;
+                    matcher: z.ZodLiteral<"glob">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"tool">;
+                    matcher: z.ZodLiteral<"regexp">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"tool">;
+                    matcher: z.ZodLiteral<"hint">;
+                    pattern: z.ZodObject<{
+                        readOnlyHint: z.ZodOptional<z.ZodBoolean>;
+                        destructiveHint: z.ZodOptional<z.ZodBoolean>;
+                        idempotentHint: z.ZodOptional<z.ZodBoolean>;
+                        openWorldHint: z.ZodOptional<z.ZodBoolean>;
+                    }, z.core.$strict>;
+                }, z.core.$strict>], "matcher">, z.ZodDiscriminatedUnion<[z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"mcpTool">;
+                    matcher: z.ZodLiteral<"exact">;
+                    server: z.ZodString;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"mcpTool">;
+                    matcher: z.ZodLiteral<"glob">;
+                    server: z.ZodString;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"mcpTool">;
+                    matcher: z.ZodLiteral<"regexp">;
+                    server: z.ZodString;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"mcpTool">;
+                    matcher: z.ZodLiteral<"hint">;
+                    server: z.ZodString;
+                    pattern: z.ZodObject<{
+                        readOnlyHint: z.ZodOptional<z.ZodBoolean>;
+                        destructiveHint: z.ZodOptional<z.ZodBoolean>;
+                        idempotentHint: z.ZodOptional<z.ZodBoolean>;
+                        openWorldHint: z.ZodOptional<z.ZodBoolean>;
+                    }, z.core.$strict>;
+                }, z.core.$strict>], "matcher">], "type">>>;
+                raterTimeoutMs: z.ZodOptional<z.ZodNumber>;
+                mcp: z.ZodOptional<z.ZodObject<{
+                    defaults: z.ZodOptional<z.ZodObject<{
+                        trustAnnotations: z.ZodOptional<z.ZodArray<z.ZodEnum<{
+                            destructiveHint: "destructiveHint";
+                            idempotentHint: "idempotentHint";
+                            openWorldHint: "openWorldHint";
+                            readOnlyHint: "readOnlyHint";
+                        }>>>;
+                    }, z.core.$strict>>;
+                    servers: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
+                        trustAnnotations: z.ZodOptional<z.ZodArray<z.ZodEnum<{
+                            destructiveHint: "destructiveHint";
+                            idempotentHint: "idempotentHint";
+                            openWorldHint: "openWorldHint";
+                            readOnlyHint: "readOnlyHint";
+                        }>>>;
+                    }, z.core.$strict>>>;
+                }, z.core.$strict>>;
+            }, z.core.$strip>]>>;
             port: z.ZodOptional<z.ZodNumber>;
             cors: z.ZodOptional<z.ZodObject<{
                 allowOrigin: z.ZodOptional<z.ZodString>;
@@ -693,7 +2893,13 @@ export interface DeprecatedConfigIssue {
  * - (C) a deprecated `*Provider*` name ({@link DEPRECATED_ROOT_PAIRS} at root,
  *   {@link DEPRECATED_COMMAND_PAIRS} per command) — must use its `*Source*` replacement;
  * - (D, CFG-18) a removed per-command key folded into another ({@link REMOVED_COMMAND_KEYS}, e.g.
- *   `commands.<cmd>.devTools` → configure under `builtInTools`).
+ *   `commands.<cmd>.devTools` → configure under `builtInTools`);
+ * - (E, CFG-26) a retired `run_shell_command` approval knob ({@link RETIRED_SHELL_TOOL_PAIRS}) at
+ *   EITHER `builtInTools.run_shell_command.*` or `commands.<cmd>.builtInTools.run_shell_command.*`
+ *   — each message names the `approvals.*` key that replaced it;
+ * - (F, CFG-27) a retired `approvals` key or `mode` value ({@link RETIRED_APPROVALS_KEYS},
+ *   {@link RETIRED_APPROVAL_MODES}) at EITHER `approvals.*` or `commands.<cmd>.approvals.*` —
+ *   each message names the rung that replaced it.
  *
  * Runs on the raw input specifically so nested `commands.*.contentProvider` is still visible
  * (zod's per-command `z.object` would strip it before any schema-embedded check could fire).
@@ -701,6 +2907,50 @@ export interface DeprecatedConfigIssue {
  * the deliberate typo-tolerance.
  */
 export declare function findDeprecatedConfigIssues(raw: Record<string, unknown>): DeprecatedConfigIssue[];
+/**
+ * EXT-71 §3.1 — every hard error the rule grammar defines, found on the RAW input: each entry in
+ * `allow`/`deny`/`escalate` validated with a path that names the offending field
+ * ({@link collectApprovalEntryIssues}), the `approvals.mcp` block ({@link collectMcpApprovalsIssues}),
+ * and the two `mcpServers` keys no rule can refer to — `*` ({@link RESERVED_MCP_SERVER_NAME}, which
+ * an entry already reads as "every server") and the empty name
+ * ({@link UNNAMEABLE_MCP_SERVER_NAME}, which no entry's `server` field can hold). Both need to see
+ * `mcpServers`, a sibling of `approvals` rather than a field of it.
+ *
+ * All of them are HARD errors, reported the same way {@link findDeprecatedConfigIssues} reports
+ * its own, and — like it — this runs BEFORE the schema parse so the precise message is the only
+ * one the user sees.
+ *
+ * PURE: it only reads the object. Kept separate from {@link findDeprecatedConfigIssues} because
+ * these are not removed pre-2.0 shapes; they are rules of the current grammar.
+ */
+export declare function findApprovalsGrammarIssues(raw: Record<string, unknown>): DeprecatedConfigIssue[];
+/**
+ * CFG-26 — one `approvals.rater` reference found in a raw config, with the dotted config path it
+ * was found at (`approvals.rater` or `commands.<name>.approvals.rater`).
+ */
+export interface RaterProfileRef {
+    /** Dotted config path of the `rater` key, for the error message. */
+    path: string;
+    /** The profile name as written. */
+    profile: string;
+}
+/**
+ * CFG-26 — collect every `approvals.rater` in a raw config (root + each `commands.<name>`).
+ * CFG-27 flattened the key: it is a BARE identity-profile name, not `rater.profile`.
+ *
+ * PURE — it only reads the object; the caller decides whether each name RESOLVES. That split is
+ * deliberate: profile resolution needs the filesystem, and `schema.ts` must stay pure so
+ * `z.toJSONSchema` and every spec that validates a config object stay cwd-independent. The loader
+ * pairs this with `resolveIdentityProfileConfigPath` to enforce the GS2-62 rule that an
+ * unresolvable profile is a hard error, never a silent fallback to the main model.
+ */
+export declare function findApprovalsRaterProfiles(raw: Record<string, unknown>): RaterProfileRef[];
+/**
+ * CFG-26 — the ONE message for an `approvals.rater.profile` that does not resolve. Shared by the
+ * loader (which hard-exits a real run) and {@link validateRawGthConfig} (which backs
+ * `gth config validate`), so the validator can never green-light a config the runtime refuses.
+ */
+export declare function unresolvedRaterProfileMessage(ref: RaterProfileRef): string;
 /**
  * Render {@link DeprecatedConfigIssue}s as the same `  - <path>: <message>` block used for
  * Zod validation errors, so a deprecated-shape rejection reads identically to a type-mismatch
@@ -719,6 +2969,14 @@ export declare function generateConfigJsonSchema(): Record<string, unknown>;
  * loader's `validateRawConfigLayer` (which warns + `exit`s inline): `gth config validate`
  * uses it to render its own output and choose its own exit code.
  */
+export interface RawConfigValidationOptions {
+    /**
+     * CFG-26 — resolves an identity profile NAME to "does it exist?". Supplied by the loader
+     * (`resolveIdentityProfileConfigPath`); omitted by pure/in-memory callers, which then skip the
+     * `approvals.rater.profile` existence check.
+     */
+    resolveProfile?: (profile: string) => boolean;
+}
 export interface RawConfigValidationResult {
     /** True when the config parses against the schema (unknown keys do NOT make it false). */
     ok: boolean;
@@ -737,4 +2995,4 @@ export interface RawConfigValidationResult {
  * Read-only: `findDeprecatedConfigIssues`, `findUnknownTopLevelKeys` and `safeParse` never
  * mutate `raw`, so no defensive copy is needed.
  */
-export declare function validateRawGthConfig(raw: Record<string, unknown>): RawConfigValidationResult;
+export declare function validateRawGthConfig(raw: Record<string, unknown>, options?: RawConfigValidationOptions): RawConfigValidationResult;