@gaunt-sloth/core 2.0.0-alpha.4 → 2.0.0-alpha.40

package/dist/config/schema.d.ts

@@ -6,15 +6,22 @@
  * JSON Schema (`packages/core/schema/gsloth-config.schema.json`). It models the
  * canonical config shape only — the deprecated aliases (`contentProvider`,
  * `requirementsProvider`, `contentProviderConfig`, `requirementsProviderConfig`)
- * are intentionally NOT part of the schema. The loader maps those one-way to the
- * canonical names ({@link preMapDeprecatedConfigNames}) BEFORE validating, so by
- * the time a config reaches the schema it only uses canonical names.
+ * are intentionally NOT part of the schema. GS2-28 (a 2.0 breaking release with NO
+ * back-compat coercion) turns those deprecated shapes into HARD validation errors:
+ * {@link findDeprecatedConfigIssues} detects them on the raw input BEFORE the schema
+ * parse and each entry point (loader `validateRawConfigLayer`, read-side
+ * {@link validateRawGthConfig}) rejects the config with a message naming the canonical
+ * replacement + migration path. Detection runs on the RAW input on purpose: zod's
+ * per-command `z.object` strips unknown keys, so a nested `commands.*.contentProvider`
+ * would vanish before any schema-embedded check could see it.
  *
  * Design notes:
  * - The top-level object is a {@link z.looseObject} so unknown keys PASS THROUGH
  *   (they are neither stripped nor a hard failure). The loader separately diffs
  *   present-vs-known top-level keys ({@link findUnknownTopLevelKeys}) to warn about
- *   likely typos without failing.
+ *   likely typos without failing. That typo-tolerance is deliberate: only the KNOWN
+ *   deprecated names ({@link findDeprecatedConfigIssues}) hard-fail; a genuine typo
+ *   (e.g. `pulrequest`) still only warns.
  * - Every field is optional. The schema validates the *shape/type of what is
  *   present*, not requiredness. In particular `llm` is optional so the loader's
  *   existing "must at least define llm.type" checks remain the authority on llm
@@ -28,6 +35,183 @@
  * is additive and legitimately differs (no deprecated fields).
  */
 import { z } from 'zod';
+/**
+ * GS2-93 — the three rungs `output.header` accepts, in increasing verbosity: `none` opens a run
+ * with nothing at all (including the review attribution), `compact` with one attribution line, and
+ * `debug` with the full technical preamble. `compact` is the default, so an unset key opens with
+ * the single run-header line and the preamble is opt-in.
+ */
+export declare const OUTPUT_HEADER_RUNGS: readonly ['none', 'compact', 'debug'];
+/** The run-header rung, as a type. The read-site default is `compact`. */
+export type GthOutputHeaderRung = (typeof OUTPUT_HEADER_RUNGS)[number];
+/**
+ * EXT-117 — the commands an ACP (editor) session may be resolved under, as `acp.mode`. Both are
+ * existing members of `GthCommand`, which is the whole point of the key: the value is a command the
+ * tool-gating branches already understand rather than a new one they would each have to learn. The
+ * read-site default is `code` ({@link import('#src/config/types.js').GthConfig.acp}).
+ */
+export declare const ACP_SESSION_MODES: readonly ['chat', 'code'];
+/** The command an ACP session resolves under, as a type. The read-site default is `code`. */
+export type GthAcpSessionMode = (typeof ACP_SESSION_MODES)[number];
+/**
+ * EXT-71 §3.1 — the **subject** axis of a rule entry, and only that: `shell` is a command, `tool`
+ * a built-in or custom in-process tool, `mcpTool` a server's tool. The hand-written twin is
+ * `ApprovalEntryType` in `shell-policy.ts`. What holds the two together is
+ * `approvalEntrySchema.spec.ts`, where a list of `ApprovalEntry`-typed literals is parsed by this
+ * schema: a value either side stops accepting fails there. That is a weaker pin than a direct
+ * equality assertion — it catches a narrowing, not a widening on one side alone.
+ */
+export declare const APPROVAL_ENTRY_TYPES: readonly ['shell', 'tool', 'mcpTool'];
+/**
+ * EXT-71 §3.1 — the **comparison** axis of a rule entry, and only that. `exact`/`glob`/`regexp`
+ * take a string pattern; `hint` takes an object over the annotation names and is valid on tool
+ * subjects only (on `shell` it is a config error — see {@link shellEntrySchema}).
+ */
+export declare const APPROVAL_ENTRY_MATCHERS: readonly ['exact', 'glob', 'regexp', 'hint'];
+/**
+ * EXT-71 §3.1 / §4.7 — the four MCP `ToolAnnotations` booleans a `hint` pattern may name, and the
+ * names a user may list in `approvals.mcp.*.trustAnnotations` (§4.7.1). This is the whole
+ * vocabulary: an unknown name is a config error, never an ignored key, because a hint pattern that
+ * quietly drops a constraint matches MORE than its author wrote, and a trust list that quietly
+ * drops one reads as working while believing something else.
+ *
+ * **The runtime twin `TOOL_ANNOTATION_HINTS` in `shell-policy.ts` is a deliberate duplicate, and
+ * the reason is layering, not oversight.** Neither file may import the other. This module must stay
+ * pure and cwd/fs-independent because it feeds `z.toJSONSchema()` (see the header), and importing
+ * `shell-policy.ts` would pull `core/types.js` and the whole runtime policy surface into it;
+ * importing this module from there would in turn pull zod into every module that only wanted a
+ * policy type. So the vocabulary is written once per layer on purpose — do not "simplify" it by
+ * making one import the other. The equality assertion in `mcpApprovalsBlock.spec.ts` is what fails
+ * when they drift.
+ */
+export declare const HINT_ANNOTATION_KEYS: readonly ['readOnlyHint', 'destructiveHint', 'idempotentHint', 'openWorldHint'];
+/**
+ * EXT-71 §3.1 — the length cap on a `regexp` pattern, enforced when the config LOADS.
+ *
+ * 200 characters. The longest pattern the spec itself writes is under 40, and every rule entry
+ * names one command or tool shape rather than a grammar, so 200 is an order of magnitude of
+ * headroom over real use while still bounding what the matcher can ever be handed. The cap is a
+ * cheap load-time bound, NOT a backtracking defence — a short pattern can backtrack
+ * catastrophically too, and the run-time match budget is the separate backstop for that. What the
+ * cap buys is that a pattern nobody could have read and reviewed cannot be smuggled past load.
+ */
+export declare const APPROVAL_REGEXP_MAX_LENGTH = 200;
+/**
+ * EXT-71 §3.1 — **one** entry in `allow`, `deny` or `escalate`. All three lists take the same
+ * shape, so there is one schema and the list a rule sits in decides only what a match DOES.
+ *
+ * `type`, `matcher` and `pattern` are required on every arm: no field is inferred, and no entry
+ * reads two ways. Every arm is a strict object, so any field the grammar does not define — a typo,
+ * a `server` on a `shell` entry, a `host` on a `shell` entry — is an unrecognized-key error rather
+ * than a silently-ignored key that would widen what the entry matches.
+ *
+ * The `id` is what makes the emitted JSON Schema hoist this union into `$defs` and reference it,
+ * instead of inlining all eleven arms into each of the twenty-four places a rule list appears
+ * (three lists × the root plus seven commands). That is the difference between a schema an editor loads
+ * and one it chokes on, and `$ref` is the standard spelling every JSON Schema consumer already
+ * understands.
+ */
+export declare const approvalEntrySchema: z.ZodDiscriminatedUnion<[z.ZodDiscriminatedUnion<[z.ZodObject<{
+    rate: z.ZodOptional<z.ZodBoolean>;
+    type: z.ZodLiteral<"shell">;
+    matcher: z.ZodLiteral<"exact">;
+    pattern: z.ZodString;
+}, z.core.$strict>, z.ZodObject<{
+    rate: z.ZodOptional<z.ZodBoolean>;
+    type: z.ZodLiteral<"shell">;
+    matcher: z.ZodLiteral<"glob">;
+    pattern: z.ZodString;
+}, z.core.$strict>, z.ZodObject<{
+    rate: z.ZodOptional<z.ZodBoolean>;
+    type: z.ZodLiteral<"shell">;
+    matcher: z.ZodLiteral<"regexp">;
+    pattern: z.ZodString;
+}, z.core.$strict>], "matcher">, z.ZodDiscriminatedUnion<[z.ZodObject<{
+    rate: z.ZodOptional<z.ZodBoolean>;
+    host: z.ZodOptional<z.ZodString>;
+    type: z.ZodLiteral<"tool">;
+    matcher: z.ZodLiteral<"exact">;
+    pattern: z.ZodString;
+}, z.core.$strict>, z.ZodObject<{
+    rate: z.ZodOptional<z.ZodBoolean>;
+    host: z.ZodOptional<z.ZodString>;
+    type: z.ZodLiteral<"tool">;
+    matcher: z.ZodLiteral<"glob">;
+    pattern: z.ZodString;
+}, z.core.$strict>, z.ZodObject<{
+    rate: z.ZodOptional<z.ZodBoolean>;
+    host: z.ZodOptional<z.ZodString>;
+    type: z.ZodLiteral<"tool">;
+    matcher: z.ZodLiteral<"regexp">;
+    pattern: z.ZodString;
+}, z.core.$strict>, z.ZodObject<{
+    rate: z.ZodOptional<z.ZodBoolean>;
+    host: z.ZodOptional<z.ZodString>;
+    type: z.ZodLiteral<"tool">;
+    matcher: z.ZodLiteral<"hint">;
+    pattern: z.ZodObject<{
+        readOnlyHint: z.ZodOptional<z.ZodBoolean>;
+        destructiveHint: z.ZodOptional<z.ZodBoolean>;
+        idempotentHint: z.ZodOptional<z.ZodBoolean>;
+        openWorldHint: z.ZodOptional<z.ZodBoolean>;
+    }, z.core.$strict>;
+}, z.core.$strict>], "matcher">, z.ZodDiscriminatedUnion<[z.ZodObject<{
+    rate: z.ZodOptional<z.ZodBoolean>;
+    host: z.ZodOptional<z.ZodString>;
+    type: z.ZodLiteral<"mcpTool">;
+    matcher: z.ZodLiteral<"exact">;
+    server: z.ZodString;
+    pattern: z.ZodString;
+}, z.core.$strict>, z.ZodObject<{
+    rate: z.ZodOptional<z.ZodBoolean>;
+    host: z.ZodOptional<z.ZodString>;
+    type: z.ZodLiteral<"mcpTool">;
+    matcher: z.ZodLiteral<"glob">;
+    server: z.ZodString;
+    pattern: z.ZodString;
+}, z.core.$strict>, z.ZodObject<{
+    rate: z.ZodOptional<z.ZodBoolean>;
+    host: z.ZodOptional<z.ZodString>;
+    type: z.ZodLiteral<"mcpTool">;
+    matcher: z.ZodLiteral<"regexp">;
+    server: z.ZodString;
+    pattern: z.ZodString;
+}, z.core.$strict>, z.ZodObject<{
+    rate: z.ZodOptional<z.ZodBoolean>;
+    host: z.ZodOptional<z.ZodString>;
+    type: z.ZodLiteral<"mcpTool">;
+    matcher: z.ZodLiteral<"hint">;
+    server: z.ZodString;
+    pattern: z.ZodObject<{
+        readOnlyHint: z.ZodOptional<z.ZodBoolean>;
+        destructiveHint: z.ZodOptional<z.ZodBoolean>;
+        idempotentHint: z.ZodOptional<z.ZodBoolean>;
+        openWorldHint: z.ZodOptional<z.ZodBoolean>;
+    }, z.core.$strict>;
+}, z.core.$strict>], "matcher">], "type">;
+/**
+ * EXT-71 §3.1 — render an entry in the object form the user would write in a config file, with the
+ * fields in grammar order (`type`, `server`, `matcher`, `pattern`, then the optional bounds).
+ *
+ * The ONE place that spelling is produced, because it is shown in two very different moments that
+ * must agree: the load-time error that tells a user what to write instead of their bare string, and
+ * the escalation menu's *this is what will be stored* line (§6). A grant the menu describes one way
+ * and stores another is exactly the drift this design cannot afford.
+ */
+export declare function renderApprovalEntryObject(entry: {
+    type: string;
+    matcher: string;
+    pattern: unknown;
+    server?: string;
+    host?: string;
+    rate?: boolean;
+}): string;
+/**
+ * EXT-71 §2.3/§9.1 — render the object form of a bare string found in a rule list, so the
+ * migration error shows the user the entry they should have written *for their own string*
+ * rather than a generic example.
+ */
+export declare function renderApprovalEntryForString(pattern: string): string;
 /**
  * Zod schema for the raw, on-disk Gaunt Sloth config. Loose at the top level so
  * unknown keys are preserved (warn-only via {@link findUnknownTopLevelKeys}).
@@ -40,13 +224,26 @@ export declare const rawGthConfigSchema: z.ZodObject<{
         configuration: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
         apiKeyEnvironmentVariable: z.ZodOptional<z.ZodString>;
     }, z.core.$loose>>;
+    extends: z.ZodOptional<z.ZodString>;
+    agent: z.ZodOptional<z.ZodObject<{
+        backend: z.ZodOptional<z.ZodEnum<{
+            lean: "lean";
+        }>>;
+    }, z.core.$strip>>;
+    history: z.ZodOptional<z.ZodObject<{
+        enabled: z.ZodOptional<z.ZodBoolean>;
+        dbPath: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>>;
+    memory: z.ZodOptional<z.ZodObject<{
+        enabled: z.ZodOptional<z.ZodBoolean>;
+    }, z.core.$strip>>;
     binaryFormats: z.ZodOptional<z.ZodUnion<readonly [z.ZodLiteral<false>, z.ZodArray<z.ZodObject<{
         type: z.ZodEnum<{
+            audio: "audio";
             binary: "binary";
+            file: "file";
             image: "image";
-            audio: "audio";
             video: "video";
-            file: "file";
         }>;
         extensions: z.ZodArray<z.ZodString>;
         maxSize: z.ZodOptional<z.ZodNumber>;
@@ -56,7 +253,64 @@ export declare const rawGthConfigSchema: z.ZodObject<{
     requirementSource: z.ZodOptional<z.ZodString>;
     contentSourceConfig: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
     requirementSourceConfig: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
-    projectGuidelines: z.ZodOptional<z.ZodString>;
+    prompts: z.ZodOptional<z.ZodObject<{
+        backstory: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodObject<{
+            path: z.ZodOptional<z.ZodString>;
+            enabled: z.ZodOptional<z.ZodBoolean>;
+            mode: z.ZodOptional<z.ZodEnum<{
+                append: "append";
+                replace: "replace";
+            }>>;
+        }, z.core.$strip>]>>;
+        guidelines: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodObject<{
+            path: z.ZodOptional<z.ZodString>;
+            enabled: z.ZodOptional<z.ZodBoolean>;
+            mode: z.ZodOptional<z.ZodEnum<{
+                append: "append";
+                replace: "replace";
+            }>>;
+        }, z.core.$strip>]>>;
+        system: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodObject<{
+            path: z.ZodOptional<z.ZodString>;
+            enabled: z.ZodOptional<z.ZodBoolean>;
+            mode: z.ZodOptional<z.ZodEnum<{
+                append: "append";
+                replace: "replace";
+            }>>;
+        }, z.core.$strip>]>>;
+        chat: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodObject<{
+            path: z.ZodOptional<z.ZodString>;
+            enabled: z.ZodOptional<z.ZodBoolean>;
+            mode: z.ZodOptional<z.ZodEnum<{
+                append: "append";
+                replace: "replace";
+            }>>;
+        }, z.core.$strip>]>>;
+        code: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodObject<{
+            path: z.ZodOptional<z.ZodString>;
+            enabled: z.ZodOptional<z.ZodBoolean>;
+            mode: z.ZodOptional<z.ZodEnum<{
+                append: "append";
+                replace: "replace";
+            }>>;
+        }, z.core.$strip>]>>;
+        exec: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodObject<{
+            path: z.ZodOptional<z.ZodString>;
+            enabled: z.ZodOptional<z.ZodBoolean>;
+            mode: z.ZodOptional<z.ZodEnum<{
+                append: "append";
+                replace: "replace";
+            }>>;
+        }, z.core.$strip>]>>;
+        review: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodObject<{
+            path: z.ZodOptional<z.ZodString>;
+            enabled: z.ZodOptional<z.ZodBoolean>;
+            mode: z.ZodOptional<z.ZodEnum<{
+                append: "append";
+                replace: "replace";
+            }>>;
+        }, z.core.$strip>]>>;
+    }, z.core.$strip>>;
     identityProfile: z.ZodOptional<z.ZodString>;
     includeCurrentDateAfterGuidelines: z.ZodOptional<z.ZodBoolean>;
     organization: z.ZodOptional<z.ZodObject<{
@@ -64,14 +318,292 @@ export declare const rawGthConfigSchema: z.ZodObject<{
         locale: z.ZodOptional<z.ZodString>;
         timezone: z.ZodOptional<z.ZodString>;
     }, z.core.$strip>>;
-    projectReviewInstructions: z.ZodOptional<z.ZodString>;
     noDefaultPrompts: z.ZodOptional<z.ZodBoolean>;
     filesystem: z.ZodOptional<z.ZodUnion<readonly [z.ZodArray<z.ZodString>, z.ZodEnum<{
         all: "all";
-        read: "read";
         none: "none";
+        read: "read";
     }>]>>;
-    builtInTools: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    builtInTools: z.ZodOptional<z.ZodUnion<readonly [z.ZodArray<z.ZodString>, z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodBoolean, z.ZodObject<{
+        enabled: z.ZodOptional<z.ZodBoolean>;
+        command: z.ZodOptional<z.ZodString>;
+        timeout: z.ZodOptional<z.ZodNumber>;
+        maxOutputBytes: z.ZodOptional<z.ZodNumber>;
+        maxBytes: z.ZodOptional<z.ZodNumber>;
+        fileSet: z.ZodOptional<z.ZodEnum<{
+            all: "all";
+            gitignore: "gitignore";
+        }>>;
+    }, z.core.$strip>]>>]>>;
+    approvals: z.ZodOptional<z.ZodUnion<readonly [z.ZodEnum<{
+        assisted: "assisted";
+        auto: "auto";
+        bypass: "bypass";
+        manual: "manual";
+        write: "write";
+    }>, z.ZodObject<{
+        mode: z.ZodOptional<z.ZodEnum<{
+            assisted: "assisted";
+            auto: "auto";
+            bypass: "bypass";
+            manual: "manual";
+            write: "write";
+        }>>;
+        rater: z.ZodOptional<z.ZodString>;
+        allow: z.ZodOptional<z.ZodArray<z.ZodDiscriminatedUnion<[z.ZodDiscriminatedUnion<[z.ZodObject<{
+            rate: z.ZodOptional<z.ZodBoolean>;
+            type: z.ZodLiteral<"shell">;
+            matcher: z.ZodLiteral<"exact">;
+            pattern: z.ZodString;
+        }, z.core.$strict>, z.ZodObject<{
+            rate: z.ZodOptional<z.ZodBoolean>;
+            type: z.ZodLiteral<"shell">;
+            matcher: z.ZodLiteral<"glob">;
+            pattern: z.ZodString;
+        }, z.core.$strict>, z.ZodObject<{
+            rate: z.ZodOptional<z.ZodBoolean>;
+            type: z.ZodLiteral<"shell">;
+            matcher: z.ZodLiteral<"regexp">;
+            pattern: z.ZodString;
+        }, z.core.$strict>], "matcher">, z.ZodDiscriminatedUnion<[z.ZodObject<{
+            rate: z.ZodOptional<z.ZodBoolean>;
+            host: z.ZodOptional<z.ZodString>;
+            type: z.ZodLiteral<"tool">;
+            matcher: z.ZodLiteral<"exact">;
+            pattern: z.ZodString;
+        }, z.core.$strict>, z.ZodObject<{
+            rate: z.ZodOptional<z.ZodBoolean>;
+            host: z.ZodOptional<z.ZodString>;
+            type: z.ZodLiteral<"tool">;
+            matcher: z.ZodLiteral<"glob">;
+            pattern: z.ZodString;
+        }, z.core.$strict>, z.ZodObject<{
+            rate: z.ZodOptional<z.ZodBoolean>;
+            host: z.ZodOptional<z.ZodString>;
+            type: z.ZodLiteral<"tool">;
+            matcher: z.ZodLiteral<"regexp">;
+            pattern: z.ZodString;
+        }, z.core.$strict>, z.ZodObject<{
+            rate: z.ZodOptional<z.ZodBoolean>;
+            host: z.ZodOptional<z.ZodString>;
+            type: z.ZodLiteral<"tool">;
+            matcher: z.ZodLiteral<"hint">;
+            pattern: z.ZodObject<{
+                readOnlyHint: z.ZodOptional<z.ZodBoolean>;
+                destructiveHint: z.ZodOptional<z.ZodBoolean>;
+                idempotentHint: z.ZodOptional<z.ZodBoolean>;
+                openWorldHint: z.ZodOptional<z.ZodBoolean>;
+            }, z.core.$strict>;
+        }, z.core.$strict>], "matcher">, z.ZodDiscriminatedUnion<[z.ZodObject<{
+            rate: z.ZodOptional<z.ZodBoolean>;
+            host: z.ZodOptional<z.ZodString>;
+            type: z.ZodLiteral<"mcpTool">;
+            matcher: z.ZodLiteral<"exact">;
+            server: z.ZodString;
+            pattern: z.ZodString;
+        }, z.core.$strict>, z.ZodObject<{
+            rate: z.ZodOptional<z.ZodBoolean>;
+            host: z.ZodOptional<z.ZodString>;
+            type: z.ZodLiteral<"mcpTool">;
+            matcher: z.ZodLiteral<"glob">;
+            server: z.ZodString;
+            pattern: z.ZodString;
+        }, z.core.$strict>, z.ZodObject<{
+            rate: z.ZodOptional<z.ZodBoolean>;
+            host: z.ZodOptional<z.ZodString>;
+            type: z.ZodLiteral<"mcpTool">;
+            matcher: z.ZodLiteral<"regexp">;
+            server: z.ZodString;
+            pattern: z.ZodString;
+        }, z.core.$strict>, z.ZodObject<{
+            rate: z.ZodOptional<z.ZodBoolean>;
+            host: z.ZodOptional<z.ZodString>;
+            type: z.ZodLiteral<"mcpTool">;
+            matcher: z.ZodLiteral<"hint">;
+            server: z.ZodString;
+            pattern: z.ZodObject<{
+                readOnlyHint: z.ZodOptional<z.ZodBoolean>;
+                destructiveHint: z.ZodOptional<z.ZodBoolean>;
+                idempotentHint: z.ZodOptional<z.ZodBoolean>;
+                openWorldHint: z.ZodOptional<z.ZodBoolean>;
+            }, z.core.$strict>;
+        }, z.core.$strict>], "matcher">], "type">>>;
+        deny: z.ZodOptional<z.ZodArray<z.ZodDiscriminatedUnion<[z.ZodDiscriminatedUnion<[z.ZodObject<{
+            rate: z.ZodOptional<z.ZodBoolean>;
+            type: z.ZodLiteral<"shell">;
+            matcher: z.ZodLiteral<"exact">;
+            pattern: z.ZodString;
+        }, z.core.$strict>, z.ZodObject<{
+            rate: z.ZodOptional<z.ZodBoolean>;
+            type: z.ZodLiteral<"shell">;
+            matcher: z.ZodLiteral<"glob">;
+            pattern: z.ZodString;
+        }, z.core.$strict>, z.ZodObject<{
+            rate: z.ZodOptional<z.ZodBoolean>;
+            type: z.ZodLiteral<"shell">;
+            matcher: z.ZodLiteral<"regexp">;
+            pattern: z.ZodString;
+        }, z.core.$strict>], "matcher">, z.ZodDiscriminatedUnion<[z.ZodObject<{
+            rate: z.ZodOptional<z.ZodBoolean>;
+            host: z.ZodOptional<z.ZodString>;
+            type: z.ZodLiteral<"tool">;
+            matcher: z.ZodLiteral<"exact">;
+            pattern: z.ZodString;
+        }, z.core.$strict>, z.ZodObject<{
+            rate: z.ZodOptional<z.ZodBoolean>;
+            host: z.ZodOptional<z.ZodString>;
+            type: z.ZodLiteral<"tool">;
+            matcher: z.ZodLiteral<"glob">;
+            pattern: z.ZodString;
+        }, z.core.$strict>, z.ZodObject<{
+            rate: z.ZodOptional<z.ZodBoolean>;
+            host: z.ZodOptional<z.ZodString>;
+            type: z.ZodLiteral<"tool">;
+            matcher: z.ZodLiteral<"regexp">;
+            pattern: z.ZodString;
+        }, z.core.$strict>, z.ZodObject<{
+            rate: z.ZodOptional<z.ZodBoolean>;
+            host: z.ZodOptional<z.ZodString>;
+            type: z.ZodLiteral<"tool">;
+            matcher: z.ZodLiteral<"hint">;
+            pattern: z.ZodObject<{
+                readOnlyHint: z.ZodOptional<z.ZodBoolean>;
+                destructiveHint: z.ZodOptional<z.ZodBoolean>;
+                idempotentHint: z.ZodOptional<z.ZodBoolean>;
+                openWorldHint: z.ZodOptional<z.ZodBoolean>;
+            }, z.core.$strict>;
+        }, z.core.$strict>], "matcher">, z.ZodDiscriminatedUnion<[z.ZodObject<{
+            rate: z.ZodOptional<z.ZodBoolean>;
+            host: z.ZodOptional<z.ZodString>;
+            type: z.ZodLiteral<"mcpTool">;
+            matcher: z.ZodLiteral<"exact">;
+            server: z.ZodString;
+            pattern: z.ZodString;
+        }, z.core.$strict>, z.ZodObject<{
+            rate: z.ZodOptional<z.ZodBoolean>;
+            host: z.ZodOptional<z.ZodString>;
+            type: z.ZodLiteral<"mcpTool">;
+            matcher: z.ZodLiteral<"glob">;
+            server: z.ZodString;
+            pattern: z.ZodString;
+        }, z.core.$strict>, z.ZodObject<{
+            rate: z.ZodOptional<z.ZodBoolean>;
+            host: z.ZodOptional<z.ZodString>;
+            type: z.ZodLiteral<"mcpTool">;
+            matcher: z.ZodLiteral<"regexp">;
+            server: z.ZodString;
+            pattern: z.ZodString;
+        }, z.core.$strict>, z.ZodObject<{
+            rate: z.ZodOptional<z.ZodBoolean>;
+            host: z.ZodOptional<z.ZodString>;
+            type: z.ZodLiteral<"mcpTool">;
+            matcher: z.ZodLiteral<"hint">;
+            server: z.ZodString;
+            pattern: z.ZodObject<{
+                readOnlyHint: z.ZodOptional<z.ZodBoolean>;
+                destructiveHint: z.ZodOptional<z.ZodBoolean>;
+                idempotentHint: z.ZodOptional<z.ZodBoolean>;
+                openWorldHint: z.ZodOptional<z.ZodBoolean>;
+            }, z.core.$strict>;
+        }, z.core.$strict>], "matcher">], "type">>>;
+        escalate: z.ZodOptional<z.ZodArray<z.ZodDiscriminatedUnion<[z.ZodDiscriminatedUnion<[z.ZodObject<{
+            rate: z.ZodOptional<z.ZodBoolean>;
+            type: z.ZodLiteral<"shell">;
+            matcher: z.ZodLiteral<"exact">;
+            pattern: z.ZodString;
+        }, z.core.$strict>, z.ZodObject<{
+            rate: z.ZodOptional<z.ZodBoolean>;
+            type: z.ZodLiteral<"shell">;
+            matcher: z.ZodLiteral<"glob">;
+            pattern: z.ZodString;
+        }, z.core.$strict>, z.ZodObject<{
+            rate: z.ZodOptional<z.ZodBoolean>;
+            type: z.ZodLiteral<"shell">;
+            matcher: z.ZodLiteral<"regexp">;
+            pattern: z.ZodString;
+        }, z.core.$strict>], "matcher">, z.ZodDiscriminatedUnion<[z.ZodObject<{
+            rate: z.ZodOptional<z.ZodBoolean>;
+            host: z.ZodOptional<z.ZodString>;
+            type: z.ZodLiteral<"tool">;
+            matcher: z.ZodLiteral<"exact">;
+            pattern: z.ZodString;
+        }, z.core.$strict>, z.ZodObject<{
+            rate: z.ZodOptional<z.ZodBoolean>;
+            host: z.ZodOptional<z.ZodString>;
+            type: z.ZodLiteral<"tool">;
+            matcher: z.ZodLiteral<"glob">;
+            pattern: z.ZodString;
+        }, z.core.$strict>, z.ZodObject<{
+            rate: z.ZodOptional<z.ZodBoolean>;
+            host: z.ZodOptional<z.ZodString>;
+            type: z.ZodLiteral<"tool">;
+            matcher: z.ZodLiteral<"regexp">;
+            pattern: z.ZodString;
+        }, z.core.$strict>, z.ZodObject<{
+            rate: z.ZodOptional<z.ZodBoolean>;
+            host: z.ZodOptional<z.ZodString>;
+            type: z.ZodLiteral<"tool">;
+            matcher: z.ZodLiteral<"hint">;
+            pattern: z.ZodObject<{
+                readOnlyHint: z.ZodOptional<z.ZodBoolean>;
+                destructiveHint: z.ZodOptional<z.ZodBoolean>;
+                idempotentHint: z.ZodOptional<z.ZodBoolean>;
+                openWorldHint: z.ZodOptional<z.ZodBoolean>;
+            }, z.core.$strict>;
+        }, z.core.$strict>], "matcher">, z.ZodDiscriminatedUnion<[z.ZodObject<{
+            rate: z.ZodOptional<z.ZodBoolean>;
+            host: z.ZodOptional<z.ZodString>;
+            type: z.ZodLiteral<"mcpTool">;
+            matcher: z.ZodLiteral<"exact">;
+            server: z.ZodString;
+            pattern: z.ZodString;
+        }, z.core.$strict>, z.ZodObject<{
+            rate: z.ZodOptional<z.ZodBoolean>;
+            host: z.ZodOptional<z.ZodString>;
+            type: z.ZodLiteral<"mcpTool">;
+            matcher: z.ZodLiteral<"glob">;
+            server: z.ZodString;
+            pattern: z.ZodString;
+        }, z.core.$strict>, z.ZodObject<{
+            rate: z.ZodOptional<z.ZodBoolean>;
+            host: z.ZodOptional<z.ZodString>;
+            type: z.ZodLiteral<"mcpTool">;
+            matcher: z.ZodLiteral<"regexp">;
+            server: z.ZodString;
+            pattern: z.ZodString;
+        }, z.core.$strict>, z.ZodObject<{
+            rate: z.ZodOptional<z.ZodBoolean>;
+            host: z.ZodOptional<z.ZodString>;
+            type: z.ZodLiteral<"mcpTool">;
+            matcher: z.ZodLiteral<"hint">;
+            server: z.ZodString;
+            pattern: z.ZodObject<{
+                readOnlyHint: z.ZodOptional<z.ZodBoolean>;
+                destructiveHint: z.ZodOptional<z.ZodBoolean>;
+                idempotentHint: z.ZodOptional<z.ZodBoolean>;
+                openWorldHint: z.ZodOptional<z.ZodBoolean>;
+            }, z.core.$strict>;
+        }, z.core.$strict>], "matcher">], "type">>>;
+        raterTimeoutMs: z.ZodOptional<z.ZodNumber>;
+        mcp: z.ZodOptional<z.ZodObject<{
+            defaults: z.ZodOptional<z.ZodObject<{
+                trustAnnotations: z.ZodOptional<z.ZodArray<z.ZodEnum<{
+                    destructiveHint: "destructiveHint";
+                    idempotentHint: "idempotentHint";
+                    openWorldHint: "openWorldHint";
+                    readOnlyHint: "readOnlyHint";
+                }>>>;
+            }, z.core.$strict>>;
+            servers: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
+                trustAnnotations: z.ZodOptional<z.ZodArray<z.ZodEnum<{
+                    destructiveHint: "destructiveHint";
+                    idempotentHint: "idempotentHint";
+                    openWorldHint: "openWorldHint";
+                    readOnlyHint: "readOnlyHint";
+                }>>>;
+            }, z.core.$strict>>>;
+        }, z.core.$strict>>;
+    }, z.core.$strip>]>>;
     tools: z.ZodOptional<z.ZodArray<z.ZodUnknown>>;
     allowedTools: z.ZodOptional<z.ZodArray<z.ZodString>>;
     middleware: z.ZodOptional<z.ZodArray<z.ZodUnknown>>;
@@ -79,6 +611,8 @@ export declare const rawGthConfigSchema: z.ZodObject<{
     writeOutputToFile: z.ZodOptional<z.ZodUnion<readonly [z.ZodBoolean, z.ZodString]>>;
     writeBinaryOutputsToFile: z.ZodOptional<z.ZodBoolean>;
     useColour: z.ZodOptional<z.ZodBoolean>;
+    useMouse: z.ZodOptional<z.ZodBoolean>;
+    tui: z.ZodOptional<z.ZodBoolean>;
     streamSessionInferenceLog: z.ZodOptional<z.ZodBoolean>;
     canInterruptInferenceWithEsc: z.ZodOptional<z.ZodBoolean>;
     debugLog: z.ZodOptional<z.ZodBoolean>;
@@ -92,13 +626,17 @@ export declare const rawGthConfigSchema: z.ZodObject<{
             allow: z.ZodOptional<z.ZodArray<z.ZodEnum<{
                 "absolute-paths": "absolute-paths";
                 "directory-traversal": "directory-traversal";
-                "shell-injection": "shell-injection";
                 "null-bytes": "null-bytes";
+                "shell-injection": "shell-injection";
             }>>>;
         }, z.core.$strip>>>;
         timeout: z.ZodOptional<z.ZodNumber>;
     }, z.core.$strip>>>;
     mcpServers: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+    tls: z.ZodOptional<z.ZodObject<{
+        extraCaCerts: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        rejectUnauthorized: z.ZodOptional<z.ZodBoolean>;
+    }, z.core.$strip>>;
     a2aAgents: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
     builtInToolsConfig: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
     aiignore: z.ZodOptional<z.ZodObject<{
@@ -111,10 +649,289 @@ export declare const rawGthConfigSchema: z.ZodObject<{
             requirementSource: z.ZodOptional<z.ZodString>;
             filesystem: z.ZodOptional<z.ZodUnion<readonly [z.ZodArray<z.ZodString>, z.ZodEnum<{
                 all: "all";
-                read: "read";
                 none: "none";
+                read: "read";
             }>]>>;
-            builtInTools: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            builtInTools: z.ZodOptional<z.ZodUnion<readonly [z.ZodArray<z.ZodString>, z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodBoolean, z.ZodObject<{
+                enabled: z.ZodOptional<z.ZodBoolean>;
+                command: z.ZodOptional<z.ZodString>;
+                timeout: z.ZodOptional<z.ZodNumber>;
+                maxOutputBytes: z.ZodOptional<z.ZodNumber>;
+                maxBytes: z.ZodOptional<z.ZodNumber>;
+                fileSet: z.ZodOptional<z.ZodEnum<{
+                    all: "all";
+                    gitignore: "gitignore";
+                }>>;
+            }, z.core.$strip>]>>]>>;
+            approvals: z.ZodOptional<z.ZodUnion<readonly [z.ZodEnum<{
+                assisted: "assisted";
+                auto: "auto";
+                bypass: "bypass";
+                manual: "manual";
+                write: "write";
+            }>, z.ZodObject<{
+                mode: z.ZodOptional<z.ZodEnum<{
+                    assisted: "assisted";
+                    auto: "auto";
+                    bypass: "bypass";
+                    manual: "manual";
+                    write: "write";
+                }>>;
+                rater: z.ZodOptional<z.ZodString>;
+                allow: z.ZodOptional<z.ZodArray<z.ZodDiscriminatedUnion<[z.ZodDiscriminatedUnion<[z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    type: z.ZodLiteral<"shell">;
+                    matcher: z.ZodLiteral<"exact">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    type: z.ZodLiteral<"shell">;
+                    matcher: z.ZodLiteral<"glob">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    type: z.ZodLiteral<"shell">;
+                    matcher: z.ZodLiteral<"regexp">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>], "matcher">, z.ZodDiscriminatedUnion<[z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"tool">;
+                    matcher: z.ZodLiteral<"exact">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"tool">;
+                    matcher: z.ZodLiteral<"glob">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"tool">;
+                    matcher: z.ZodLiteral<"regexp">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"tool">;
+                    matcher: z.ZodLiteral<"hint">;
+                    pattern: z.ZodObject<{
+                        readOnlyHint: z.ZodOptional<z.ZodBoolean>;
+                        destructiveHint: z.ZodOptional<z.ZodBoolean>;
+                        idempotentHint: z.ZodOptional<z.ZodBoolean>;
+                        openWorldHint: z.ZodOptional<z.ZodBoolean>;
+                    }, z.core.$strict>;
+                }, z.core.$strict>], "matcher">, z.ZodDiscriminatedUnion<[z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"mcpTool">;
+                    matcher: z.ZodLiteral<"exact">;
+                    server: z.ZodString;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"mcpTool">;
+                    matcher: z.ZodLiteral<"glob">;
+                    server: z.ZodString;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"mcpTool">;
+                    matcher: z.ZodLiteral<"regexp">;
+                    server: z.ZodString;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"mcpTool">;
+                    matcher: z.ZodLiteral<"hint">;
+                    server: z.ZodString;
+                    pattern: z.ZodObject<{
+                        readOnlyHint: z.ZodOptional<z.ZodBoolean>;
+                        destructiveHint: z.ZodOptional<z.ZodBoolean>;
+                        idempotentHint: z.ZodOptional<z.ZodBoolean>;
+                        openWorldHint: z.ZodOptional<z.ZodBoolean>;
+                    }, z.core.$strict>;
+                }, z.core.$strict>], "matcher">], "type">>>;
+                deny: z.ZodOptional<z.ZodArray<z.ZodDiscriminatedUnion<[z.ZodDiscriminatedUnion<[z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    type: z.ZodLiteral<"shell">;
+                    matcher: z.ZodLiteral<"exact">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    type: z.ZodLiteral<"shell">;
+                    matcher: z.ZodLiteral<"glob">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    type: z.ZodLiteral<"shell">;
+                    matcher: z.ZodLiteral<"regexp">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>], "matcher">, z.ZodDiscriminatedUnion<[z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"tool">;
+                    matcher: z.ZodLiteral<"exact">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"tool">;
+                    matcher: z.ZodLiteral<"glob">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"tool">;
+                    matcher: z.ZodLiteral<"regexp">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"tool">;
+                    matcher: z.ZodLiteral<"hint">;
+                    pattern: z.ZodObject<{
+                        readOnlyHint: z.ZodOptional<z.ZodBoolean>;
+                        destructiveHint: z.ZodOptional<z.ZodBoolean>;
+                        idempotentHint: z.ZodOptional<z.ZodBoolean>;
+                        openWorldHint: z.ZodOptional<z.ZodBoolean>;
+                    }, z.core.$strict>;
+                }, z.core.$strict>], "matcher">, z.ZodDiscriminatedUnion<[z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"mcpTool">;
+                    matcher: z.ZodLiteral<"exact">;
+                    server: z.ZodString;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"mcpTool">;
+                    matcher: z.ZodLiteral<"glob">;
+                    server: z.ZodString;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"mcpTool">;
+                    matcher: z.ZodLiteral<"regexp">;
+                    server: z.ZodString;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"mcpTool">;
+                    matcher: z.ZodLiteral<"hint">;
+                    server: z.ZodString;
+                    pattern: z.ZodObject<{
+                        readOnlyHint: z.ZodOptional<z.ZodBoolean>;
+                        destructiveHint: z.ZodOptional<z.ZodBoolean>;
+                        idempotentHint: z.ZodOptional<z.ZodBoolean>;
+                        openWorldHint: z.ZodOptional<z.ZodBoolean>;
+                    }, z.core.$strict>;
+                }, z.core.$strict>], "matcher">], "type">>>;
+                escalate: z.ZodOptional<z.ZodArray<z.ZodDiscriminatedUnion<[z.ZodDiscriminatedUnion<[z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    type: z.ZodLiteral<"shell">;
+                    matcher: z.ZodLiteral<"exact">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    type: z.ZodLiteral<"shell">;
+                    matcher: z.ZodLiteral<"glob">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    type: z.ZodLiteral<"shell">;
+                    matcher: z.ZodLiteral<"regexp">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>], "matcher">, z.ZodDiscriminatedUnion<[z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"tool">;
+                    matcher: z.ZodLiteral<"exact">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"tool">;
+                    matcher: z.ZodLiteral<"glob">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"tool">;
+                    matcher: z.ZodLiteral<"regexp">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"tool">;
+                    matcher: z.ZodLiteral<"hint">;
+                    pattern: z.ZodObject<{
+                        readOnlyHint: z.ZodOptional<z.ZodBoolean>;
+                        destructiveHint: z.ZodOptional<z.ZodBoolean>;
+                        idempotentHint: z.ZodOptional<z.ZodBoolean>;
+                        openWorldHint: z.ZodOptional<z.ZodBoolean>;
+                    }, z.core.$strict>;
+                }, z.core.$strict>], "matcher">, z.ZodDiscriminatedUnion<[z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"mcpTool">;
+                    matcher: z.ZodLiteral<"exact">;
+                    server: z.ZodString;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"mcpTool">;
+                    matcher: z.ZodLiteral<"glob">;
+                    server: z.ZodString;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"mcpTool">;
+                    matcher: z.ZodLiteral<"regexp">;
+                    server: z.ZodString;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"mcpTool">;
+                    matcher: z.ZodLiteral<"hint">;
+                    server: z.ZodString;
+                    pattern: z.ZodObject<{
+                        readOnlyHint: z.ZodOptional<z.ZodBoolean>;
+                        destructiveHint: z.ZodOptional<z.ZodBoolean>;
+                        idempotentHint: z.ZodOptional<z.ZodBoolean>;
+                        openWorldHint: z.ZodOptional<z.ZodBoolean>;
+                    }, z.core.$strict>;
+                }, z.core.$strict>], "matcher">], "type">>>;
+                raterTimeoutMs: z.ZodOptional<z.ZodNumber>;
+                mcp: z.ZodOptional<z.ZodObject<{
+                    defaults: z.ZodOptional<z.ZodObject<{
+                        trustAnnotations: z.ZodOptional<z.ZodArray<z.ZodEnum<{
+                            destructiveHint: "destructiveHint";
+                            idempotentHint: "idempotentHint";
+                            openWorldHint: "openWorldHint";
+                            readOnlyHint: "readOnlyHint";
+                        }>>>;
+                    }, z.core.$strict>>;
+                    servers: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
+                        trustAnnotations: z.ZodOptional<z.ZodArray<z.ZodEnum<{
+                            destructiveHint: "destructiveHint";
+                            idempotentHint: "idempotentHint";
+                            openWorldHint: "openWorldHint";
+                            readOnlyHint: "readOnlyHint";
+                        }>>>;
+                    }, z.core.$strict>>>;
+                }, z.core.$strict>>;
+            }, z.core.$strip>]>>;
             customTools: z.ZodOptional<z.ZodUnion<readonly [z.ZodLiteral<false>, z.ZodRecord<z.ZodString, z.ZodObject<{
                 command: z.ZodString;
                 description: z.ZodString;
@@ -123,8 +940,8 @@ export declare const rawGthConfigSchema: z.ZodObject<{
                     allow: z.ZodOptional<z.ZodArray<z.ZodEnum<{
                         "absolute-paths": "absolute-paths";
                         "directory-traversal": "directory-traversal";
-                        "shell-injection": "shell-injection";
                         "null-bytes": "null-bytes";
+                        "shell-injection": "shell-injection";
                     }>>>;
                 }, z.core.$strip>>>;
                 timeout: z.ZodOptional<z.ZodNumber>;
@@ -140,11 +957,11 @@ export declare const rawGthConfigSchema: z.ZodObject<{
             }, z.core.$strip>>;
             binaryFormats: z.ZodOptional<z.ZodUnion<readonly [z.ZodLiteral<false>, z.ZodArray<z.ZodObject<{
                 type: z.ZodEnum<{
+                    audio: "audio";
                     binary: "binary";
+                    file: "file";
                     image: "image";
-                    audio: "audio";
                     video: "video";
-                    file: "file";
                 }>;
                 extensions: z.ZodArray<z.ZodString>;
                 maxSize: z.ZodOptional<z.ZodNumber>;
@@ -156,10 +973,289 @@ export declare const rawGthConfigSchema: z.ZodObject<{
             requirementSource: z.ZodOptional<z.ZodString>;
             filesystem: z.ZodOptional<z.ZodUnion<readonly [z.ZodArray<z.ZodString>, z.ZodEnum<{
                 all: "all";
-                read: "read";
                 none: "none";
+                read: "read";
             }>]>>;
-            builtInTools: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            builtInTools: z.ZodOptional<z.ZodUnion<readonly [z.ZodArray<z.ZodString>, z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodBoolean, z.ZodObject<{
+                enabled: z.ZodOptional<z.ZodBoolean>;
+                command: z.ZodOptional<z.ZodString>;
+                timeout: z.ZodOptional<z.ZodNumber>;
+                maxOutputBytes: z.ZodOptional<z.ZodNumber>;
+                maxBytes: z.ZodOptional<z.ZodNumber>;
+                fileSet: z.ZodOptional<z.ZodEnum<{
+                    all: "all";
+                    gitignore: "gitignore";
+                }>>;
+            }, z.core.$strip>]>>]>>;
+            approvals: z.ZodOptional<z.ZodUnion<readonly [z.ZodEnum<{
+                assisted: "assisted";
+                auto: "auto";
+                bypass: "bypass";
+                manual: "manual";
+                write: "write";
+            }>, z.ZodObject<{
+                mode: z.ZodOptional<z.ZodEnum<{
+                    assisted: "assisted";
+                    auto: "auto";
+                    bypass: "bypass";
+                    manual: "manual";
+                    write: "write";
+                }>>;
+                rater: z.ZodOptional<z.ZodString>;
+                allow: z.ZodOptional<z.ZodArray<z.ZodDiscriminatedUnion<[z.ZodDiscriminatedUnion<[z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    type: z.ZodLiteral<"shell">;
+                    matcher: z.ZodLiteral<"exact">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    type: z.ZodLiteral<"shell">;
+                    matcher: z.ZodLiteral<"glob">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    type: z.ZodLiteral<"shell">;
+                    matcher: z.ZodLiteral<"regexp">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>], "matcher">, z.ZodDiscriminatedUnion<[z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"tool">;
+                    matcher: z.ZodLiteral<"exact">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"tool">;
+                    matcher: z.ZodLiteral<"glob">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"tool">;
+                    matcher: z.ZodLiteral<"regexp">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"tool">;
+                    matcher: z.ZodLiteral<"hint">;
+                    pattern: z.ZodObject<{
+                        readOnlyHint: z.ZodOptional<z.ZodBoolean>;
+                        destructiveHint: z.ZodOptional<z.ZodBoolean>;
+                        idempotentHint: z.ZodOptional<z.ZodBoolean>;
+                        openWorldHint: z.ZodOptional<z.ZodBoolean>;
+                    }, z.core.$strict>;
+                }, z.core.$strict>], "matcher">, z.ZodDiscriminatedUnion<[z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"mcpTool">;
+                    matcher: z.ZodLiteral<"exact">;
+                    server: z.ZodString;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"mcpTool">;
+                    matcher: z.ZodLiteral<"glob">;
+                    server: z.ZodString;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"mcpTool">;
+                    matcher: z.ZodLiteral<"regexp">;
+                    server: z.ZodString;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"mcpTool">;
+                    matcher: z.ZodLiteral<"hint">;
+                    server: z.ZodString;
+                    pattern: z.ZodObject<{
+                        readOnlyHint: z.ZodOptional<z.ZodBoolean>;
+                        destructiveHint: z.ZodOptional<z.ZodBoolean>;
+                        idempotentHint: z.ZodOptional<z.ZodBoolean>;
+                        openWorldHint: z.ZodOptional<z.ZodBoolean>;
+                    }, z.core.$strict>;
+                }, z.core.$strict>], "matcher">], "type">>>;
+                deny: z.ZodOptional<z.ZodArray<z.ZodDiscriminatedUnion<[z.ZodDiscriminatedUnion<[z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    type: z.ZodLiteral<"shell">;
+                    matcher: z.ZodLiteral<"exact">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    type: z.ZodLiteral<"shell">;
+                    matcher: z.ZodLiteral<"glob">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    type: z.ZodLiteral<"shell">;
+                    matcher: z.ZodLiteral<"regexp">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>], "matcher">, z.ZodDiscriminatedUnion<[z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"tool">;
+                    matcher: z.ZodLiteral<"exact">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"tool">;
+                    matcher: z.ZodLiteral<"glob">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"tool">;
+                    matcher: z.ZodLiteral<"regexp">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"tool">;
+                    matcher: z.ZodLiteral<"hint">;
+                    pattern: z.ZodObject<{
+                        readOnlyHint: z.ZodOptional<z.ZodBoolean>;
+                        destructiveHint: z.ZodOptional<z.ZodBoolean>;
+                        idempotentHint: z.ZodOptional<z.ZodBoolean>;
+                        openWorldHint: z.ZodOptional<z.ZodBoolean>;
+                    }, z.core.$strict>;
+                }, z.core.$strict>], "matcher">, z.ZodDiscriminatedUnion<[z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"mcpTool">;
+                    matcher: z.ZodLiteral<"exact">;
+                    server: z.ZodString;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"mcpTool">;
+                    matcher: z.ZodLiteral<"glob">;
+                    server: z.ZodString;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"mcpTool">;
+                    matcher: z.ZodLiteral<"regexp">;
+                    server: z.ZodString;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"mcpTool">;
+                    matcher: z.ZodLiteral<"hint">;
+                    server: z.ZodString;
+                    pattern: z.ZodObject<{
+                        readOnlyHint: z.ZodOptional<z.ZodBoolean>;
+                        destructiveHint: z.ZodOptional<z.ZodBoolean>;
+                        idempotentHint: z.ZodOptional<z.ZodBoolean>;
+                        openWorldHint: z.ZodOptional<z.ZodBoolean>;
+                    }, z.core.$strict>;
+                }, z.core.$strict>], "matcher">], "type">>>;
+                escalate: z.ZodOptional<z.ZodArray<z.ZodDiscriminatedUnion<[z.ZodDiscriminatedUnion<[z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    type: z.ZodLiteral<"shell">;
+                    matcher: z.ZodLiteral<"exact">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    type: z.ZodLiteral<"shell">;
+                    matcher: z.ZodLiteral<"glob">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    type: z.ZodLiteral<"shell">;
+                    matcher: z.ZodLiteral<"regexp">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>], "matcher">, z.ZodDiscriminatedUnion<[z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"tool">;
+                    matcher: z.ZodLiteral<"exact">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"tool">;
+                    matcher: z.ZodLiteral<"glob">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"tool">;
+                    matcher: z.ZodLiteral<"regexp">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"tool">;
+                    matcher: z.ZodLiteral<"hint">;
+                    pattern: z.ZodObject<{
+                        readOnlyHint: z.ZodOptional<z.ZodBoolean>;
+                        destructiveHint: z.ZodOptional<z.ZodBoolean>;
+                        idempotentHint: z.ZodOptional<z.ZodBoolean>;
+                        openWorldHint: z.ZodOptional<z.ZodBoolean>;
+                    }, z.core.$strict>;
+                }, z.core.$strict>], "matcher">, z.ZodDiscriminatedUnion<[z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"mcpTool">;
+                    matcher: z.ZodLiteral<"exact">;
+                    server: z.ZodString;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"mcpTool">;
+                    matcher: z.ZodLiteral<"glob">;
+                    server: z.ZodString;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"mcpTool">;
+                    matcher: z.ZodLiteral<"regexp">;
+                    server: z.ZodString;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"mcpTool">;
+                    matcher: z.ZodLiteral<"hint">;
+                    server: z.ZodString;
+                    pattern: z.ZodObject<{
+                        readOnlyHint: z.ZodOptional<z.ZodBoolean>;
+                        destructiveHint: z.ZodOptional<z.ZodBoolean>;
+                        idempotentHint: z.ZodOptional<z.ZodBoolean>;
+                        openWorldHint: z.ZodOptional<z.ZodBoolean>;
+                    }, z.core.$strict>;
+                }, z.core.$strict>], "matcher">], "type">>>;
+                raterTimeoutMs: z.ZodOptional<z.ZodNumber>;
+                mcp: z.ZodOptional<z.ZodObject<{
+                    defaults: z.ZodOptional<z.ZodObject<{
+                        trustAnnotations: z.ZodOptional<z.ZodArray<z.ZodEnum<{
+                            destructiveHint: "destructiveHint";
+                            idempotentHint: "idempotentHint";
+                            openWorldHint: "openWorldHint";
+                            readOnlyHint: "readOnlyHint";
+                        }>>>;
+                    }, z.core.$strict>>;
+                    servers: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
+                        trustAnnotations: z.ZodOptional<z.ZodArray<z.ZodEnum<{
+                            destructiveHint: "destructiveHint";
+                            idempotentHint: "idempotentHint";
+                            openWorldHint: "openWorldHint";
+                            readOnlyHint: "readOnlyHint";
+                        }>>>;
+                    }, z.core.$strict>>>;
+                }, z.core.$strict>>;
+            }, z.core.$strip>]>>;
             customTools: z.ZodOptional<z.ZodUnion<readonly [z.ZodLiteral<false>, z.ZodRecord<z.ZodString, z.ZodObject<{
                 command: z.ZodString;
                 description: z.ZodString;
@@ -168,8 +1264,8 @@ export declare const rawGthConfigSchema: z.ZodObject<{
                     allow: z.ZodOptional<z.ZodArray<z.ZodEnum<{
                         "absolute-paths": "absolute-paths";
                         "directory-traversal": "directory-traversal";
-                        "shell-injection": "shell-injection";
                         "null-bytes": "null-bytes";
+                        "shell-injection": "shell-injection";
                     }>>>;
                 }, z.core.$strip>>>;
                 timeout: z.ZodOptional<z.ZodNumber>;
@@ -184,11 +1280,11 @@ export declare const rawGthConfigSchema: z.ZodObject<{
             }, z.core.$strip>>;
             binaryFormats: z.ZodOptional<z.ZodUnion<readonly [z.ZodLiteral<false>, z.ZodArray<z.ZodObject<{
                 type: z.ZodEnum<{
+                    audio: "audio";
                     binary: "binary";
+                    file: "file";
                     image: "image";
-                    audio: "audio";
                     video: "video";
-                    file: "file";
                 }>;
                 extensions: z.ZodArray<z.ZodString>;
                 maxSize: z.ZodOptional<z.ZodNumber>;
@@ -198,10 +1294,289 @@ export declare const rawGthConfigSchema: z.ZodObject<{
         ask: z.ZodOptional<z.ZodObject<{
             filesystem: z.ZodOptional<z.ZodUnion<readonly [z.ZodArray<z.ZodString>, z.ZodEnum<{
                 all: "all";
-                read: "read";
                 none: "none";
+                read: "read";
             }>]>>;
-            builtInTools: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            builtInTools: z.ZodOptional<z.ZodUnion<readonly [z.ZodArray<z.ZodString>, z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodBoolean, z.ZodObject<{
+                enabled: z.ZodOptional<z.ZodBoolean>;
+                command: z.ZodOptional<z.ZodString>;
+                timeout: z.ZodOptional<z.ZodNumber>;
+                maxOutputBytes: z.ZodOptional<z.ZodNumber>;
+                maxBytes: z.ZodOptional<z.ZodNumber>;
+                fileSet: z.ZodOptional<z.ZodEnum<{
+                    all: "all";
+                    gitignore: "gitignore";
+                }>>;
+            }, z.core.$strip>]>>]>>;
+            approvals: z.ZodOptional<z.ZodUnion<readonly [z.ZodEnum<{
+                assisted: "assisted";
+                auto: "auto";
+                bypass: "bypass";
+                manual: "manual";
+                write: "write";
+            }>, z.ZodObject<{
+                mode: z.ZodOptional<z.ZodEnum<{
+                    assisted: "assisted";
+                    auto: "auto";
+                    bypass: "bypass";
+                    manual: "manual";
+                    write: "write";
+                }>>;
+                rater: z.ZodOptional<z.ZodString>;
+                allow: z.ZodOptional<z.ZodArray<z.ZodDiscriminatedUnion<[z.ZodDiscriminatedUnion<[z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    type: z.ZodLiteral<"shell">;
+                    matcher: z.ZodLiteral<"exact">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    type: z.ZodLiteral<"shell">;
+                    matcher: z.ZodLiteral<"glob">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    type: z.ZodLiteral<"shell">;
+                    matcher: z.ZodLiteral<"regexp">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>], "matcher">, z.ZodDiscriminatedUnion<[z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"tool">;
+                    matcher: z.ZodLiteral<"exact">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"tool">;
+                    matcher: z.ZodLiteral<"glob">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"tool">;
+                    matcher: z.ZodLiteral<"regexp">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"tool">;
+                    matcher: z.ZodLiteral<"hint">;
+                    pattern: z.ZodObject<{
+                        readOnlyHint: z.ZodOptional<z.ZodBoolean>;
+                        destructiveHint: z.ZodOptional<z.ZodBoolean>;
+                        idempotentHint: z.ZodOptional<z.ZodBoolean>;
+                        openWorldHint: z.ZodOptional<z.ZodBoolean>;
+                    }, z.core.$strict>;
+                }, z.core.$strict>], "matcher">, z.ZodDiscriminatedUnion<[z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"mcpTool">;
+                    matcher: z.ZodLiteral<"exact">;
+                    server: z.ZodString;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"mcpTool">;
+                    matcher: z.ZodLiteral<"glob">;
+                    server: z.ZodString;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"mcpTool">;
+                    matcher: z.ZodLiteral<"regexp">;
+                    server: z.ZodString;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"mcpTool">;
+                    matcher: z.ZodLiteral<"hint">;
+                    server: z.ZodString;
+                    pattern: z.ZodObject<{
+                        readOnlyHint: z.ZodOptional<z.ZodBoolean>;
+                        destructiveHint: z.ZodOptional<z.ZodBoolean>;
+                        idempotentHint: z.ZodOptional<z.ZodBoolean>;
+                        openWorldHint: z.ZodOptional<z.ZodBoolean>;
+                    }, z.core.$strict>;
+                }, z.core.$strict>], "matcher">], "type">>>;
+                deny: z.ZodOptional<z.ZodArray<z.ZodDiscriminatedUnion<[z.ZodDiscriminatedUnion<[z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    type: z.ZodLiteral<"shell">;
+                    matcher: z.ZodLiteral<"exact">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    type: z.ZodLiteral<"shell">;
+                    matcher: z.ZodLiteral<"glob">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    type: z.ZodLiteral<"shell">;
+                    matcher: z.ZodLiteral<"regexp">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>], "matcher">, z.ZodDiscriminatedUnion<[z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"tool">;
+                    matcher: z.ZodLiteral<"exact">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"tool">;
+                    matcher: z.ZodLiteral<"glob">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"tool">;
+                    matcher: z.ZodLiteral<"regexp">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"tool">;
+                    matcher: z.ZodLiteral<"hint">;
+                    pattern: z.ZodObject<{
+                        readOnlyHint: z.ZodOptional<z.ZodBoolean>;
+                        destructiveHint: z.ZodOptional<z.ZodBoolean>;
+                        idempotentHint: z.ZodOptional<z.ZodBoolean>;
+                        openWorldHint: z.ZodOptional<z.ZodBoolean>;
+                    }, z.core.$strict>;
+                }, z.core.$strict>], "matcher">, z.ZodDiscriminatedUnion<[z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"mcpTool">;
+                    matcher: z.ZodLiteral<"exact">;
+                    server: z.ZodString;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"mcpTool">;
+                    matcher: z.ZodLiteral<"glob">;
+                    server: z.ZodString;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"mcpTool">;
+                    matcher: z.ZodLiteral<"regexp">;
+                    server: z.ZodString;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"mcpTool">;
+                    matcher: z.ZodLiteral<"hint">;
+                    server: z.ZodString;
+                    pattern: z.ZodObject<{
+                        readOnlyHint: z.ZodOptional<z.ZodBoolean>;
+                        destructiveHint: z.ZodOptional<z.ZodBoolean>;
+                        idempotentHint: z.ZodOptional<z.ZodBoolean>;
+                        openWorldHint: z.ZodOptional<z.ZodBoolean>;
+                    }, z.core.$strict>;
+                }, z.core.$strict>], "matcher">], "type">>>;
+                escalate: z.ZodOptional<z.ZodArray<z.ZodDiscriminatedUnion<[z.ZodDiscriminatedUnion<[z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    type: z.ZodLiteral<"shell">;
+                    matcher: z.ZodLiteral<"exact">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    type: z.ZodLiteral<"shell">;
+                    matcher: z.ZodLiteral<"glob">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    type: z.ZodLiteral<"shell">;
+                    matcher: z.ZodLiteral<"regexp">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>], "matcher">, z.ZodDiscriminatedUnion<[z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"tool">;
+                    matcher: z.ZodLiteral<"exact">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"tool">;
+                    matcher: z.ZodLiteral<"glob">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"tool">;
+                    matcher: z.ZodLiteral<"regexp">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"tool">;
+                    matcher: z.ZodLiteral<"hint">;
+                    pattern: z.ZodObject<{
+                        readOnlyHint: z.ZodOptional<z.ZodBoolean>;
+                        destructiveHint: z.ZodOptional<z.ZodBoolean>;
+                        idempotentHint: z.ZodOptional<z.ZodBoolean>;
+                        openWorldHint: z.ZodOptional<z.ZodBoolean>;
+                    }, z.core.$strict>;
+                }, z.core.$strict>], "matcher">, z.ZodDiscriminatedUnion<[z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"mcpTool">;
+                    matcher: z.ZodLiteral<"exact">;
+                    server: z.ZodString;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"mcpTool">;
+                    matcher: z.ZodLiteral<"glob">;
+                    server: z.ZodString;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"mcpTool">;
+                    matcher: z.ZodLiteral<"regexp">;
+                    server: z.ZodString;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"mcpTool">;
+                    matcher: z.ZodLiteral<"hint">;
+                    server: z.ZodString;
+                    pattern: z.ZodObject<{
+                        readOnlyHint: z.ZodOptional<z.ZodBoolean>;
+                        destructiveHint: z.ZodOptional<z.ZodBoolean>;
+                        idempotentHint: z.ZodOptional<z.ZodBoolean>;
+                        openWorldHint: z.ZodOptional<z.ZodBoolean>;
+                    }, z.core.$strict>;
+                }, z.core.$strict>], "matcher">], "type">>>;
+                raterTimeoutMs: z.ZodOptional<z.ZodNumber>;
+                mcp: z.ZodOptional<z.ZodObject<{
+                    defaults: z.ZodOptional<z.ZodObject<{
+                        trustAnnotations: z.ZodOptional<z.ZodArray<z.ZodEnum<{
+                            destructiveHint: "destructiveHint";
+                            idempotentHint: "idempotentHint";
+                            openWorldHint: "openWorldHint";
+                            readOnlyHint: "readOnlyHint";
+                        }>>>;
+                    }, z.core.$strict>>;
+                    servers: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
+                        trustAnnotations: z.ZodOptional<z.ZodArray<z.ZodEnum<{
+                            destructiveHint: "destructiveHint";
+                            idempotentHint: "idempotentHint";
+                            openWorldHint: "openWorldHint";
+                            readOnlyHint: "readOnlyHint";
+                        }>>>;
+                    }, z.core.$strict>>>;
+                }, z.core.$strict>>;
+            }, z.core.$strip>]>>;
             customTools: z.ZodOptional<z.ZodUnion<readonly [z.ZodLiteral<false>, z.ZodRecord<z.ZodString, z.ZodObject<{
                 command: z.ZodString;
                 description: z.ZodString;
@@ -210,45 +1585,20 @@ export declare const rawGthConfigSchema: z.ZodObject<{
                     allow: z.ZodOptional<z.ZodArray<z.ZodEnum<{
                         "absolute-paths": "absolute-paths";
                         "directory-traversal": "directory-traversal";
-                        "shell-injection": "shell-injection";
                         "null-bytes": "null-bytes";
+                        "shell-injection": "shell-injection";
                     }>>>;
                 }, z.core.$strip>>>;
                 timeout: z.ZodOptional<z.ZodNumber>;
             }, z.core.$strip>>]>>;
             allowedTools: z.ZodOptional<z.ZodArray<z.ZodString>>;
-            devTools: z.ZodOptional<z.ZodObject<{
-                run_tests: z.ZodOptional<z.ZodString>;
-                run_lint: z.ZodOptional<z.ZodString>;
-                run_build: z.ZodOptional<z.ZodString>;
-                run_single_test: z.ZodOptional<z.ZodString>;
-                shell: z.ZodOptional<z.ZodUnion<readonly [z.ZodBoolean, z.ZodObject<{
-                    enabled: z.ZodOptional<z.ZodBoolean>;
-                    timeout: z.ZodOptional<z.ZodNumber>;
-                    maxOutputBytes: z.ZodOptional<z.ZodNumber>;
-                    allowlist: z.ZodOptional<z.ZodBoolean>;
-                    persistAllowlist: z.ZodOptional<z.ZodBoolean>;
-                    judge: z.ZodOptional<z.ZodUnion<readonly [z.ZodBoolean, z.ZodObject<{
-                        enabled: z.ZodOptional<z.ZodBoolean>;
-                        autoApproveLow: z.ZodOptional<z.ZodBoolean>;
-                        blockHigh: z.ZodOptional<z.ZodBoolean>;
-                        model: z.ZodOptional<z.ZodObject<{
-                            type: z.ZodOptional<z.ZodString>;
-                            model: z.ZodOptional<z.ZodString>;
-                            configuration: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
-                            apiKeyEnvironmentVariable: z.ZodOptional<z.ZodString>;
-                        }, z.core.$loose>>;
-                    }, z.core.$strip>]>>;
-                }, z.core.$strip>]>>;
-                shellYolo: z.ZodOptional<z.ZodBoolean>;
-            }, z.core.$strip>>;
             binaryFormats: z.ZodOptional<z.ZodUnion<readonly [z.ZodLiteral<false>, z.ZodArray<z.ZodObject<{
                 type: z.ZodEnum<{
+                    audio: "audio";
                     binary: "binary";
+                    file: "file";
                     image: "image";
-                    audio: "audio";
                     video: "video";
-                    file: "file";
                 }>;
                 extensions: z.ZodArray<z.ZodString>;
                 maxSize: z.ZodOptional<z.ZodNumber>;
@@ -258,10 +1608,289 @@ export declare const rawGthConfigSchema: z.ZodObject<{
         chat: z.ZodOptional<z.ZodObject<{
             filesystem: z.ZodOptional<z.ZodUnion<readonly [z.ZodArray<z.ZodString>, z.ZodEnum<{
                 all: "all";
-                read: "read";
                 none: "none";
+                read: "read";
             }>]>>;
-            builtInTools: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            builtInTools: z.ZodOptional<z.ZodUnion<readonly [z.ZodArray<z.ZodString>, z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodBoolean, z.ZodObject<{
+                enabled: z.ZodOptional<z.ZodBoolean>;
+                command: z.ZodOptional<z.ZodString>;
+                timeout: z.ZodOptional<z.ZodNumber>;
+                maxOutputBytes: z.ZodOptional<z.ZodNumber>;
+                maxBytes: z.ZodOptional<z.ZodNumber>;
+                fileSet: z.ZodOptional<z.ZodEnum<{
+                    all: "all";
+                    gitignore: "gitignore";
+                }>>;
+            }, z.core.$strip>]>>]>>;
+            approvals: z.ZodOptional<z.ZodUnion<readonly [z.ZodEnum<{
+                assisted: "assisted";
+                auto: "auto";
+                bypass: "bypass";
+                manual: "manual";
+                write: "write";
+            }>, z.ZodObject<{
+                mode: z.ZodOptional<z.ZodEnum<{
+                    assisted: "assisted";
+                    auto: "auto";
+                    bypass: "bypass";
+                    manual: "manual";
+                    write: "write";
+                }>>;
+                rater: z.ZodOptional<z.ZodString>;
+                allow: z.ZodOptional<z.ZodArray<z.ZodDiscriminatedUnion<[z.ZodDiscriminatedUnion<[z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    type: z.ZodLiteral<"shell">;
+                    matcher: z.ZodLiteral<"exact">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    type: z.ZodLiteral<"shell">;
+                    matcher: z.ZodLiteral<"glob">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    type: z.ZodLiteral<"shell">;
+                    matcher: z.ZodLiteral<"regexp">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>], "matcher">, z.ZodDiscriminatedUnion<[z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"tool">;
+                    matcher: z.ZodLiteral<"exact">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"tool">;
+                    matcher: z.ZodLiteral<"glob">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"tool">;
+                    matcher: z.ZodLiteral<"regexp">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"tool">;
+                    matcher: z.ZodLiteral<"hint">;
+                    pattern: z.ZodObject<{
+                        readOnlyHint: z.ZodOptional<z.ZodBoolean>;
+                        destructiveHint: z.ZodOptional<z.ZodBoolean>;
+                        idempotentHint: z.ZodOptional<z.ZodBoolean>;
+                        openWorldHint: z.ZodOptional<z.ZodBoolean>;
+                    }, z.core.$strict>;
+                }, z.core.$strict>], "matcher">, z.ZodDiscriminatedUnion<[z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"mcpTool">;
+                    matcher: z.ZodLiteral<"exact">;
+                    server: z.ZodString;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"mcpTool">;
+                    matcher: z.ZodLiteral<"glob">;
+                    server: z.ZodString;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"mcpTool">;
+                    matcher: z.ZodLiteral<"regexp">;
+                    server: z.ZodString;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"mcpTool">;
+                    matcher: z.ZodLiteral<"hint">;
+                    server: z.ZodString;
+                    pattern: z.ZodObject<{
+                        readOnlyHint: z.ZodOptional<z.ZodBoolean>;
+                        destructiveHint: z.ZodOptional<z.ZodBoolean>;
+                        idempotentHint: z.ZodOptional<z.ZodBoolean>;
+                        openWorldHint: z.ZodOptional<z.ZodBoolean>;
+                    }, z.core.$strict>;
+                }, z.core.$strict>], "matcher">], "type">>>;
+                deny: z.ZodOptional<z.ZodArray<z.ZodDiscriminatedUnion<[z.ZodDiscriminatedUnion<[z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    type: z.ZodLiteral<"shell">;
+                    matcher: z.ZodLiteral<"exact">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    type: z.ZodLiteral<"shell">;
+                    matcher: z.ZodLiteral<"glob">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    type: z.ZodLiteral<"shell">;
+                    matcher: z.ZodLiteral<"regexp">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>], "matcher">, z.ZodDiscriminatedUnion<[z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"tool">;
+                    matcher: z.ZodLiteral<"exact">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"tool">;
+                    matcher: z.ZodLiteral<"glob">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"tool">;
+                    matcher: z.ZodLiteral<"regexp">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"tool">;
+                    matcher: z.ZodLiteral<"hint">;
+                    pattern: z.ZodObject<{
+                        readOnlyHint: z.ZodOptional<z.ZodBoolean>;
+                        destructiveHint: z.ZodOptional<z.ZodBoolean>;
+                        idempotentHint: z.ZodOptional<z.ZodBoolean>;
+                        openWorldHint: z.ZodOptional<z.ZodBoolean>;
+                    }, z.core.$strict>;
+                }, z.core.$strict>], "matcher">, z.ZodDiscriminatedUnion<[z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"mcpTool">;
+                    matcher: z.ZodLiteral<"exact">;
+                    server: z.ZodString;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"mcpTool">;
+                    matcher: z.ZodLiteral<"glob">;
+                    server: z.ZodString;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"mcpTool">;
+                    matcher: z.ZodLiteral<"regexp">;
+                    server: z.ZodString;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"mcpTool">;
+                    matcher: z.ZodLiteral<"hint">;
+                    server: z.ZodString;
+                    pattern: z.ZodObject<{
+                        readOnlyHint: z.ZodOptional<z.ZodBoolean>;
+                        destructiveHint: z.ZodOptional<z.ZodBoolean>;
+                        idempotentHint: z.ZodOptional<z.ZodBoolean>;
+                        openWorldHint: z.ZodOptional<z.ZodBoolean>;
+                    }, z.core.$strict>;
+                }, z.core.$strict>], "matcher">], "type">>>;
+                escalate: z.ZodOptional<z.ZodArray<z.ZodDiscriminatedUnion<[z.ZodDiscriminatedUnion<[z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    type: z.ZodLiteral<"shell">;
+                    matcher: z.ZodLiteral<"exact">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    type: z.ZodLiteral<"shell">;
+                    matcher: z.ZodLiteral<"glob">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    type: z.ZodLiteral<"shell">;
+                    matcher: z.ZodLiteral<"regexp">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>], "matcher">, z.ZodDiscriminatedUnion<[z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"tool">;
+                    matcher: z.ZodLiteral<"exact">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"tool">;
+                    matcher: z.ZodLiteral<"glob">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"tool">;
+                    matcher: z.ZodLiteral<"regexp">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"tool">;
+                    matcher: z.ZodLiteral<"hint">;
+                    pattern: z.ZodObject<{
+                        readOnlyHint: z.ZodOptional<z.ZodBoolean>;
+                        destructiveHint: z.ZodOptional<z.ZodBoolean>;
+                        idempotentHint: z.ZodOptional<z.ZodBoolean>;
+                        openWorldHint: z.ZodOptional<z.ZodBoolean>;
+                    }, z.core.$strict>;
+                }, z.core.$strict>], "matcher">, z.ZodDiscriminatedUnion<[z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"mcpTool">;
+                    matcher: z.ZodLiteral<"exact">;
+                    server: z.ZodString;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"mcpTool">;
+                    matcher: z.ZodLiteral<"glob">;
+                    server: z.ZodString;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"mcpTool">;
+                    matcher: z.ZodLiteral<"regexp">;
+                    server: z.ZodString;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"mcpTool">;
+                    matcher: z.ZodLiteral<"hint">;
+                    server: z.ZodString;
+                    pattern: z.ZodObject<{
+                        readOnlyHint: z.ZodOptional<z.ZodBoolean>;
+                        destructiveHint: z.ZodOptional<z.ZodBoolean>;
+                        idempotentHint: z.ZodOptional<z.ZodBoolean>;
+                        openWorldHint: z.ZodOptional<z.ZodBoolean>;
+                    }, z.core.$strict>;
+                }, z.core.$strict>], "matcher">], "type">>>;
+                raterTimeoutMs: z.ZodOptional<z.ZodNumber>;
+                mcp: z.ZodOptional<z.ZodObject<{
+                    defaults: z.ZodOptional<z.ZodObject<{
+                        trustAnnotations: z.ZodOptional<z.ZodArray<z.ZodEnum<{
+                            destructiveHint: "destructiveHint";
+                            idempotentHint: "idempotentHint";
+                            openWorldHint: "openWorldHint";
+                            readOnlyHint: "readOnlyHint";
+                        }>>>;
+                    }, z.core.$strict>>;
+                    servers: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
+                        trustAnnotations: z.ZodOptional<z.ZodArray<z.ZodEnum<{
+                            destructiveHint: "destructiveHint";
+                            idempotentHint: "idempotentHint";
+                            openWorldHint: "openWorldHint";
+                            readOnlyHint: "readOnlyHint";
+                        }>>>;
+                    }, z.core.$strict>>>;
+                }, z.core.$strict>>;
+            }, z.core.$strip>]>>;
             customTools: z.ZodOptional<z.ZodUnion<readonly [z.ZodLiteral<false>, z.ZodRecord<z.ZodString, z.ZodObject<{
                 command: z.ZodString;
                 description: z.ZodString;
@@ -270,8 +1899,8 @@ export declare const rawGthConfigSchema: z.ZodObject<{
                     allow: z.ZodOptional<z.ZodArray<z.ZodEnum<{
                         "absolute-paths": "absolute-paths";
                         "directory-traversal": "directory-traversal";
-                        "shell-injection": "shell-injection";
                         "null-bytes": "null-bytes";
+                        "shell-injection": "shell-injection";
                     }>>>;
                 }, z.core.$strip>>>;
                 timeout: z.ZodOptional<z.ZodNumber>;
@@ -279,11 +1908,11 @@ export declare const rawGthConfigSchema: z.ZodObject<{
             allowedTools: z.ZodOptional<z.ZodArray<z.ZodString>>;
             binaryFormats: z.ZodOptional<z.ZodUnion<readonly [z.ZodLiteral<false>, z.ZodArray<z.ZodObject<{
                 type: z.ZodEnum<{
+                    audio: "audio";
                     binary: "binary";
+                    file: "file";
                     image: "image";
-                    audio: "audio";
                     video: "video";
-                    file: "file";
                 }>;
                 extensions: z.ZodArray<z.ZodString>;
                 maxSize: z.ZodOptional<z.ZodNumber>;
@@ -293,10 +1922,289 @@ export declare const rawGthConfigSchema: z.ZodObject<{
         code: z.ZodOptional<z.ZodObject<{
             filesystem: z.ZodOptional<z.ZodUnion<readonly [z.ZodArray<z.ZodString>, z.ZodEnum<{
                 all: "all";
-                read: "read";
                 none: "none";
+                read: "read";
             }>]>>;
-            builtInTools: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            builtInTools: z.ZodOptional<z.ZodUnion<readonly [z.ZodArray<z.ZodString>, z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodBoolean, z.ZodObject<{
+                enabled: z.ZodOptional<z.ZodBoolean>;
+                command: z.ZodOptional<z.ZodString>;
+                timeout: z.ZodOptional<z.ZodNumber>;
+                maxOutputBytes: z.ZodOptional<z.ZodNumber>;
+                maxBytes: z.ZodOptional<z.ZodNumber>;
+                fileSet: z.ZodOptional<z.ZodEnum<{
+                    all: "all";
+                    gitignore: "gitignore";
+                }>>;
+            }, z.core.$strip>]>>]>>;
+            approvals: z.ZodOptional<z.ZodUnion<readonly [z.ZodEnum<{
+                assisted: "assisted";
+                auto: "auto";
+                bypass: "bypass";
+                manual: "manual";
+                write: "write";
+            }>, z.ZodObject<{
+                mode: z.ZodOptional<z.ZodEnum<{
+                    assisted: "assisted";
+                    auto: "auto";
+                    bypass: "bypass";
+                    manual: "manual";
+                    write: "write";
+                }>>;
+                rater: z.ZodOptional<z.ZodString>;
+                allow: z.ZodOptional<z.ZodArray<z.ZodDiscriminatedUnion<[z.ZodDiscriminatedUnion<[z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    type: z.ZodLiteral<"shell">;
+                    matcher: z.ZodLiteral<"exact">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    type: z.ZodLiteral<"shell">;
+                    matcher: z.ZodLiteral<"glob">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    type: z.ZodLiteral<"shell">;
+                    matcher: z.ZodLiteral<"regexp">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>], "matcher">, z.ZodDiscriminatedUnion<[z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"tool">;
+                    matcher: z.ZodLiteral<"exact">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"tool">;
+                    matcher: z.ZodLiteral<"glob">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"tool">;
+                    matcher: z.ZodLiteral<"regexp">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"tool">;
+                    matcher: z.ZodLiteral<"hint">;
+                    pattern: z.ZodObject<{
+                        readOnlyHint: z.ZodOptional<z.ZodBoolean>;
+                        destructiveHint: z.ZodOptional<z.ZodBoolean>;
+                        idempotentHint: z.ZodOptional<z.ZodBoolean>;
+                        openWorldHint: z.ZodOptional<z.ZodBoolean>;
+                    }, z.core.$strict>;
+                }, z.core.$strict>], "matcher">, z.ZodDiscriminatedUnion<[z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"mcpTool">;
+                    matcher: z.ZodLiteral<"exact">;
+                    server: z.ZodString;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"mcpTool">;
+                    matcher: z.ZodLiteral<"glob">;
+                    server: z.ZodString;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"mcpTool">;
+                    matcher: z.ZodLiteral<"regexp">;
+                    server: z.ZodString;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"mcpTool">;
+                    matcher: z.ZodLiteral<"hint">;
+                    server: z.ZodString;
+                    pattern: z.ZodObject<{
+                        readOnlyHint: z.ZodOptional<z.ZodBoolean>;
+                        destructiveHint: z.ZodOptional<z.ZodBoolean>;
+                        idempotentHint: z.ZodOptional<z.ZodBoolean>;
+                        openWorldHint: z.ZodOptional<z.ZodBoolean>;
+                    }, z.core.$strict>;
+                }, z.core.$strict>], "matcher">], "type">>>;
+                deny: z.ZodOptional<z.ZodArray<z.ZodDiscriminatedUnion<[z.ZodDiscriminatedUnion<[z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    type: z.ZodLiteral<"shell">;
+                    matcher: z.ZodLiteral<"exact">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    type: z.ZodLiteral<"shell">;
+                    matcher: z.ZodLiteral<"glob">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    type: z.ZodLiteral<"shell">;
+                    matcher: z.ZodLiteral<"regexp">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>], "matcher">, z.ZodDiscriminatedUnion<[z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"tool">;
+                    matcher: z.ZodLiteral<"exact">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"tool">;
+                    matcher: z.ZodLiteral<"glob">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"tool">;
+                    matcher: z.ZodLiteral<"regexp">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"tool">;
+                    matcher: z.ZodLiteral<"hint">;
+                    pattern: z.ZodObject<{
+                        readOnlyHint: z.ZodOptional<z.ZodBoolean>;
+                        destructiveHint: z.ZodOptional<z.ZodBoolean>;
+                        idempotentHint: z.ZodOptional<z.ZodBoolean>;
+                        openWorldHint: z.ZodOptional<z.ZodBoolean>;
+                    }, z.core.$strict>;
+                }, z.core.$strict>], "matcher">, z.ZodDiscriminatedUnion<[z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"mcpTool">;
+                    matcher: z.ZodLiteral<"exact">;
+                    server: z.ZodString;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"mcpTool">;
+                    matcher: z.ZodLiteral<"glob">;
+                    server: z.ZodString;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"mcpTool">;
+                    matcher: z.ZodLiteral<"regexp">;
+                    server: z.ZodString;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"mcpTool">;
+                    matcher: z.ZodLiteral<"hint">;
+                    server: z.ZodString;
+                    pattern: z.ZodObject<{
+                        readOnlyHint: z.ZodOptional<z.ZodBoolean>;
+                        destructiveHint: z.ZodOptional<z.ZodBoolean>;
+                        idempotentHint: z.ZodOptional<z.ZodBoolean>;
+                        openWorldHint: z.ZodOptional<z.ZodBoolean>;
+                    }, z.core.$strict>;
+                }, z.core.$strict>], "matcher">], "type">>>;
+                escalate: z.ZodOptional<z.ZodArray<z.ZodDiscriminatedUnion<[z.ZodDiscriminatedUnion<[z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    type: z.ZodLiteral<"shell">;
+                    matcher: z.ZodLiteral<"exact">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    type: z.ZodLiteral<"shell">;
+                    matcher: z.ZodLiteral<"glob">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    type: z.ZodLiteral<"shell">;
+                    matcher: z.ZodLiteral<"regexp">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>], "matcher">, z.ZodDiscriminatedUnion<[z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"tool">;
+                    matcher: z.ZodLiteral<"exact">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"tool">;
+                    matcher: z.ZodLiteral<"glob">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"tool">;
+                    matcher: z.ZodLiteral<"regexp">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"tool">;
+                    matcher: z.ZodLiteral<"hint">;
+                    pattern: z.ZodObject<{
+                        readOnlyHint: z.ZodOptional<z.ZodBoolean>;
+                        destructiveHint: z.ZodOptional<z.ZodBoolean>;
+                        idempotentHint: z.ZodOptional<z.ZodBoolean>;
+                        openWorldHint: z.ZodOptional<z.ZodBoolean>;
+                    }, z.core.$strict>;
+                }, z.core.$strict>], "matcher">, z.ZodDiscriminatedUnion<[z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"mcpTool">;
+                    matcher: z.ZodLiteral<"exact">;
+                    server: z.ZodString;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"mcpTool">;
+                    matcher: z.ZodLiteral<"glob">;
+                    server: z.ZodString;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"mcpTool">;
+                    matcher: z.ZodLiteral<"regexp">;
+                    server: z.ZodString;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"mcpTool">;
+                    matcher: z.ZodLiteral<"hint">;
+                    server: z.ZodString;
+                    pattern: z.ZodObject<{
+                        readOnlyHint: z.ZodOptional<z.ZodBoolean>;
+                        destructiveHint: z.ZodOptional<z.ZodBoolean>;
+                        idempotentHint: z.ZodOptional<z.ZodBoolean>;
+                        openWorldHint: z.ZodOptional<z.ZodBoolean>;
+                    }, z.core.$strict>;
+                }, z.core.$strict>], "matcher">], "type">>>;
+                raterTimeoutMs: z.ZodOptional<z.ZodNumber>;
+                mcp: z.ZodOptional<z.ZodObject<{
+                    defaults: z.ZodOptional<z.ZodObject<{
+                        trustAnnotations: z.ZodOptional<z.ZodArray<z.ZodEnum<{
+                            destructiveHint: "destructiveHint";
+                            idempotentHint: "idempotentHint";
+                            openWorldHint: "openWorldHint";
+                            readOnlyHint: "readOnlyHint";
+                        }>>>;
+                    }, z.core.$strict>>;
+                    servers: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
+                        trustAnnotations: z.ZodOptional<z.ZodArray<z.ZodEnum<{
+                            destructiveHint: "destructiveHint";
+                            idempotentHint: "idempotentHint";
+                            openWorldHint: "openWorldHint";
+                            readOnlyHint: "readOnlyHint";
+                        }>>>;
+                    }, z.core.$strict>>>;
+                }, z.core.$strict>>;
+            }, z.core.$strip>]>>;
             customTools: z.ZodOptional<z.ZodUnion<readonly [z.ZodLiteral<false>, z.ZodRecord<z.ZodString, z.ZodObject<{
                 command: z.ZodString;
                 description: z.ZodString;
@@ -305,45 +2213,20 @@ export declare const rawGthConfigSchema: z.ZodObject<{
                     allow: z.ZodOptional<z.ZodArray<z.ZodEnum<{
                         "absolute-paths": "absolute-paths";
                         "directory-traversal": "directory-traversal";
-                        "shell-injection": "shell-injection";
                         "null-bytes": "null-bytes";
+                        "shell-injection": "shell-injection";
                     }>>>;
                 }, z.core.$strip>>>;
                 timeout: z.ZodOptional<z.ZodNumber>;
             }, z.core.$strip>>]>>;
             allowedTools: z.ZodOptional<z.ZodArray<z.ZodString>>;
-            devTools: z.ZodOptional<z.ZodObject<{
-                run_tests: z.ZodOptional<z.ZodString>;
-                run_lint: z.ZodOptional<z.ZodString>;
-                run_build: z.ZodOptional<z.ZodString>;
-                run_single_test: z.ZodOptional<z.ZodString>;
-                shell: z.ZodOptional<z.ZodUnion<readonly [z.ZodBoolean, z.ZodObject<{
-                    enabled: z.ZodOptional<z.ZodBoolean>;
-                    timeout: z.ZodOptional<z.ZodNumber>;
-                    maxOutputBytes: z.ZodOptional<z.ZodNumber>;
-                    allowlist: z.ZodOptional<z.ZodBoolean>;
-                    persistAllowlist: z.ZodOptional<z.ZodBoolean>;
-                    judge: z.ZodOptional<z.ZodUnion<readonly [z.ZodBoolean, z.ZodObject<{
-                        enabled: z.ZodOptional<z.ZodBoolean>;
-                        autoApproveLow: z.ZodOptional<z.ZodBoolean>;
-                        blockHigh: z.ZodOptional<z.ZodBoolean>;
-                        model: z.ZodOptional<z.ZodObject<{
-                            type: z.ZodOptional<z.ZodString>;
-                            model: z.ZodOptional<z.ZodString>;
-                            configuration: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
-                            apiKeyEnvironmentVariable: z.ZodOptional<z.ZodString>;
-                        }, z.core.$loose>>;
-                    }, z.core.$strip>]>>;
-                }, z.core.$strip>]>>;
-                shellYolo: z.ZodOptional<z.ZodBoolean>;
-            }, z.core.$strip>>;
             binaryFormats: z.ZodOptional<z.ZodUnion<readonly [z.ZodLiteral<false>, z.ZodArray<z.ZodObject<{
                 type: z.ZodEnum<{
+                    audio: "audio";
                     binary: "binary";
+                    file: "file";
                     image: "image";
-                    audio: "audio";
                     video: "video";
-                    file: "file";
                 }>;
                 extensions: z.ZodArray<z.ZodString>;
                 maxSize: z.ZodOptional<z.ZodNumber>;
@@ -353,10 +2236,289 @@ export declare const rawGthConfigSchema: z.ZodObject<{
         exec: z.ZodOptional<z.ZodObject<{
             filesystem: z.ZodOptional<z.ZodUnion<readonly [z.ZodArray<z.ZodString>, z.ZodEnum<{
                 all: "all";
-                read: "read";
                 none: "none";
+                read: "read";
             }>]>>;
-            builtInTools: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            builtInTools: z.ZodOptional<z.ZodUnion<readonly [z.ZodArray<z.ZodString>, z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodBoolean, z.ZodObject<{
+                enabled: z.ZodOptional<z.ZodBoolean>;
+                command: z.ZodOptional<z.ZodString>;
+                timeout: z.ZodOptional<z.ZodNumber>;
+                maxOutputBytes: z.ZodOptional<z.ZodNumber>;
+                maxBytes: z.ZodOptional<z.ZodNumber>;
+                fileSet: z.ZodOptional<z.ZodEnum<{
+                    all: "all";
+                    gitignore: "gitignore";
+                }>>;
+            }, z.core.$strip>]>>]>>;
+            approvals: z.ZodOptional<z.ZodUnion<readonly [z.ZodEnum<{
+                assisted: "assisted";
+                auto: "auto";
+                bypass: "bypass";
+                manual: "manual";
+                write: "write";
+            }>, z.ZodObject<{
+                mode: z.ZodOptional<z.ZodEnum<{
+                    assisted: "assisted";
+                    auto: "auto";
+                    bypass: "bypass";
+                    manual: "manual";
+                    write: "write";
+                }>>;
+                rater: z.ZodOptional<z.ZodString>;
+                allow: z.ZodOptional<z.ZodArray<z.ZodDiscriminatedUnion<[z.ZodDiscriminatedUnion<[z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    type: z.ZodLiteral<"shell">;
+                    matcher: z.ZodLiteral<"exact">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    type: z.ZodLiteral<"shell">;
+                    matcher: z.ZodLiteral<"glob">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    type: z.ZodLiteral<"shell">;
+                    matcher: z.ZodLiteral<"regexp">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>], "matcher">, z.ZodDiscriminatedUnion<[z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"tool">;
+                    matcher: z.ZodLiteral<"exact">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"tool">;
+                    matcher: z.ZodLiteral<"glob">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"tool">;
+                    matcher: z.ZodLiteral<"regexp">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"tool">;
+                    matcher: z.ZodLiteral<"hint">;
+                    pattern: z.ZodObject<{
+                        readOnlyHint: z.ZodOptional<z.ZodBoolean>;
+                        destructiveHint: z.ZodOptional<z.ZodBoolean>;
+                        idempotentHint: z.ZodOptional<z.ZodBoolean>;
+                        openWorldHint: z.ZodOptional<z.ZodBoolean>;
+                    }, z.core.$strict>;
+                }, z.core.$strict>], "matcher">, z.ZodDiscriminatedUnion<[z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"mcpTool">;
+                    matcher: z.ZodLiteral<"exact">;
+                    server: z.ZodString;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"mcpTool">;
+                    matcher: z.ZodLiteral<"glob">;
+                    server: z.ZodString;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"mcpTool">;
+                    matcher: z.ZodLiteral<"regexp">;
+                    server: z.ZodString;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"mcpTool">;
+                    matcher: z.ZodLiteral<"hint">;
+                    server: z.ZodString;
+                    pattern: z.ZodObject<{
+                        readOnlyHint: z.ZodOptional<z.ZodBoolean>;
+                        destructiveHint: z.ZodOptional<z.ZodBoolean>;
+                        idempotentHint: z.ZodOptional<z.ZodBoolean>;
+                        openWorldHint: z.ZodOptional<z.ZodBoolean>;
+                    }, z.core.$strict>;
+                }, z.core.$strict>], "matcher">], "type">>>;
+                deny: z.ZodOptional<z.ZodArray<z.ZodDiscriminatedUnion<[z.ZodDiscriminatedUnion<[z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    type: z.ZodLiteral<"shell">;
+                    matcher: z.ZodLiteral<"exact">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    type: z.ZodLiteral<"shell">;
+                    matcher: z.ZodLiteral<"glob">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    type: z.ZodLiteral<"shell">;
+                    matcher: z.ZodLiteral<"regexp">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>], "matcher">, z.ZodDiscriminatedUnion<[z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"tool">;
+                    matcher: z.ZodLiteral<"exact">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"tool">;
+                    matcher: z.ZodLiteral<"glob">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"tool">;
+                    matcher: z.ZodLiteral<"regexp">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"tool">;
+                    matcher: z.ZodLiteral<"hint">;
+                    pattern: z.ZodObject<{
+                        readOnlyHint: z.ZodOptional<z.ZodBoolean>;
+                        destructiveHint: z.ZodOptional<z.ZodBoolean>;
+                        idempotentHint: z.ZodOptional<z.ZodBoolean>;
+                        openWorldHint: z.ZodOptional<z.ZodBoolean>;
+                    }, z.core.$strict>;
+                }, z.core.$strict>], "matcher">, z.ZodDiscriminatedUnion<[z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"mcpTool">;
+                    matcher: z.ZodLiteral<"exact">;
+                    server: z.ZodString;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"mcpTool">;
+                    matcher: z.ZodLiteral<"glob">;
+                    server: z.ZodString;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"mcpTool">;
+                    matcher: z.ZodLiteral<"regexp">;
+                    server: z.ZodString;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"mcpTool">;
+                    matcher: z.ZodLiteral<"hint">;
+                    server: z.ZodString;
+                    pattern: z.ZodObject<{
+                        readOnlyHint: z.ZodOptional<z.ZodBoolean>;
+                        destructiveHint: z.ZodOptional<z.ZodBoolean>;
+                        idempotentHint: z.ZodOptional<z.ZodBoolean>;
+                        openWorldHint: z.ZodOptional<z.ZodBoolean>;
+                    }, z.core.$strict>;
+                }, z.core.$strict>], "matcher">], "type">>>;
+                escalate: z.ZodOptional<z.ZodArray<z.ZodDiscriminatedUnion<[z.ZodDiscriminatedUnion<[z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    type: z.ZodLiteral<"shell">;
+                    matcher: z.ZodLiteral<"exact">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    type: z.ZodLiteral<"shell">;
+                    matcher: z.ZodLiteral<"glob">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    type: z.ZodLiteral<"shell">;
+                    matcher: z.ZodLiteral<"regexp">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>], "matcher">, z.ZodDiscriminatedUnion<[z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"tool">;
+                    matcher: z.ZodLiteral<"exact">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"tool">;
+                    matcher: z.ZodLiteral<"glob">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"tool">;
+                    matcher: z.ZodLiteral<"regexp">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"tool">;
+                    matcher: z.ZodLiteral<"hint">;
+                    pattern: z.ZodObject<{
+                        readOnlyHint: z.ZodOptional<z.ZodBoolean>;
+                        destructiveHint: z.ZodOptional<z.ZodBoolean>;
+                        idempotentHint: z.ZodOptional<z.ZodBoolean>;
+                        openWorldHint: z.ZodOptional<z.ZodBoolean>;
+                    }, z.core.$strict>;
+                }, z.core.$strict>], "matcher">, z.ZodDiscriminatedUnion<[z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"mcpTool">;
+                    matcher: z.ZodLiteral<"exact">;
+                    server: z.ZodString;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"mcpTool">;
+                    matcher: z.ZodLiteral<"glob">;
+                    server: z.ZodString;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"mcpTool">;
+                    matcher: z.ZodLiteral<"regexp">;
+                    server: z.ZodString;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"mcpTool">;
+                    matcher: z.ZodLiteral<"hint">;
+                    server: z.ZodString;
+                    pattern: z.ZodObject<{
+                        readOnlyHint: z.ZodOptional<z.ZodBoolean>;
+                        destructiveHint: z.ZodOptional<z.ZodBoolean>;
+                        idempotentHint: z.ZodOptional<z.ZodBoolean>;
+                        openWorldHint: z.ZodOptional<z.ZodBoolean>;
+                    }, z.core.$strict>;
+                }, z.core.$strict>], "matcher">], "type">>>;
+                raterTimeoutMs: z.ZodOptional<z.ZodNumber>;
+                mcp: z.ZodOptional<z.ZodObject<{
+                    defaults: z.ZodOptional<z.ZodObject<{
+                        trustAnnotations: z.ZodOptional<z.ZodArray<z.ZodEnum<{
+                            destructiveHint: "destructiveHint";
+                            idempotentHint: "idempotentHint";
+                            openWorldHint: "openWorldHint";
+                            readOnlyHint: "readOnlyHint";
+                        }>>>;
+                    }, z.core.$strict>>;
+                    servers: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
+                        trustAnnotations: z.ZodOptional<z.ZodArray<z.ZodEnum<{
+                            destructiveHint: "destructiveHint";
+                            idempotentHint: "idempotentHint";
+                            openWorldHint: "openWorldHint";
+                            readOnlyHint: "readOnlyHint";
+                        }>>>;
+                    }, z.core.$strict>>>;
+                }, z.core.$strict>>;
+            }, z.core.$strip>]>>;
             customTools: z.ZodOptional<z.ZodUnion<readonly [z.ZodLiteral<false>, z.ZodRecord<z.ZodString, z.ZodObject<{
                 command: z.ZodString;
                 description: z.ZodString;
@@ -365,45 +2527,20 @@ export declare const rawGthConfigSchema: z.ZodObject<{
                     allow: z.ZodOptional<z.ZodArray<z.ZodEnum<{
                         "absolute-paths": "absolute-paths";
                         "directory-traversal": "directory-traversal";
-                        "shell-injection": "shell-injection";
                         "null-bytes": "null-bytes";
+                        "shell-injection": "shell-injection";
                     }>>>;
                 }, z.core.$strip>>>;
                 timeout: z.ZodOptional<z.ZodNumber>;
             }, z.core.$strip>>]>>;
             allowedTools: z.ZodOptional<z.ZodArray<z.ZodString>>;
-            devTools: z.ZodOptional<z.ZodObject<{
-                run_tests: z.ZodOptional<z.ZodString>;
-                run_lint: z.ZodOptional<z.ZodString>;
-                run_build: z.ZodOptional<z.ZodString>;
-                run_single_test: z.ZodOptional<z.ZodString>;
-                shell: z.ZodOptional<z.ZodUnion<readonly [z.ZodBoolean, z.ZodObject<{
-                    enabled: z.ZodOptional<z.ZodBoolean>;
-                    timeout: z.ZodOptional<z.ZodNumber>;
-                    maxOutputBytes: z.ZodOptional<z.ZodNumber>;
-                    allowlist: z.ZodOptional<z.ZodBoolean>;
-                    persistAllowlist: z.ZodOptional<z.ZodBoolean>;
-                    judge: z.ZodOptional<z.ZodUnion<readonly [z.ZodBoolean, z.ZodObject<{
-                        enabled: z.ZodOptional<z.ZodBoolean>;
-                        autoApproveLow: z.ZodOptional<z.ZodBoolean>;
-                        blockHigh: z.ZodOptional<z.ZodBoolean>;
-                        model: z.ZodOptional<z.ZodObject<{
-                            type: z.ZodOptional<z.ZodString>;
-                            model: z.ZodOptional<z.ZodString>;
-                            configuration: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
-                            apiKeyEnvironmentVariable: z.ZodOptional<z.ZodString>;
-                        }, z.core.$loose>>;
-                    }, z.core.$strip>]>>;
-                }, z.core.$strip>]>>;
-                shellYolo: z.ZodOptional<z.ZodBoolean>;
-            }, z.core.$strip>>;
             binaryFormats: z.ZodOptional<z.ZodUnion<readonly [z.ZodLiteral<false>, z.ZodArray<z.ZodObject<{
                 type: z.ZodEnum<{
+                    audio: "audio";
                     binary: "binary";
+                    file: "file";
                     image: "image";
-                    audio: "audio";
                     video: "video";
-                    file: "file";
                 }>;
                 extensions: z.ZodArray<z.ZodString>;
                 maxSize: z.ZodOptional<z.ZodNumber>;
@@ -413,10 +2550,289 @@ export declare const rawGthConfigSchema: z.ZodObject<{
         api: z.ZodOptional<z.ZodObject<{
             filesystem: z.ZodOptional<z.ZodUnion<readonly [z.ZodArray<z.ZodString>, z.ZodEnum<{
                 all: "all";
-                read: "read";
                 none: "none";
+                read: "read";
             }>]>>;
-            builtInTools: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            builtInTools: z.ZodOptional<z.ZodUnion<readonly [z.ZodArray<z.ZodString>, z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodBoolean, z.ZodObject<{
+                enabled: z.ZodOptional<z.ZodBoolean>;
+                command: z.ZodOptional<z.ZodString>;
+                timeout: z.ZodOptional<z.ZodNumber>;
+                maxOutputBytes: z.ZodOptional<z.ZodNumber>;
+                maxBytes: z.ZodOptional<z.ZodNumber>;
+                fileSet: z.ZodOptional<z.ZodEnum<{
+                    all: "all";
+                    gitignore: "gitignore";
+                }>>;
+            }, z.core.$strip>]>>]>>;
+            approvals: z.ZodOptional<z.ZodUnion<readonly [z.ZodEnum<{
+                assisted: "assisted";
+                auto: "auto";
+                bypass: "bypass";
+                manual: "manual";
+                write: "write";
+            }>, z.ZodObject<{
+                mode: z.ZodOptional<z.ZodEnum<{
+                    assisted: "assisted";
+                    auto: "auto";
+                    bypass: "bypass";
+                    manual: "manual";
+                    write: "write";
+                }>>;
+                rater: z.ZodOptional<z.ZodString>;
+                allow: z.ZodOptional<z.ZodArray<z.ZodDiscriminatedUnion<[z.ZodDiscriminatedUnion<[z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    type: z.ZodLiteral<"shell">;
+                    matcher: z.ZodLiteral<"exact">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    type: z.ZodLiteral<"shell">;
+                    matcher: z.ZodLiteral<"glob">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    type: z.ZodLiteral<"shell">;
+                    matcher: z.ZodLiteral<"regexp">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>], "matcher">, z.ZodDiscriminatedUnion<[z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"tool">;
+                    matcher: z.ZodLiteral<"exact">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"tool">;
+                    matcher: z.ZodLiteral<"glob">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"tool">;
+                    matcher: z.ZodLiteral<"regexp">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"tool">;
+                    matcher: z.ZodLiteral<"hint">;
+                    pattern: z.ZodObject<{
+                        readOnlyHint: z.ZodOptional<z.ZodBoolean>;
+                        destructiveHint: z.ZodOptional<z.ZodBoolean>;
+                        idempotentHint: z.ZodOptional<z.ZodBoolean>;
+                        openWorldHint: z.ZodOptional<z.ZodBoolean>;
+                    }, z.core.$strict>;
+                }, z.core.$strict>], "matcher">, z.ZodDiscriminatedUnion<[z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"mcpTool">;
+                    matcher: z.ZodLiteral<"exact">;
+                    server: z.ZodString;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"mcpTool">;
+                    matcher: z.ZodLiteral<"glob">;
+                    server: z.ZodString;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"mcpTool">;
+                    matcher: z.ZodLiteral<"regexp">;
+                    server: z.ZodString;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"mcpTool">;
+                    matcher: z.ZodLiteral<"hint">;
+                    server: z.ZodString;
+                    pattern: z.ZodObject<{
+                        readOnlyHint: z.ZodOptional<z.ZodBoolean>;
+                        destructiveHint: z.ZodOptional<z.ZodBoolean>;
+                        idempotentHint: z.ZodOptional<z.ZodBoolean>;
+                        openWorldHint: z.ZodOptional<z.ZodBoolean>;
+                    }, z.core.$strict>;
+                }, z.core.$strict>], "matcher">], "type">>>;
+                deny: z.ZodOptional<z.ZodArray<z.ZodDiscriminatedUnion<[z.ZodDiscriminatedUnion<[z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    type: z.ZodLiteral<"shell">;
+                    matcher: z.ZodLiteral<"exact">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    type: z.ZodLiteral<"shell">;
+                    matcher: z.ZodLiteral<"glob">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    type: z.ZodLiteral<"shell">;
+                    matcher: z.ZodLiteral<"regexp">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>], "matcher">, z.ZodDiscriminatedUnion<[z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"tool">;
+                    matcher: z.ZodLiteral<"exact">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"tool">;
+                    matcher: z.ZodLiteral<"glob">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"tool">;
+                    matcher: z.ZodLiteral<"regexp">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"tool">;
+                    matcher: z.ZodLiteral<"hint">;
+                    pattern: z.ZodObject<{
+                        readOnlyHint: z.ZodOptional<z.ZodBoolean>;
+                        destructiveHint: z.ZodOptional<z.ZodBoolean>;
+                        idempotentHint: z.ZodOptional<z.ZodBoolean>;
+                        openWorldHint: z.ZodOptional<z.ZodBoolean>;
+                    }, z.core.$strict>;
+                }, z.core.$strict>], "matcher">, z.ZodDiscriminatedUnion<[z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"mcpTool">;
+                    matcher: z.ZodLiteral<"exact">;
+                    server: z.ZodString;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"mcpTool">;
+                    matcher: z.ZodLiteral<"glob">;
+                    server: z.ZodString;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"mcpTool">;
+                    matcher: z.ZodLiteral<"regexp">;
+                    server: z.ZodString;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"mcpTool">;
+                    matcher: z.ZodLiteral<"hint">;
+                    server: z.ZodString;
+                    pattern: z.ZodObject<{
+                        readOnlyHint: z.ZodOptional<z.ZodBoolean>;
+                        destructiveHint: z.ZodOptional<z.ZodBoolean>;
+                        idempotentHint: z.ZodOptional<z.ZodBoolean>;
+                        openWorldHint: z.ZodOptional<z.ZodBoolean>;
+                    }, z.core.$strict>;
+                }, z.core.$strict>], "matcher">], "type">>>;
+                escalate: z.ZodOptional<z.ZodArray<z.ZodDiscriminatedUnion<[z.ZodDiscriminatedUnion<[z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    type: z.ZodLiteral<"shell">;
+                    matcher: z.ZodLiteral<"exact">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    type: z.ZodLiteral<"shell">;
+                    matcher: z.ZodLiteral<"glob">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    type: z.ZodLiteral<"shell">;
+                    matcher: z.ZodLiteral<"regexp">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>], "matcher">, z.ZodDiscriminatedUnion<[z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"tool">;
+                    matcher: z.ZodLiteral<"exact">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"tool">;
+                    matcher: z.ZodLiteral<"glob">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"tool">;
+                    matcher: z.ZodLiteral<"regexp">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"tool">;
+                    matcher: z.ZodLiteral<"hint">;
+                    pattern: z.ZodObject<{
+                        readOnlyHint: z.ZodOptional<z.ZodBoolean>;
+                        destructiveHint: z.ZodOptional<z.ZodBoolean>;
+                        idempotentHint: z.ZodOptional<z.ZodBoolean>;
+                        openWorldHint: z.ZodOptional<z.ZodBoolean>;
+                    }, z.core.$strict>;
+                }, z.core.$strict>], "matcher">, z.ZodDiscriminatedUnion<[z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"mcpTool">;
+                    matcher: z.ZodLiteral<"exact">;
+                    server: z.ZodString;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"mcpTool">;
+                    matcher: z.ZodLiteral<"glob">;
+                    server: z.ZodString;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"mcpTool">;
+                    matcher: z.ZodLiteral<"regexp">;
+                    server: z.ZodString;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"mcpTool">;
+                    matcher: z.ZodLiteral<"hint">;
+                    server: z.ZodString;
+                    pattern: z.ZodObject<{
+                        readOnlyHint: z.ZodOptional<z.ZodBoolean>;
+                        destructiveHint: z.ZodOptional<z.ZodBoolean>;
+                        idempotentHint: z.ZodOptional<z.ZodBoolean>;
+                        openWorldHint: z.ZodOptional<z.ZodBoolean>;
+                    }, z.core.$strict>;
+                }, z.core.$strict>], "matcher">], "type">>>;
+                raterTimeoutMs: z.ZodOptional<z.ZodNumber>;
+                mcp: z.ZodOptional<z.ZodObject<{
+                    defaults: z.ZodOptional<z.ZodObject<{
+                        trustAnnotations: z.ZodOptional<z.ZodArray<z.ZodEnum<{
+                            destructiveHint: "destructiveHint";
+                            idempotentHint: "idempotentHint";
+                            openWorldHint: "openWorldHint";
+                            readOnlyHint: "readOnlyHint";
+                        }>>>;
+                    }, z.core.$strict>>;
+                    servers: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
+                        trustAnnotations: z.ZodOptional<z.ZodArray<z.ZodEnum<{
+                            destructiveHint: "destructiveHint";
+                            idempotentHint: "idempotentHint";
+                            openWorldHint: "openWorldHint";
+                            readOnlyHint: "readOnlyHint";
+                        }>>>;
+                    }, z.core.$strict>>>;
+                }, z.core.$strict>>;
+            }, z.core.$strip>]>>;
             port: z.ZodOptional<z.ZodNumber>;
             cors: z.ZodOptional<z.ZodObject<{
                 allowOrigin: z.ZodOptional<z.ZodString>;
@@ -425,9 +2841,43 @@ export declare const rawGthConfigSchema: z.ZodObject<{
             }, z.core.$strip>>;
         }, z.core.$strip>>;
     }, z.core.$strip>>;
+    acp: z.ZodOptional<z.ZodObject<{
+        mode: z.ZodOptional<z.ZodEnum<{
+            chat: "chat";
+            code: "code";
+        }>>;
+    }, z.core.$strip>>;
+    commit: z.ZodOptional<z.ZodObject<{
+        coAuthor: z.ZodOptional<z.ZodObject<{
+            name: z.ZodOptional<z.ZodString>;
+            email: z.ZodOptional<z.ZodString>;
+        }, z.core.$strip>>;
+    }, z.core.$strip>>;
     modelDisplayName: z.ZodOptional<z.ZodString>;
+    injectModelContext: z.ZodOptional<z.ZodBoolean>;
+    debugDump: z.ZodOptional<z.ZodObject<{
+        redact: z.ZodOptional<z.ZodBoolean>;
+    }, z.core.$strip>>;
     allowDirs: z.ZodOptional<z.ZodArray<z.ZodString>>;
     askWriteMode: z.ZodOptional<z.ZodBoolean>;
+    output: z.ZodOptional<z.ZodObject<{
+        header: z.ZodOptional<z.ZodEnum<{
+            compact: "compact";
+            debug: "debug";
+            none: "none";
+        }>>;
+    }, z.core.$strip>>;
+    toolLoopGuard: z.ZodOptional<z.ZodUnion<readonly [z.ZodBoolean, z.ZodObject<{
+        warn: z.ZodOptional<z.ZodBoolean>;
+        halt: z.ZodOptional<z.ZodBoolean>;
+        threshold: z.ZodOptional<z.ZodNumber>;
+    }, z.core.$strip>]>>;
+    reporters: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+    subagents: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        name: z.ZodString;
+        description: z.ZodOptional<z.ZodString>;
+        profile: z.ZodString;
+    }, z.core.$strip>>>;
 }, z.core.$loose>;
 /**
  * Type inferred from {@link rawGthConfigSchema}. This is additive and intentionally
@@ -440,10 +2890,20 @@ export type RawGthConfigInput = z.infer<typeof rawGthConfigSchema>;
  * never drift from {@link rawGthConfigSchema}. Includes `$schema`.
  */
 export declare const KNOWN_TOP_LEVEL_KEYS: ReadonlySet<string>;
+/**
+ * True when a raw config value is a plain (non-null, non-array) object, so the key scans
+ * ({@link findDeprecatedConfigIssues}, {@link findUnknownTopLevelKeys}) are safe to run. A
+ * `null`/array/primitive config (e.g. a JSON file that is just `null`, or a module
+ * `configure()` returning null) must NOT reach those scans — they'd throw on
+ * `hasOwnProperty`/`Object.keys`; the entry points instead hand it straight to
+ * `rawGthConfigSchema.safeParse`, which reports a clean "expected object" error.
+ */
+export declare function isRecordConfig(value: unknown): value is Record<string, unknown>;
 /**
  * Return the top-level keys present in `raw` that are not part of the known config
- * surface. Deprecated aliases should be pre-mapped away first (see
- * {@link preMapDeprecatedConfigNames}) so they do not show up here.
+ * surface. KNOWN deprecated names are rejected earlier by {@link findDeprecatedConfigIssues}
+ * (the entry points short-circuit on those), so a key that reaches here is a genuinely
+ * unknown key (a likely typo) that only warrants a warning.
  */
 export declare function findUnknownTopLevelKeys(raw: Record<string, unknown>): string[];
 /**
@@ -451,21 +2911,126 @@ export declare function findUnknownTopLevelKeys(raw: Record<string, unknown>): s
  * becomes a line `  - <path>: <message>`, with `(root)` for top-level issues.
  */
 export declare function formatConfigValidationError(error: z.ZodError): string;
+/** A single deprecated-config-shape rejection: the offending `path` and the migration message. */
+export interface DeprecatedConfigIssue {
+    /** Dotted path of the offending key (e.g. `pr`, `commands.pr.contentProvider`). */
+    path: string;
+    /** Human message naming the canonical replacement + migration path. */
+    message: string;
+}
 /**
- * B3 — one-way pre-map of deprecated config key names to their canonical names, at
- * the config root AND per-command. Mutates `raw` in place (it is always a freshly
- * loaded config layer) and returns it alongside a list of deprecation warnings the
- * caller should emit via `displayWarning`. Canonical names win when both are
- * present; the deprecated key is always removed so it does not later surface as an
- * "unknown top-level key".
+ * GS2-28 — detect the removed pre-2.0 config shapes on the RAW input (read-only; no
+ * mutation), returning one {@link DeprecatedConfigIssue} per occurrence. A non-empty
+ * result is a HARD validation failure: 2.0 dropped back-compat coercion, so an old shape
+ * must error and point at the fix rather than be silently remapped or ignored.
+ *
+ * Detects:
+ * - (A) a COMMAND name ({@link COMMAND_KEYS}) at the config ROOT — must move under `commands.<cmd>`;
+ * - (C) a deprecated `*Provider*` name ({@link DEPRECATED_ROOT_PAIRS} at root,
+ *   {@link DEPRECATED_COMMAND_PAIRS} per command) — must use its `*Source*` replacement;
+ * - (D, CFG-18) a removed per-command key folded into another ({@link REMOVED_COMMAND_KEYS}, e.g.
+ *   `commands.<cmd>.devTools` → configure under `builtInTools`);
+ * - (E, CFG-26) a retired `run_shell_command` approval knob ({@link RETIRED_SHELL_TOOL_PAIRS}) at
+ *   EITHER `builtInTools.run_shell_command.*` or `commands.<cmd>.builtInTools.run_shell_command.*`
+ *   — each message names the `approvals.*` key that replaced it;
+ * - (F, CFG-27) a retired `approvals` key or `mode` value ({@link RETIRED_APPROVALS_KEYS},
+ *   {@link RETIRED_APPROVAL_MODES}) at EITHER `approvals.*` or `commands.<cmd>.approvals.*` —
+ *   each message names the rung that replaced it;
+ * - (G, EXT-114) a retired `agent.backend` value ({@link RETIRED_AGENT_BACKENDS}) — the message
+ *   names the surviving backend and what the retired one took with it.
+ *
+ * Runs on the raw input specifically so nested `commands.*.contentProvider` is still visible
+ * (zod's per-command `z.object` would strip it before any schema-embedded check could fire).
+ * A genuinely-unknown key is NOT flagged here (it stays a warn-only unknown key), preserving
+ * the deliberate typo-tolerance.
  */
-export declare function preMapDeprecatedConfigNames<T extends Record<string, unknown>>(raw: T): {
-    config: T;
-    warnings: string[];
-};
+export declare function findDeprecatedConfigIssues(raw: Record<string, unknown>): DeprecatedConfigIssue[];
+/**
+ * EXT-71 §3.1 — every hard error the rule grammar defines, found on the RAW input: each entry in
+ * `allow`/`deny`/`escalate` validated with a path that names the offending field
+ * ({@link collectApprovalEntryIssues}), the `approvals.mcp` block ({@link collectMcpApprovalsIssues}),
+ * and the two `mcpServers` keys no rule can refer to — `*` ({@link RESERVED_MCP_SERVER_NAME}, which
+ * an entry already reads as "every server") and the empty name
+ * ({@link UNNAMEABLE_MCP_SERVER_NAME}, which no entry's `server` field can hold). Both need to see
+ * `mcpServers`, a sibling of `approvals` rather than a field of it.
+ *
+ * All of them are HARD errors, reported the same way {@link findDeprecatedConfigIssues} reports
+ * its own, and — like it — this runs BEFORE the schema parse so the precise message is the only
+ * one the user sees.
+ *
+ * PURE: it only reads the object. Kept separate from {@link findDeprecatedConfigIssues} because
+ * these are not removed pre-2.0 shapes; they are rules of the current grammar.
+ */
+export declare function findApprovalsGrammarIssues(raw: Record<string, unknown>): DeprecatedConfigIssue[];
+/**
+ * CFG-26 — one `approvals.rater` reference found in a raw config, with the dotted config path it
+ * was found at (`approvals.rater` or `commands.<name>.approvals.rater`).
+ */
+export interface RaterProfileRef {
+    /** Dotted config path of the `rater` key, for the error message. */
+    path: string;
+    /** The profile name as written. */
+    profile: string;
+}
+/**
+ * CFG-26 — collect every `approvals.rater` in a raw config (root + each `commands.<name>`).
+ * CFG-27 flattened the key: it is a BARE identity-profile name, not `rater.profile`.
+ *
+ * PURE — it only reads the object; the caller decides whether each name RESOLVES. That split is
+ * deliberate: profile resolution needs the filesystem, and `schema.ts` must stay pure so
+ * `z.toJSONSchema` and every spec that validates a config object stay cwd-independent. The loader
+ * pairs this with `resolveIdentityProfileConfigPath` to enforce the GS2-62 rule that an
+ * unresolvable profile is a hard error, never a silent fallback to the main model.
+ */
+export declare function findApprovalsRaterProfiles(raw: Record<string, unknown>): RaterProfileRef[];
+/**
+ * CFG-26 — the ONE message for an `approvals.rater.profile` that does not resolve. Shared by the
+ * loader (which hard-exits a real run) and {@link validateRawGthConfig} (which backs
+ * `gth config validate`), so the validator can never green-light a config the runtime refuses.
+ */
+export declare function unresolvedRaterProfileMessage(ref: RaterProfileRef): string;
+/**
+ * Render {@link DeprecatedConfigIssue}s as the same `  - <path>: <message>` block used for
+ * Zod validation errors, so a deprecated-shape rejection reads identically to a type-mismatch
+ * rejection (loader wraps it with `Invalid configuration in <source>:`).
+ */
+export declare function formatDeprecatedConfigIssues(issues: ReadonlyArray<DeprecatedConfigIssue>): string;
 /**
  * Generate the JSON Schema for the raw config from {@link rawGthConfigSchema} using
  * zod 4's native `z.toJSONSchema`. The output is committed to
  * `packages/core/schema/gsloth-config.schema.json` and asserted by a golden test.
  */
 export declare function generateConfigJsonSchema(): Record<string, unknown>;
+/**
+ * The structured outcome of validating a single raw config layer, WITHOUT any side
+ * effects (no console output, no `exit`). This is the read-side counterpart to the
+ * loader's `validateRawConfigLayer` (which warns + `exit`s inline): `gth config validate`
+ * uses it to render its own output and choose its own exit code.
+ */
+export interface RawConfigValidationOptions {
+    /**
+     * CFG-26 — resolves an identity profile NAME to "does it exist?". Supplied by the loader
+     * (`resolveIdentityProfileConfigPath`); omitted by pure/in-memory callers, which then skip the
+     * `approvals.rater.profile` existence check.
+     */
+    resolveProfile?: (profile: string) => boolean;
+}
+export interface RawConfigValidationResult {
+    /** True when the config parses against the schema (unknown keys do NOT make it false). */
+    ok: boolean;
+    /** Non-fatal advisories: unknown top-level keys (likely typos). Deprecated shapes are hard errors, not warnings. */
+    warnings: string[];
+    /** Present only when `ok` is false: the path-scoped, multi-line validation message. */
+    errorMessage?: string;
+}
+/**
+ * Validate a freshly-loaded raw config object against {@link rawGthConfigSchema} and
+ * report the outcome as data (a pure function — no `displayWarning`/`exit`). Mirrors the
+ * loader's policy: a removed pre-2.0 shape (a top-level command key or a deprecated
+ * `*Provider*` name) is a HARD failure that names the fix, unknown top-level keys warn but
+ * do not fail, and a genuine type mismatch on a known field fails with a path-scoped message.
+ *
+ * Read-only: `findDeprecatedConfigIssues`, `findUnknownTopLevelKeys` and `safeParse` never
+ * mutate `raw`, so no defensive copy is needed.
+ */
+export declare function validateRawGthConfig(raw: Record<string, unknown>, options?: RawConfigValidationOptions): RawConfigValidationResult;