@opentag/cli 0.3.0 → 0.3.1

package/dist/config.d.ts

@@ -2,6 +2,45 @@ import { type OpenTagDaemonConfig } from "@opentag/local-runtime";
 import { z } from "zod";
 import type { CliLanguage } from "./catalogs/languages.js";
 import type { PlatformId } from "./catalogs/platforms.js";
+declare const SecretRefSchema: z.ZodDiscriminatedUnion<"kind", [z.ZodObject<{
+    kind: z.ZodLiteral<"env">;
+    name: z.ZodString;
+}, "strict", z.ZodTypeAny, {
+    kind: "env";
+    name: string;
+}, {
+    kind: "env";
+    name: string;
+}>, z.ZodObject<{
+    kind: z.ZodLiteral<"file">;
+    path: z.ZodString;
+}, "strict", z.ZodTypeAny, {
+    kind: "file";
+    path: string;
+}, {
+    kind: "file";
+    path: string;
+}>, z.ZodObject<{
+    kind: z.ZodLiteral<"keychain">;
+    service: z.ZodString;
+    account: z.ZodString;
+}, "strict", z.ZodTypeAny, {
+    kind: "keychain";
+    service: string;
+    account: string;
+}, {
+    kind: "keychain";
+    service: string;
+    account: string;
+}>]>;
+export type SecretRef = z.infer<typeof SecretRefSchema>;
+export type KeychainSecretRef = Extract<SecretRef, {
+    kind: "keychain";
+}>;
+type ExecFileSyncLike = (file: string, args: readonly string[], options: {
+    encoding: "utf8";
+}) => string | Buffer;
+export declare function readKeychainSecret(ref: KeychainSecretRef, execFileSyncImpl?: ExecFileSyncLike): string;
 export declare const OpenTagCliConfigSchema: z.ZodObject<{
     schemaVersion: z.ZodLiteral<1>;
     state: z.ZodObject<{
@@ -17,10 +56,29 @@ export declare const OpenTagCliConfigSchema: z.ZodObject<{
         directory: string;
         databasePath: string;
     }>;
+    runtime: z.ZodOptional<z.ZodDiscriminatedUnion<"mode", [z.ZodObject<{
+        mode: z.ZodLiteral<"local">;
+    }, "strict", z.ZodTypeAny, {
+        mode: "local";
+    }, {
+        mode: "local";
+    }>, z.ZodObject<{
+        mode: z.ZodLiteral<"relay">;
+        relayUrl: z.ZodString;
+        relayProvider: z.ZodOptional<z.ZodString>;
+    }, "strict", z.ZodTypeAny, {
+        mode: "relay";
+        relayUrl: string;
+        relayProvider?: string | undefined;
+    }, {
+        mode: "relay";
+        relayUrl: string;
+        relayProvider?: string | undefined;
+    }>]>>;
     preferences: z.ZodOptional<z.ZodObject<{
         language: z.ZodOptional<z.ZodEnum<["en", "zh-CN"]>>;
         lastSetup: z.ZodOptional<z.ZodObject<{
-            platforms: z.ZodOptional<z.ZodArray<z.ZodEnum<["lark", "slack", "github", "telegram"]>, "many">>;
+            platforms: z.ZodOptional<z.ZodArray<z.ZodEnum<["lark", "slack", "github", "gitlab", "telegram"]>, "many">>;
             executor: z.ZodOptional<z.ZodString>;
             projectPath: z.ZodOptional<z.ZodString>;
             larkSetupMethod: z.ZodOptional<z.ZodEnum<["saved", "scan", "manual"]>>;
@@ -35,7 +93,7 @@ export declare const OpenTagCliConfigSchema: z.ZodObject<{
             githubPort: z.ZodOptional<z.ZodNumber>;
             githubAutoCreatePullRequest: z.ZodOptional<z.ZodBoolean>;
         }, "strict", z.ZodTypeAny, {
-            platforms?: ("lark" | "slack" | "github" | "telegram")[] | undefined;
+            platforms?: ("lark" | "slack" | "github" | "gitlab" | "telegram")[] | undefined;
             executor?: string | undefined;
             projectPath?: string | undefined;
             larkSetupMethod?: "saved" | "scan" | "manual" | undefined;
@@ -50,7 +108,7 @@ export declare const OpenTagCliConfigSchema: z.ZodObject<{
             githubPort?: number | undefined;
             githubAutoCreatePullRequest?: boolean | undefined;
         }, {
-            platforms?: ("lark" | "slack" | "github" | "telegram")[] | undefined;
+            platforms?: ("lark" | "slack" | "github" | "gitlab" | "telegram")[] | undefined;
             executor?: string | undefined;
             projectPath?: string | undefined;
             larkSetupMethod?: "saved" | "scan" | "manual" | undefined;
@@ -68,7 +126,7 @@ export declare const OpenTagCliConfigSchema: z.ZodObject<{
     }, "strict", z.ZodTypeAny, {
         language?: "en" | "zh-CN" | undefined;
         lastSetup?: {
-            platforms?: ("lark" | "slack" | "github" | "telegram")[] | undefined;
+            platforms?: ("lark" | "slack" | "github" | "gitlab" | "telegram")[] | undefined;
             executor?: string | undefined;
             projectPath?: string | undefined;
             larkSetupMethod?: "saved" | "scan" | "manual" | undefined;
@@ -86,7 +144,7 @@ export declare const OpenTagCliConfigSchema: z.ZodObject<{
     }, {
         language?: "en" | "zh-CN" | undefined;
         lastSetup?: {
-            platforms?: ("lark" | "slack" | "github" | "telegram")[] | undefined;
+            platforms?: ("lark" | "slack" | "github" | "gitlab" | "telegram")[] | undefined;
             executor?: string | undefined;
             projectPath?: string | undefined;
             larkSetupMethod?: "saved" | "scan" | "manual" | undefined;
@@ -177,6 +235,29 @@ export declare const OpenTagCliConfigSchema: z.ZodObject<{
             permissionMode?: "acceptEdits" | "auto" | "bypassPermissions" | "default" | "plan" | undefined;
             dangerouslySkipPermissions?: boolean | undefined;
         }>>;
+        hermes: z.ZodOptional<z.ZodObject<{
+            command: z.ZodOptional<z.ZodString>;
+            profile: z.ZodOptional<z.ZodString>;
+            profileTemplate: z.ZodOptional<z.ZodString>;
+        }, "strict", z.ZodTypeAny, {
+            command?: string | undefined;
+            profile?: string | undefined;
+            profileTemplate?: string | undefined;
+        }, {
+            command?: string | undefined;
+            profile?: string | undefined;
+            profileTemplate?: string | undefined;
+        }>>;
+        agentSessionProfile: z.ZodOptional<z.ZodObject<{
+            profile: z.ZodOptional<z.ZodString>;
+            profileTemplate: z.ZodOptional<z.ZodString>;
+        }, "strict", z.ZodTypeAny, {
+            profile?: string | undefined;
+            profileTemplate?: string | undefined;
+        }, {
+            profile?: string | undefined;
+            profileTemplate?: string | undefined;
+        }>>;
         security: z.ZodOptional<z.ZodObject<{
             mode: z.ZodOptional<z.ZodEnum<["enforce", "audit", "off"]>>;
             allowedWorkspaceRoot: z.ZodOptional<z.ZodString>;
@@ -193,12 +274,217 @@ export declare const OpenTagCliConfigSchema: z.ZodObject<{
             allowUnsafePrompts?: boolean | undefined;
             extraSafeEnv?: string[] | undefined;
         }>>;
-        githubToken: z.ZodOptional<z.ZodString>;
+        githubToken: z.ZodOptional<z.ZodEffects<z.ZodUnion<[z.ZodString, z.ZodDiscriminatedUnion<"kind", [z.ZodObject<{
+            kind: z.ZodLiteral<"env">;
+            name: z.ZodString;
+        }, "strict", z.ZodTypeAny, {
+            kind: "env";
+            name: string;
+        }, {
+            kind: "env";
+            name: string;
+        }>, z.ZodObject<{
+            kind: z.ZodLiteral<"file">;
+            path: z.ZodString;
+        }, "strict", z.ZodTypeAny, {
+            kind: "file";
+            path: string;
+        }, {
+            kind: "file";
+            path: string;
+        }>, z.ZodObject<{
+            kind: z.ZodLiteral<"keychain">;
+            service: z.ZodString;
+            account: z.ZodString;
+        }, "strict", z.ZodTypeAny, {
+            kind: "keychain";
+            service: string;
+            account: string;
+        }, {
+            kind: "keychain";
+            service: string;
+            account: string;
+        }>]>]>, string, string | {
+            kind: "env";
+            name: string;
+        } | {
+            kind: "file";
+            path: string;
+        } | {
+            kind: "keychain";
+            service: string;
+            account: string;
+        }>>;
+        githubApplyToken: z.ZodOptional<z.ZodNullable<z.ZodEffects<z.ZodUnion<[z.ZodString, z.ZodDiscriminatedUnion<"kind", [z.ZodObject<{
+            kind: z.ZodLiteral<"env">;
+            name: z.ZodString;
+        }, "strict", z.ZodTypeAny, {
+            kind: "env";
+            name: string;
+        }, {
+            kind: "env";
+            name: string;
+        }>, z.ZodObject<{
+            kind: z.ZodLiteral<"file">;
+            path: z.ZodString;
+        }, "strict", z.ZodTypeAny, {
+            kind: "file";
+            path: string;
+        }, {
+            kind: "file";
+            path: string;
+        }>, z.ZodObject<{
+            kind: z.ZodLiteral<"keychain">;
+            service: z.ZodString;
+            account: z.ZodString;
+        }, "strict", z.ZodTypeAny, {
+            kind: "keychain";
+            service: string;
+            account: string;
+        }, {
+            kind: "keychain";
+            service: string;
+            account: string;
+        }>]>]>, string, string | {
+            kind: "env";
+            name: string;
+        } | {
+            kind: "file";
+            path: string;
+        } | {
+            kind: "keychain";
+            service: string;
+            account: string;
+        }>>>;
         preparePullRequestBranch: z.ZodOptional<z.ZodBoolean>;
         allowAutoCreatePullRequest: z.ZodOptional<z.ZodBoolean>;
-        pairingToken: z.ZodString;
+        runnerToken: z.ZodOptional<z.ZodEffects<z.ZodUnion<[z.ZodString, z.ZodDiscriminatedUnion<"kind", [z.ZodObject<{
+            kind: z.ZodLiteral<"env">;
+            name: z.ZodString;
+        }, "strict", z.ZodTypeAny, {
+            kind: "env";
+            name: string;
+        }, {
+            kind: "env";
+            name: string;
+        }>, z.ZodObject<{
+            kind: z.ZodLiteral<"file">;
+            path: z.ZodString;
+        }, "strict", z.ZodTypeAny, {
+            kind: "file";
+            path: string;
+        }, {
+            kind: "file";
+            path: string;
+        }>, z.ZodObject<{
+            kind: z.ZodLiteral<"keychain">;
+            service: z.ZodString;
+            account: z.ZodString;
+        }, "strict", z.ZodTypeAny, {
+            kind: "keychain";
+            service: string;
+            account: string;
+        }, {
+            kind: "keychain";
+            service: string;
+            account: string;
+        }>]>]>, string, string | {
+            kind: "env";
+            name: string;
+        } | {
+            kind: "file";
+            path: string;
+        } | {
+            kind: "keychain";
+            service: string;
+            account: string;
+        }>>;
+        runnerTokens: z.ZodOptional<z.ZodArray<z.ZodEffects<z.ZodUnion<[z.ZodString, z.ZodDiscriminatedUnion<"kind", [z.ZodObject<{
+            kind: z.ZodLiteral<"env">;
+            name: z.ZodString;
+        }, "strict", z.ZodTypeAny, {
+            kind: "env";
+            name: string;
+        }, {
+            kind: "env";
+            name: string;
+        }>, z.ZodObject<{
+            kind: z.ZodLiteral<"file">;
+            path: z.ZodString;
+        }, "strict", z.ZodTypeAny, {
+            kind: "file";
+            path: string;
+        }, {
+            kind: "file";
+            path: string;
+        }>, z.ZodObject<{
+            kind: z.ZodLiteral<"keychain">;
+            service: z.ZodString;
+            account: z.ZodString;
+        }, "strict", z.ZodTypeAny, {
+            kind: "keychain";
+            service: string;
+            account: string;
+        }, {
+            kind: "keychain";
+            service: string;
+            account: string;
+        }>]>]>, string, string | {
+            kind: "env";
+            name: string;
+        } | {
+            kind: "file";
+            path: string;
+        } | {
+            kind: "keychain";
+            service: string;
+            account: string;
+        }>, "many">>;
+        revokedRunnerTokenFingerprints: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        pairingToken: z.ZodEffects<z.ZodUnion<[z.ZodString, z.ZodDiscriminatedUnion<"kind", [z.ZodObject<{
+            kind: z.ZodLiteral<"env">;
+            name: z.ZodString;
+        }, "strict", z.ZodTypeAny, {
+            kind: "env";
+            name: string;
+        }, {
+            kind: "env";
+            name: string;
+        }>, z.ZodObject<{
+            kind: z.ZodLiteral<"file">;
+            path: z.ZodString;
+        }, "strict", z.ZodTypeAny, {
+            kind: "file";
+            path: string;
+        }, {
+            kind: "file";
+            path: string;
+        }>, z.ZodObject<{
+            kind: z.ZodLiteral<"keychain">;
+            service: z.ZodString;
+            account: z.ZodString;
+        }, "strict", z.ZodTypeAny, {
+            kind: "keychain";
+            service: string;
+            account: string;
+        }, {
+            kind: "keychain";
+            service: string;
+            account: string;
+        }>]>]>, string, string | {
+            kind: "env";
+            name: string;
+        } | {
+            kind: "file";
+            path: string;
+        } | {
+            kind: "keychain";
+            service: string;
+            account: string;
+        }>;
         pollIntervalMs: z.ZodNumber;
         heartbeatIntervalMs: z.ZodNumber;
+        runTimeoutMs: z.ZodOptional<z.ZodNumber>;
     }, "strict", z.ZodTypeAny, {
         runnerId: string;
         dispatcherUrl: string;
@@ -231,6 +517,15 @@ export declare const OpenTagCliConfigSchema: z.ZodObject<{
             permissionMode?: "acceptEdits" | "auto" | "bypassPermissions" | "default" | "plan" | undefined;
             dangerouslySkipPermissions?: boolean | undefined;
         } | undefined;
+        hermes?: {
+            command?: string | undefined;
+            profile?: string | undefined;
+            profileTemplate?: string | undefined;
+        } | undefined;
+        agentSessionProfile?: {
+            profile?: string | undefined;
+            profileTemplate?: string | undefined;
+        } | undefined;
         security?: {
             mode?: "enforce" | "audit" | "off" | undefined;
             allowedWorkspaceRoot?: string | undefined;
@@ -238,8 +533,13 @@ export declare const OpenTagCliConfigSchema: z.ZodObject<{
             extraSafeEnv?: string[] | undefined;
         } | undefined;
         githubToken?: string | undefined;
+        githubApplyToken?: string | null | undefined;
         preparePullRequestBranch?: boolean | undefined;
         allowAutoCreatePullRequest?: boolean | undefined;
+        runnerToken?: string | undefined;
+        runnerTokens?: string[] | undefined;
+        revokedRunnerTokenFingerprints?: string[] | undefined;
+        runTimeoutMs?: number | undefined;
     }, {
         runnerId: string;
         dispatcherUrl: string;
@@ -254,7 +554,17 @@ export declare const OpenTagCliConfigSchema: z.ZodObject<{
             worktreeRoot: string;
             keepWorktree: "always" | "on_failure" | "never";
         }[];
-        pairingToken: string;
+        pairingToken: string | {
+            kind: "env";
+            name: string;
+        } | {
+            kind: "file";
+            path: string;
+        } | {
+            kind: "keychain";
+            service: string;
+            account: string;
+        };
         pollIntervalMs: number;
         heartbeatIntervalMs: number;
         channelBindings?: {
@@ -272,20 +582,114 @@ export declare const OpenTagCliConfigSchema: z.ZodObject<{
             permissionMode?: "acceptEdits" | "auto" | "bypassPermissions" | "default" | "plan" | undefined;
             dangerouslySkipPermissions?: boolean | undefined;
         } | undefined;
+        hermes?: {
+            command?: string | undefined;
+            profile?: string | undefined;
+            profileTemplate?: string | undefined;
+        } | undefined;
+        agentSessionProfile?: {
+            profile?: string | undefined;
+            profileTemplate?: string | undefined;
+        } | undefined;
         security?: {
             mode?: "enforce" | "audit" | "off" | undefined;
             allowedWorkspaceRoot?: string | undefined;
             allowUnsafePrompts?: boolean | undefined;
             extraSafeEnv?: string[] | undefined;
         } | undefined;
-        githubToken?: string | undefined;
+        githubToken?: string | {
+            kind: "env";
+            name: string;
+        } | {
+            kind: "file";
+            path: string;
+        } | {
+            kind: "keychain";
+            service: string;
+            account: string;
+        } | undefined;
+        githubApplyToken?: string | {
+            kind: "env";
+            name: string;
+        } | {
+            kind: "file";
+            path: string;
+        } | {
+            kind: "keychain";
+            service: string;
+            account: string;
+        } | null | undefined;
         preparePullRequestBranch?: boolean | undefined;
         allowAutoCreatePullRequest?: boolean | undefined;
+        runnerToken?: string | {
+            kind: "env";
+            name: string;
+        } | {
+            kind: "file";
+            path: string;
+        } | {
+            kind: "keychain";
+            service: string;
+            account: string;
+        } | undefined;
+        runnerTokens?: (string | {
+            kind: "env";
+            name: string;
+        } | {
+            kind: "file";
+            path: string;
+        } | {
+            kind: "keychain";
+            service: string;
+            account: string;
+        })[] | undefined;
+        revokedRunnerTokenFingerprints?: string[] | undefined;
+        runTimeoutMs?: number | undefined;
     }>;
     platforms: z.ZodObject<{
         lark: z.ZodOptional<z.ZodObject<{
             appId: z.ZodString;
-            appSecret: z.ZodString;
+            appSecret: z.ZodEffects<z.ZodUnion<[z.ZodString, z.ZodDiscriminatedUnion<"kind", [z.ZodObject<{
+                kind: z.ZodLiteral<"env">;
+                name: z.ZodString;
+            }, "strict", z.ZodTypeAny, {
+                kind: "env";
+                name: string;
+            }, {
+                kind: "env";
+                name: string;
+            }>, z.ZodObject<{
+                kind: z.ZodLiteral<"file">;
+                path: z.ZodString;
+            }, "strict", z.ZodTypeAny, {
+                kind: "file";
+                path: string;
+            }, {
+                kind: "file";
+                path: string;
+            }>, z.ZodObject<{
+                kind: z.ZodLiteral<"keychain">;
+                service: z.ZodString;
+                account: z.ZodString;
+            }, "strict", z.ZodTypeAny, {
+                kind: "keychain";
+                service: string;
+                account: string;
+            }, {
+                kind: "keychain";
+                service: string;
+                account: string;
+            }>]>]>, string, string | {
+                kind: "env";
+                name: string;
+            } | {
+                kind: "file";
+                path: string;
+            } | {
+                kind: "keychain";
+                service: string;
+                account: string;
+            }>;
             domain: z.ZodEnum<["lark", "feishu"]>;
             botOpenId: z.ZodOptional<z.ZodString>;
             defaultProjectBinding: z.ZodOptional<z.ZodBoolean>;
@@ -297,16 +701,146 @@ export declare const OpenTagCliConfigSchema: z.ZodObject<{
             defaultProjectBinding?: boolean | undefined;
         }, {
             appId: string;
-            appSecret: string;
+            appSecret: string | {
+                kind: "env";
+                name: string;
+            } | {
+                kind: "file";
+                path: string;
+            } | {
+                kind: "keychain";
+                service: string;
+                account: string;
+            };
             domain: "lark" | "feishu";
             botOpenId?: string | undefined;
             defaultProjectBinding?: boolean | undefined;
         }>>;
         slack: z.ZodOptional<z.ZodEffects<z.ZodObject<{
             mode: z.ZodOptional<z.ZodEnum<["socket_mode", "events_api"]>>;
-            appToken: z.ZodOptional<z.ZodString>;
-            signingSecret: z.ZodOptional<z.ZodString>;
-            botToken: z.ZodString;
+            appToken: z.ZodOptional<z.ZodEffects<z.ZodUnion<[z.ZodString, z.ZodDiscriminatedUnion<"kind", [z.ZodObject<{
+                kind: z.ZodLiteral<"env">;
+                name: z.ZodString;
+            }, "strict", z.ZodTypeAny, {
+                kind: "env";
+                name: string;
+            }, {
+                kind: "env";
+                name: string;
+            }>, z.ZodObject<{
+                kind: z.ZodLiteral<"file">;
+                path: z.ZodString;
+            }, "strict", z.ZodTypeAny, {
+                kind: "file";
+                path: string;
+            }, {
+                kind: "file";
+                path: string;
+            }>, z.ZodObject<{
+                kind: z.ZodLiteral<"keychain">;
+                service: z.ZodString;
+                account: z.ZodString;
+            }, "strict", z.ZodTypeAny, {
+                kind: "keychain";
+                service: string;
+                account: string;
+            }, {
+                kind: "keychain";
+                service: string;
+                account: string;
+            }>]>]>, string, string | {
+                kind: "env";
+                name: string;
+            } | {
+                kind: "file";
+                path: string;
+            } | {
+                kind: "keychain";
+                service: string;
+                account: string;
+            }>>;
+            signingSecret: z.ZodOptional<z.ZodEffects<z.ZodUnion<[z.ZodString, z.ZodDiscriminatedUnion<"kind", [z.ZodObject<{
+                kind: z.ZodLiteral<"env">;
+                name: z.ZodString;
+            }, "strict", z.ZodTypeAny, {
+                kind: "env";
+                name: string;
+            }, {
+                kind: "env";
+                name: string;
+            }>, z.ZodObject<{
+                kind: z.ZodLiteral<"file">;
+                path: z.ZodString;
+            }, "strict", z.ZodTypeAny, {
+                kind: "file";
+                path: string;
+            }, {
+                kind: "file";
+                path: string;
+            }>, z.ZodObject<{
+                kind: z.ZodLiteral<"keychain">;
+                service: z.ZodString;
+                account: z.ZodString;
+            }, "strict", z.ZodTypeAny, {
+                kind: "keychain";
+                service: string;
+                account: string;
+            }, {
+                kind: "keychain";
+                service: string;
+                account: string;
+            }>]>]>, string, string | {
+                kind: "env";
+                name: string;
+            } | {
+                kind: "file";
+                path: string;
+            } | {
+                kind: "keychain";
+                service: string;
+                account: string;
+            }>>;
+            botToken: z.ZodEffects<z.ZodUnion<[z.ZodString, z.ZodDiscriminatedUnion<"kind", [z.ZodObject<{
+                kind: z.ZodLiteral<"env">;
+                name: z.ZodString;
+            }, "strict", z.ZodTypeAny, {
+                kind: "env";
+                name: string;
+            }, {
+                kind: "env";
+                name: string;
+            }>, z.ZodObject<{
+                kind: z.ZodLiteral<"file">;
+                path: z.ZodString;
+            }, "strict", z.ZodTypeAny, {
+                kind: "file";
+                path: string;
+            }, {
+                kind: "file";
+                path: string;
+            }>, z.ZodObject<{
+                kind: z.ZodLiteral<"keychain">;
+                service: z.ZodString;
+                account: z.ZodString;
+            }, "strict", z.ZodTypeAny, {
+                kind: "keychain";
+                service: string;
+                account: string;
+            }, {
+                kind: "keychain";
+                service: string;
+                account: string;
+            }>]>]>, string, string | {
+                kind: "env";
+                name: string;
+            } | {
+                kind: "file";
+                path: string;
+            } | {
+                kind: "keychain";
+                service: string;
+                account: string;
+            }>;
             teamId: z.ZodString;
             channelId: z.ZodString;
             appId: z.ZodOptional<z.ZodString>;
@@ -323,14 +857,44 @@ export declare const OpenTagCliConfigSchema: z.ZodObject<{
             signingSecret?: string | undefined;
             port?: number | undefined;
         }, {
-            botToken: string;
+            botToken: string | {
+                kind: "env";
+                name: string;
+            } | {
+                kind: "file";
+                path: string;
+            } | {
+                kind: "keychain";
+                service: string;
+                account: string;
+            };
             teamId: string;
             channelId: string;
             mode?: "socket_mode" | "events_api" | undefined;
             appId?: string | undefined;
             defaultProjectBinding?: boolean | undefined;
-            appToken?: string | undefined;
-            signingSecret?: string | undefined;
+            appToken?: string | {
+                kind: "env";
+                name: string;
+            } | {
+                kind: "file";
+                path: string;
+            } | {
+                kind: "keychain";
+                service: string;
+                account: string;
+            } | undefined;
+            signingSecret?: string | {
+                kind: "env";
+                name: string;
+            } | {
+                kind: "file";
+                path: string;
+            } | {
+                kind: "keychain";
+                service: string;
+                account: string;
+            } | undefined;
             port?: number | undefined;
         }>, {
             botToken: string;
@@ -343,18 +907,88 @@ export declare const OpenTagCliConfigSchema: z.ZodObject<{
             signingSecret?: string | undefined;
             port?: number | undefined;
         }, {
-            botToken: string;
+            botToken: string | {
+                kind: "env";
+                name: string;
+            } | {
+                kind: "file";
+                path: string;
+            } | {
+                kind: "keychain";
+                service: string;
+                account: string;
+            };
             teamId: string;
             channelId: string;
             mode?: "socket_mode" | "events_api" | undefined;
             appId?: string | undefined;
             defaultProjectBinding?: boolean | undefined;
-            appToken?: string | undefined;
-            signingSecret?: string | undefined;
+            appToken?: string | {
+                kind: "env";
+                name: string;
+            } | {
+                kind: "file";
+                path: string;
+            } | {
+                kind: "keychain";
+                service: string;
+                account: string;
+            } | undefined;
+            signingSecret?: string | {
+                kind: "env";
+                name: string;
+            } | {
+                kind: "file";
+                path: string;
+            } | {
+                kind: "keychain";
+                service: string;
+                account: string;
+            } | undefined;
             port?: number | undefined;
         }>>;
         github: z.ZodOptional<z.ZodObject<{
-            webhookSecret: z.ZodString;
+            webhookSecret: z.ZodEffects<z.ZodUnion<[z.ZodString, z.ZodDiscriminatedUnion<"kind", [z.ZodObject<{
+                kind: z.ZodLiteral<"env">;
+                name: z.ZodString;
+            }, "strict", z.ZodTypeAny, {
+                kind: "env";
+                name: string;
+            }, {
+                kind: "env";
+                name: string;
+            }>, z.ZodObject<{
+                kind: z.ZodLiteral<"file">;
+                path: z.ZodString;
+            }, "strict", z.ZodTypeAny, {
+                kind: "file";
+                path: string;
+            }, {
+                kind: "file";
+                path: string;
+            }>, z.ZodObject<{
+                kind: z.ZodLiteral<"keychain">;
+                service: z.ZodString;
+                account: z.ZodString;
+            }, "strict", z.ZodTypeAny, {
+                kind: "keychain";
+                service: string;
+                account: string;
+            }, {
+                kind: "keychain";
+                service: string;
+                account: string;
+            }>]>]>, string, string | {
+                kind: "env";
+                name: string;
+            } | {
+                kind: "file";
+                path: string;
+            } | {
+                kind: "keychain";
+                service: string;
+                account: string;
+            }>;
             owner: z.ZodString;
             repo: z.ZodString;
             webhookPath: z.ZodOptional<z.ZodString>;
@@ -368,7 +1002,17 @@ export declare const OpenTagCliConfigSchema: z.ZodObject<{
         }, {
             owner: string;
             repo: string;
-            webhookSecret: string;
+            webhookSecret: string | {
+                kind: "env";
+                name: string;
+            } | {
+                kind: "file";
+                path: string;
+            } | {
+                kind: "keychain";
+                service: string;
+                account: string;
+            };
             port?: number | undefined;
             webhookPath?: string | undefined;
         }>>;
@@ -401,26 +1045,76 @@ export declare const OpenTagCliConfigSchema: z.ZodObject<{
     }, {
         lark?: {
             appId: string;
-            appSecret: string;
+            appSecret: string | {
+                kind: "env";
+                name: string;
+            } | {
+                kind: "file";
+                path: string;
+            } | {
+                kind: "keychain";
+                service: string;
+                account: string;
+            };
             domain: "lark" | "feishu";
             botOpenId?: string | undefined;
             defaultProjectBinding?: boolean | undefined;
         } | undefined;
         slack?: {
-            botToken: string;
+            botToken: string | {
+                kind: "env";
+                name: string;
+            } | {
+                kind: "file";
+                path: string;
+            } | {
+                kind: "keychain";
+                service: string;
+                account: string;
+            };
             teamId: string;
             channelId: string;
             mode?: "socket_mode" | "events_api" | undefined;
             appId?: string | undefined;
             defaultProjectBinding?: boolean | undefined;
-            appToken?: string | undefined;
-            signingSecret?: string | undefined;
+            appToken?: string | {
+                kind: "env";
+                name: string;
+            } | {
+                kind: "file";
+                path: string;
+            } | {
+                kind: "keychain";
+                service: string;
+                account: string;
+            } | undefined;
+            signingSecret?: string | {
+                kind: "env";
+                name: string;
+            } | {
+                kind: "file";
+                path: string;
+            } | {
+                kind: "keychain";
+                service: string;
+                account: string;
+            } | undefined;
             port?: number | undefined;
         } | undefined;
         github?: {
             owner: string;
             repo: string;
-            webhookSecret: string;
+            webhookSecret: string | {
+                kind: "env";
+                name: string;
+            } | {
+                kind: "file";
+                path: string;
+            } | {
+                kind: "keychain";
+                service: string;
+                account: string;
+            };
             port?: number | undefined;
             webhookPath?: string | undefined;
         } | undefined;
@@ -491,6 +1185,15 @@ export declare const OpenTagCliConfigSchema: z.ZodObject<{
             permissionMode?: "acceptEdits" | "auto" | "bypassPermissions" | "default" | "plan" | undefined;
             dangerouslySkipPermissions?: boolean | undefined;
         } | undefined;
+        hermes?: {
+            command?: string | undefined;
+            profile?: string | undefined;
+            profileTemplate?: string | undefined;
+        } | undefined;
+        agentSessionProfile?: {
+            profile?: string | undefined;
+            profileTemplate?: string | undefined;
+        } | undefined;
         security?: {
             mode?: "enforce" | "audit" | "off" | undefined;
             allowedWorkspaceRoot?: string | undefined;
@@ -498,13 +1201,25 @@ export declare const OpenTagCliConfigSchema: z.ZodObject<{
             extraSafeEnv?: string[] | undefined;
         } | undefined;
         githubToken?: string | undefined;
+        githubApplyToken?: string | null | undefined;
         preparePullRequestBranch?: boolean | undefined;
         allowAutoCreatePullRequest?: boolean | undefined;
+        runnerToken?: string | undefined;
+        runnerTokens?: string[] | undefined;
+        revokedRunnerTokenFingerprints?: string[] | undefined;
+        runTimeoutMs?: number | undefined;
     };
+    runtime?: {
+        mode: "local";
+    } | {
+        mode: "relay";
+        relayUrl: string;
+        relayProvider?: string | undefined;
+    } | undefined;
     preferences?: {
         language?: "en" | "zh-CN" | undefined;
         lastSetup?: {
-            platforms?: ("lark" | "slack" | "github" | "telegram")[] | undefined;
+            platforms?: ("lark" | "slack" | "github" | "gitlab" | "telegram")[] | undefined;
             executor?: string | undefined;
             projectPath?: string | undefined;
             larkSetupMethod?: "saved" | "scan" | "manual" | undefined;
@@ -524,26 +1239,76 @@ export declare const OpenTagCliConfigSchema: z.ZodObject<{
     platforms: {
         lark?: {
             appId: string;
-            appSecret: string;
+            appSecret: string | {
+                kind: "env";
+                name: string;
+            } | {
+                kind: "file";
+                path: string;
+            } | {
+                kind: "keychain";
+                service: string;
+                account: string;
+            };
             domain: "lark" | "feishu";
             botOpenId?: string | undefined;
             defaultProjectBinding?: boolean | undefined;
         } | undefined;
         slack?: {
-            botToken: string;
+            botToken: string | {
+                kind: "env";
+                name: string;
+            } | {
+                kind: "file";
+                path: string;
+            } | {
+                kind: "keychain";
+                service: string;
+                account: string;
+            };
             teamId: string;
             channelId: string;
             mode?: "socket_mode" | "events_api" | undefined;
             appId?: string | undefined;
             defaultProjectBinding?: boolean | undefined;
-            appToken?: string | undefined;
-            signingSecret?: string | undefined;
+            appToken?: string | {
+                kind: "env";
+                name: string;
+            } | {
+                kind: "file";
+                path: string;
+            } | {
+                kind: "keychain";
+                service: string;
+                account: string;
+            } | undefined;
+            signingSecret?: string | {
+                kind: "env";
+                name: string;
+            } | {
+                kind: "file";
+                path: string;
+            } | {
+                kind: "keychain";
+                service: string;
+                account: string;
+            } | undefined;
             port?: number | undefined;
         } | undefined;
         github?: {
             owner: string;
             repo: string;
-            webhookSecret: string;
+            webhookSecret: string | {
+                kind: "env";
+                name: string;
+            } | {
+                kind: "file";
+                path: string;
+            } | {
+                kind: "keychain";
+                service: string;
+                account: string;
+            };
             port?: number | undefined;
             webhookPath?: string | undefined;
         } | undefined;
@@ -568,7 +1333,17 @@ export declare const OpenTagCliConfigSchema: z.ZodObject<{
             worktreeRoot: string;
             keepWorktree: "always" | "on_failure" | "never";
         }[];
-        pairingToken: string;
+        pairingToken: string | {
+            kind: "env";
+            name: string;
+        } | {
+            kind: "file";
+            path: string;
+        } | {
+            kind: "keychain";
+            service: string;
+            account: string;
+        };
         pollIntervalMs: number;
         heartbeatIntervalMs: number;
         channelBindings?: {
@@ -586,20 +1361,81 @@ export declare const OpenTagCliConfigSchema: z.ZodObject<{
             permissionMode?: "acceptEdits" | "auto" | "bypassPermissions" | "default" | "plan" | undefined;
             dangerouslySkipPermissions?: boolean | undefined;
         } | undefined;
+        hermes?: {
+            command?: string | undefined;
+            profile?: string | undefined;
+            profileTemplate?: string | undefined;
+        } | undefined;
+        agentSessionProfile?: {
+            profile?: string | undefined;
+            profileTemplate?: string | undefined;
+        } | undefined;
         security?: {
             mode?: "enforce" | "audit" | "off" | undefined;
             allowedWorkspaceRoot?: string | undefined;
             allowUnsafePrompts?: boolean | undefined;
             extraSafeEnv?: string[] | undefined;
         } | undefined;
-        githubToken?: string | undefined;
+        githubToken?: string | {
+            kind: "env";
+            name: string;
+        } | {
+            kind: "file";
+            path: string;
+        } | {
+            kind: "keychain";
+            service: string;
+            account: string;
+        } | undefined;
+        githubApplyToken?: string | {
+            kind: "env";
+            name: string;
+        } | {
+            kind: "file";
+            path: string;
+        } | {
+            kind: "keychain";
+            service: string;
+            account: string;
+        } | null | undefined;
         preparePullRequestBranch?: boolean | undefined;
         allowAutoCreatePullRequest?: boolean | undefined;
+        runnerToken?: string | {
+            kind: "env";
+            name: string;
+        } | {
+            kind: "file";
+            path: string;
+        } | {
+            kind: "keychain";
+            service: string;
+            account: string;
+        } | undefined;
+        runnerTokens?: (string | {
+            kind: "env";
+            name: string;
+        } | {
+            kind: "file";
+            path: string;
+        } | {
+            kind: "keychain";
+            service: string;
+            account: string;
+        })[] | undefined;
+        revokedRunnerTokenFingerprints?: string[] | undefined;
+        runTimeoutMs?: number | undefined;
     };
+    runtime?: {
+        mode: "local";
+    } | {
+        mode: "relay";
+        relayUrl: string;
+        relayProvider?: string | undefined;
+    } | undefined;
     preferences?: {
         language?: "en" | "zh-CN" | undefined;
         lastSetup?: {
-            platforms?: ("lark" | "slack" | "github" | "telegram")[] | undefined;
+            platforms?: ("lark" | "slack" | "github" | "gitlab" | "telegram")[] | undefined;
             executor?: string | undefined;
             projectPath?: string | undefined;
             larkSetupMethod?: "saved" | "scan" | "manual" | undefined;
@@ -624,14 +1460,21 @@ export type OpenTagCliLastSetup = NonNullable<OpenTagCliPreferences["lastSetup"]
 export type OpenTagCliLanguage = CliLanguage;
 export type OpenTagCliPlatform = PlatformId;
 export type OpenTagCliExecutor = string;
+export type OpenTagRuntimeMode = NonNullable<OpenTagCliConfig["runtime"]>["mode"];
 export type PathEnvironment = Partial<Record<"OPENTAG_CONFIG_PATH" | "OPENTAG_CONFIG_HOME" | "OPENTAG_STATE_DIR" | "XDG_CONFIG_HOME" | "XDG_STATE_HOME", string>>;
 export declare function defaultConfigPath(env?: PathEnvironment, home?: string): string;
 export declare function defaultStateDirectory(env?: PathEnvironment, home?: string): string;
 export declare function formatCliConfigError(error: unknown): string;
 export declare function parseCliConfig(value: unknown): OpenTagCliConfig;
+export declare function runnerDispatcherToken(config: Pick<OpenTagDaemonConfig, "runnerToken" | "pairingToken">): string | undefined;
+export declare function runtimeModeFromConfig(config: OpenTagCliConfig): OpenTagRuntimeMode;
+export declare function relayUrlFromConfig(config: OpenTagCliConfig): string | undefined;
 export declare function readCliConfig(path?: string): OpenTagCliConfig;
 export declare function ensurePrivateDirectory(path: string): void;
 export declare function writeCliConfigAtomic(path: string, config: OpenTagCliConfig): void;
 export declare function assertPrivateConfigFile(path: string): void;
 export declare function redactedCliConfig(config: OpenTagCliConfig): unknown;
+export declare function redactedCliConfigValue(value: unknown): unknown;
+export declare function readRedactedCliConfig(path?: string): unknown;
+export {};
 //# sourceMappingURL=config.d.ts.map