@orion-agents/orion-code 0.2.0 → 0.3.0

package/dist/services/file-lock.js

@@ -37,6 +37,20 @@ function processIsAlive(pid) {
         return error.code === 'EPERM';
     }
 }
+function shouldAttemptStaleRecovery(lockPath, staleMs) {
+    let observed;
+    try {
+        observed = (0, fs_1.statSync)(lockPath);
+    }
+    catch {
+        return false;
+    }
+    const owner = readOwner(lockPath);
+    if (!owner)
+        return false;
+    const lastActivity = Math.max(observed.mtimeMs, owner.createdAt);
+    return Date.now() - lastActivity > staleMs && !processIsAlive(owner.pid);
+}
 function recoverStaleLock(lockPath, staleMs, options = {}) {
     let firstStat;
     try {
@@ -169,10 +183,11 @@ function acquirePrimitiveLock(lockPath, options) {
     }
 }
 function withRecoverySentinel(lockPath, options, operation) {
-    // Every main-lock acquire, stale recovery, and release passes through this
-    // short-lived sentinel, so a checked stale main lock cannot be replaced
-    // before it is renamed. The primitive sentinel still treats a live owner as
-    // authoritative and fails closed on contention.
+    // Stale recovery passes through this short-lived sentinel, so two recovery
+    // contenders cannot both move the same observed main lock. Healthy owners
+    // publish and release by token without taking this secondary lock: making a
+    // release queue behind ordinary waiters can starve the owner and turn normal
+    // high-contention writes into deterministic timeouts.
     const sentinelPath = `${lockPath}${RECOVERY_SUFFIX}`;
     const sentinel = acquirePrimitiveLock(sentinelPath, options);
     try {
@@ -185,14 +200,27 @@ function withRecoverySentinel(lockPath, options, operation) {
 function acquireLock(lockPath, options) {
     const deadline = Date.now() + options.waitMs;
     while (true) {
+        // Atomic no-replace publication is safe without the recovery sentinel.
+        // Contenders for a healthy live lock must not repeatedly seize the
+        // sentinel, otherwise they can starve the actual owner when it needs the
+        // sentinel to release the main lock. An already-published sentinel still
+        // owns the transition and must be honored, including malformed legacy
+        // sentinels that intentionally fail closed during their grace period.
+        const sentinelExists = (0, fs_1.existsSync)(`${lockPath}${RECOVERY_SUFFIX}`);
+        if (!sentinelExists) {
+            const published = createLock(lockPath);
+            if (published)
+                return published;
+        }
         const remainingMs = Math.max(0, deadline - Date.now());
         let owner = null;
-        withRecoverySentinel(lockPath, { ...options, waitMs: remainingMs }, () => {
-            owner = createLock(lockPath);
-            if (!owner && recoverStaleLock(lockPath, options.staleMs)) {
+        if (sentinelExists || shouldAttemptStaleRecovery(lockPath, options.staleMs)) {
+            withRecoverySentinel(lockPath, { ...options, waitMs: remainingMs }, () => {
                 owner = createLock(lockPath);
-            }
-        });
+                if (!owner && recoverStaleLock(lockPath, options.staleMs))
+                    owner = createLock(lockPath);
+            });
+        }
         if (owner)
             return owner;
         if (Date.now() >= deadline)
@@ -213,14 +241,11 @@ function withFileLockSync(targetPath, operation, options = {}) {
         return operation();
     }
     finally {
-        try {
-            withRecoverySentinel(lockPath, resolvedOptions, () => {
-                releaseOwnedLock(lockPath, owner, 'file-lock.release');
-            });
-        }
-        catch (error) {
-            (0, debug_log_1.debugError)('file-lock.release', error, lockPath);
-        }
+        // The owner token makes release conditional on the exact published lock.
+        // A live owner is never eligible for stale recovery, and stale recovery
+        // serializes its own check/rename path, so release must not contend for the
+        // recovery sentinel with processes that are merely waiting for this lock.
+        releaseOwnedLock(lockPath, owner, 'file-lock.release');
     }
 }
 //# sourceMappingURL=file-lock.js.map

package/dist/services/file-lock.js.map

@@ -1 +1 @@
-{"version":3,"file":"file-lock.js","sourceRoot":"","sources":["../../src/services/file-lock.ts"],"names":[],"mappings":";;AA+OA,4CAuBC;AAtQD,mCAAoC;AACpC,2BAUY;AACZ,kDAAgD;AAEhD,MAAM,eAAe,GAAG,IAAK,CAAC;AAC9B,MAAM,gBAAgB,GAAG,EAAE,CAAC;AAC5B,MAAM,gBAAgB,GAAG,KAAM,CAAC;AAChC,MAAM,eAAe,GAAG,WAAW,CAAC;AAkBpC,SAAS,SAAS,CAAC,EAAU;IAC3B,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC,IAAI,iBAAiB,CAAC,CAAC,CAAC,CAAC,CAAC;IACxD,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;AACjC,CAAC;AAED,SAAS,SAAS,CAAC,QAAgB;IACjC,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAA,iBAAY,EAAC,QAAQ,EAAE,MAAM,CAAC,CAAuB,CAAC;QAC/E,IACE,OAAO,KAAK,CAAC,KAAK,KAAK,QAAQ;YAC/B,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,GAAG,CAAC;YAChC,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ,EACnC,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,KAAkB,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CAAC,GAAW;IACjC,IAAI,GAAG,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IAC3B,IAAI,CAAC;QACH,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QACrB,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAQ,KAA+B,CAAC,IAAI,KAAK,OAAO,CAAC;IAC3D,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB,CACvB,QAAgB,EAChB,OAAe,EACf,UAAgC,EAAE;IAElC,IAAI,SAAS,CAAC;IACd,IAAI,CAAC;QACH,SAAS,GAAG,IAAA,aAAQ,EAAC,QAAQ,CAAC,CAAC;IACjC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,UAAU,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;IACvC,IAAI,UAAU,EAAE,CAAC;QACf,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,OAAO,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC;QACvE,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,YAAY,IAAI,OAAO,IAAI,cAAc,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YAC3E,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;SAAM,CAAC;QACN,sEAAsE;QACtE,sEAAsE;QACtE,qEAAqE;QACrE,0EAA0E;QAC1E,wEAAwE;QACxE,IAAI,CAAC,OAAO,CAAC,oBAAoB,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC,OAAO,IAAI,OAAO,EAAE,CAAC;YAC/E,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED,IAAI,WAAW,CAAC;IAChB,IAAI,CAAC;QACH,WAAW,GAAG,IAAA,aAAQ,EAAC,QAAQ,CAAC,CAAC;IACnC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,YAAY,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;IACzC,IACE,WAAW,CAAC,GAAG,KAAK,SAAS,CAAC,GAAG;QACjC,WAAW,CAAC,GAAG,KAAK,SAAS,CAAC,GAAG;QACjC,WAAW,CAAC,OAAO,KAAK,SAAS,CAAC,OAAO;QACzC,WAAW,CAAC,OAAO,KAAK,SAAS,CAAC,OAAO;QACzC,WAAW,CAAC,IAAI,KAAK,SAAS,CAAC,IAAI;QACnC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,YAAY,IAAI,YAAY,CAAC,KAAK,KAAK,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,YAAY,KAAK,IAAI,CAAC,EAC/F,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,SAAS,GAAG,UAAU;QAC1B,CAAC,CAAC,GAAG,QAAQ,UAAU,IAAA,mBAAU,GAAE,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE;QACjD,CAAC,CAAC,GAAG,QAAQ,eAAe,IAAI,CAAC,GAAG,EAAE,IAAI,IAAA,mBAAU,GAAE,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;IACvE,IAAI,CAAC;QACH,IAAA,eAAU,EAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;IAClC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAQ,KAA+B,CAAC,IAAI,KAAK,QAAQ,CAAC;IAC5D,CAAC;IACD,4EAA4E;IAC5E,mEAAmE;IACnE,IAAI,UAAU,EAAE,CAAC;QACf,IAAI,CAAC;YACH,IAAA,eAAU,EAAC,SAAS,CAAC,CAAC;QACxB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAA,sBAAU,EAAC,wBAAwB,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC;QACzD,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,UAAU,CAAC,QAAgB;IAClC,MAAM,KAAK,GAAc,EAAE,KAAK,EAAE,IAAA,mBAAU,GAAE,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;IAC1F,MAAM,aAAa,GAAG,GAAG,QAAQ,cAAc,KAAK,CAAC,KAAK,EAAE,CAAC;IAC7D,IAAI,gBAAgB,GAAG,KAAK,CAAC;IAC7B,IAAI,CAAC;QACH,2EAA2E;QAC3E,wEAAwE;QACxE,iEAAiE;QACjE,MAAM,EAAE,GAAG,IAAA,aAAQ,EAAC,aAAa,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;QAChD,gBAAgB,GAAG,IAAI,CAAC;QACxB,IAAI,CAAC;YACH,IAAA,kBAAa,EAAC,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC;QAC3C,CAAC;gBAAS,CAAC;YACT,IAAA,cAAS,EAAC,EAAE,CAAC,CAAC;QAChB,CAAC;QAED,IAAI,CAAC;YACH,IAAA,aAAQ,EAAC,aAAa,EAAE,QAAQ,CAAC,CAAC;QACpC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;gBAAE,OAAO,IAAI,CAAC;YACpE,MAAM,KAAK,CAAC;QACd,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;YAAS,CAAC;QACT,IAAI,gBAAgB,EAAE,CAAC;YACrB,IAAI,CAAC;gBACH,IAAA,eAAU,EAAC,aAAa,CAAC,CAAC;YAC5B,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;oBACvD,IAAA,sBAAU,EAAC,4BAA4B,EAAE,KAAK,EAAE,aAAa,CAAC,CAAC;gBACjE,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB,CAAC,QAAgB,EAAE,KAAgB,EAAE,KAAa;IACzE,IAAI,CAAC;QACH,IAAI,IAAA,eAAU,EAAC,QAAQ,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,EAAE,KAAK,KAAK,KAAK,CAAC,KAAK,EAAE,CAAC;YACvE,IAAA,eAAU,EAAC,QAAQ,CAAC,CAAC;QACvB,CAAC;aAAM,CAAC;YACN,IAAA,sBAAU,EAAC,GAAG,KAAK,WAAW,EAAE,IAAI,KAAK,CAAC,wBAAwB,CAAC,EAAE,QAAQ,CAAC,CAAC;QACjF,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAA,sBAAU,EAAC,KAAK,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC;IACrC,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,SAAS,oBAAoB,CAC3B,QAAgB,EAChB,OAA6D;IAE7D,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC;IAC7C,OAAO,IAAI,EAAE,CAAC;QACZ,MAAM,KAAK,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;QACnC,IAAI,KAAK;YAAE,OAAO,KAAK,CAAC;QAExB,IAAI,gBAAgB,CAAC,QAAQ,EAAE,OAAO,CAAC,OAAO,EAAE,EAAE,oBAAoB,EAAE,IAAI,EAAE,CAAC;YAAE,SAAS;QAC1F,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,QAAQ,EAAE,CAAC,CAAC;QAC3F,SAAS,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAC7B,CAAC;AACH,CAAC;AAED,SAAS,oBAAoB,CAC3B,QAAgB,EAChB,OAA6D,EAC7D,SAAkB;IAElB,2EAA2E;IAC3E,wEAAwE;IACxE,4EAA4E;IAC5E,gDAAgD;IAChD,MAAM,YAAY,GAAG,GAAG,QAAQ,GAAG,eAAe,EAAE,CAAC;IACrD,MAAM,QAAQ,GAAG,oBAAoB,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;IAC7D,IAAI,CAAC;QACH,OAAO,SAAS,EAAE,CAAC;IACrB,CAAC;YAAS,CAAC;QACT,gBAAgB,CAAC,YAAY,EAAE,QAAQ,EAAE,2BAA2B,CAAC,CAAC;IACxE,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAClB,QAAgB,EAChB,OAA6D;IAE7D,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC;IAC7C,OAAO,IAAI,EAAE,CAAC;QACZ,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QACvD,IAAI,KAAK,GAAqB,IAAI,CAAC;QAEnC,oBAAoB,CAAC,QAAQ,EAAE,EAAE,GAAG,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,EAAE,GAAG,EAAE;YACvE,KAAK,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;YAC7B,IAAI,CAAC,KAAK,IAAI,gBAAgB,CAAC,QAAQ,EAAE,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC1D,KAAK,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;YAC/B,CAAC;QACH,CAAC,CAAC,CAAC;QACH,IAAI,KAAK;YAAE,OAAO,KAAK,CAAC;QACxB,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,QAAQ,EAAE,CAAC,CAAC;QAC3F,SAAS,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAC7B,CAAC;AACH,CAAC;AAED,kFAAkF;AAClF,SAAgB,gBAAgB,CAC9B,UAAkB,EAClB,SAAkB,EAClB,UAAmE,EAAE;IAErE,MAAM,QAAQ,GAAG,GAAG,UAAU,OAAO,CAAC;IACtC,MAAM,eAAe,GAAG;QACtB,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,eAAe;QACzC,OAAO,EAAE,OAAO,CAAC,OAAO,IAAI,gBAAgB;QAC5C,OAAO,EAAE,OAAO,CAAC,OAAO,IAAI,gBAAgB;KAC7C,CAAC;IACF,MAAM,KAAK,GAAG,WAAW,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAC;IACrD,IAAI,CAAC;QACH,OAAO,SAAS,EAAE,CAAC;IACrB,CAAC;YAAS,CAAC;QACT,IAAI,CAAC;YACH,oBAAoB,CAAC,QAAQ,EAAE,eAAe,EAAE,GAAG,EAAE;gBACnD,gBAAgB,CAAC,QAAQ,EAAE,KAAK,EAAE,mBAAmB,CAAC,CAAC;YACzD,CAAC,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAA,sBAAU,EAAC,mBAAmB,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC;QACnD,CAAC;IACH,CAAC;AACH,CAAC"}
+{"version":3,"file":"file-lock.js","sourceRoot":"","sources":["../../src/services/file-lock.ts"],"names":[],"mappings":";;AAwQA,4CAqBC;AA7RD,mCAAoC;AACpC,2BAUY;AACZ,kDAAgD;AAEhD,MAAM,eAAe,GAAG,IAAK,CAAC;AAC9B,MAAM,gBAAgB,GAAG,EAAE,CAAC;AAC5B,MAAM,gBAAgB,GAAG,KAAM,CAAC;AAChC,MAAM,eAAe,GAAG,WAAW,CAAC;AAkBpC,SAAS,SAAS,CAAC,EAAU;IAC3B,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC,IAAI,iBAAiB,CAAC,CAAC,CAAC,CAAC,CAAC;IACxD,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;AACjC,CAAC;AAED,SAAS,SAAS,CAAC,QAAgB;IACjC,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAA,iBAAY,EAAC,QAAQ,EAAE,MAAM,CAAC,CAAuB,CAAC;QAC/E,IACE,OAAO,KAAK,CAAC,KAAK,KAAK,QAAQ;YAC/B,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,GAAG,CAAC;YAChC,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ,EACnC,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,KAAkB,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CAAC,GAAW;IACjC,IAAI,GAAG,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IAC3B,IAAI,CAAC;QACH,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QACrB,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAQ,KAA+B,CAAC,IAAI,KAAK,OAAO,CAAC;IAC3D,CAAC;AACH,CAAC;AAED,SAAS,0BAA0B,CAAC,QAAgB,EAAE,OAAe;IACnE,IAAI,QAAQ,CAAC;IACb,IAAI,CAAC;QACH,QAAQ,GAAG,IAAA,aAAQ,EAAC,QAAQ,CAAC,CAAC;IAChC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,KAAK,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;IAClC,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC;IACzB,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,OAAO,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;IACjE,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,YAAY,GAAG,OAAO,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;AAC3E,CAAC;AAED,SAAS,gBAAgB,CACvB,QAAgB,EAChB,OAAe,EACf,UAAgC,EAAE;IAElC,IAAI,SAAS,CAAC;IACd,IAAI,CAAC;QACH,SAAS,GAAG,IAAA,aAAQ,EAAC,QAAQ,CAAC,CAAC;IACjC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,UAAU,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;IACvC,IAAI,UAAU,EAAE,CAAC;QACf,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,OAAO,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC;QACvE,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,YAAY,IAAI,OAAO,IAAI,cAAc,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YAC3E,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;SAAM,CAAC;QACN,sEAAsE;QACtE,sEAAsE;QACtE,qEAAqE;QACrE,0EAA0E;QAC1E,wEAAwE;QACxE,IAAI,CAAC,OAAO,CAAC,oBAAoB,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC,OAAO,IAAI,OAAO,EAAE,CAAC;YAC/E,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED,IAAI,WAAW,CAAC;IAChB,IAAI,CAAC;QACH,WAAW,GAAG,IAAA,aAAQ,EAAC,QAAQ,CAAC,CAAC;IACnC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,YAAY,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;IACzC,IACE,WAAW,CAAC,GAAG,KAAK,SAAS,CAAC,GAAG;QACjC,WAAW,CAAC,GAAG,KAAK,SAAS,CAAC,GAAG;QACjC,WAAW,CAAC,OAAO,KAAK,SAAS,CAAC,OAAO;QACzC,WAAW,CAAC,OAAO,KAAK,SAAS,CAAC,OAAO;QACzC,WAAW,CAAC,IAAI,KAAK,SAAS,CAAC,IAAI;QACnC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,YAAY,IAAI,YAAY,CAAC,KAAK,KAAK,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,YAAY,KAAK,IAAI,CAAC,EAC/F,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,SAAS,GAAG,UAAU;QAC1B,CAAC,CAAC,GAAG,QAAQ,UAAU,IAAA,mBAAU,GAAE,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE;QACjD,CAAC,CAAC,GAAG,QAAQ,eAAe,IAAI,CAAC,GAAG,EAAE,IAAI,IAAA,mBAAU,GAAE,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;IACvE,IAAI,CAAC;QACH,IAAA,eAAU,EAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;IAClC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAQ,KAA+B,CAAC,IAAI,KAAK,QAAQ,CAAC;IAC5D,CAAC;IACD,4EAA4E;IAC5E,mEAAmE;IACnE,IAAI,UAAU,EAAE,CAAC;QACf,IAAI,CAAC;YACH,IAAA,eAAU,EAAC,SAAS,CAAC,CAAC;QACxB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAA,sBAAU,EAAC,wBAAwB,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC;QACzD,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,UAAU,CAAC,QAAgB;IAClC,MAAM,KAAK,GAAc,EAAE,KAAK,EAAE,IAAA,mBAAU,GAAE,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;IAC1F,MAAM,aAAa,GAAG,GAAG,QAAQ,cAAc,KAAK,CAAC,KAAK,EAAE,CAAC;IAC7D,IAAI,gBAAgB,GAAG,KAAK,CAAC;IAC7B,IAAI,CAAC;QACH,2EAA2E;QAC3E,wEAAwE;QACxE,iEAAiE;QACjE,MAAM,EAAE,GAAG,IAAA,aAAQ,EAAC,aAAa,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;QAChD,gBAAgB,GAAG,IAAI,CAAC;QACxB,IAAI,CAAC;YACH,IAAA,kBAAa,EAAC,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC;QAC3C,CAAC;gBAAS,CAAC;YACT,IAAA,cAAS,EAAC,EAAE,CAAC,CAAC;QAChB,CAAC;QAED,IAAI,CAAC;YACH,IAAA,aAAQ,EAAC,aAAa,EAAE,QAAQ,CAAC,CAAC;QACpC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;gBAAE,OAAO,IAAI,CAAC;YACpE,MAAM,KAAK,CAAC;QACd,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;YAAS,CAAC;QACT,IAAI,gBAAgB,EAAE,CAAC;YACrB,IAAI,CAAC;gBACH,IAAA,eAAU,EAAC,aAAa,CAAC,CAAC;YAC5B,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;oBACvD,IAAA,sBAAU,EAAC,4BAA4B,EAAE,KAAK,EAAE,aAAa,CAAC,CAAC;gBACjE,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB,CAAC,QAAgB,EAAE,KAAgB,EAAE,KAAa;IACzE,IAAI,CAAC;QACH,IAAI,IAAA,eAAU,EAAC,QAAQ,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,EAAE,KAAK,KAAK,KAAK,CAAC,KAAK,EAAE,CAAC;YACvE,IAAA,eAAU,EAAC,QAAQ,CAAC,CAAC;QACvB,CAAC;aAAM,CAAC;YACN,IAAA,sBAAU,EAAC,GAAG,KAAK,WAAW,EAAE,IAAI,KAAK,CAAC,wBAAwB,CAAC,EAAE,QAAQ,CAAC,CAAC;QACjF,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAA,sBAAU,EAAC,KAAK,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC;IACrC,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,SAAS,oBAAoB,CAC3B,QAAgB,EAChB,OAA6D;IAE7D,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC;IAC7C,OAAO,IAAI,EAAE,CAAC;QACZ,MAAM,KAAK,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;QACnC,IAAI,KAAK;YAAE,OAAO,KAAK,CAAC;QAExB,IAAI,gBAAgB,CAAC,QAAQ,EAAE,OAAO,CAAC,OAAO,EAAE,EAAE,oBAAoB,EAAE,IAAI,EAAE,CAAC;YAAE,SAAS;QAC1F,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,QAAQ,EAAE,CAAC,CAAC;QAC3F,SAAS,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAC7B,CAAC;AACH,CAAC;AAED,SAAS,oBAAoB,CAC3B,QAAgB,EAChB,OAA6D,EAC7D,SAAkB;IAElB,2EAA2E;IAC3E,0EAA0E;IAC1E,4EAA4E;IAC5E,6EAA6E;IAC7E,sDAAsD;IACtD,MAAM,YAAY,GAAG,GAAG,QAAQ,GAAG,eAAe,EAAE,CAAC;IACrD,MAAM,QAAQ,GAAG,oBAAoB,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;IAC7D,IAAI,CAAC;QACH,OAAO,SAAS,EAAE,CAAC;IACrB,CAAC;YAAS,CAAC;QACT,gBAAgB,CAAC,YAAY,EAAE,QAAQ,EAAE,2BAA2B,CAAC,CAAC;IACxE,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAClB,QAAgB,EAChB,OAA6D;IAE7D,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC;IAC7C,OAAO,IAAI,EAAE,CAAC;QACZ,uEAAuE;QACvE,mEAAmE;QACnE,yEAAyE;QACzE,yEAAyE;QACzE,sEAAsE;QACtE,sEAAsE;QACtE,MAAM,cAAc,GAAG,IAAA,eAAU,EAAC,GAAG,QAAQ,GAAG,eAAe,EAAE,CAAC,CAAC;QACnE,IAAI,CAAC,cAAc,EAAE,CAAC;YACpB,MAAM,SAAS,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;YACvC,IAAI,SAAS;gBAAE,OAAO,SAAS,CAAC;QAClC,CAAC;QAED,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QACvD,IAAI,KAAK,GAAqB,IAAI,CAAC;QACnC,IAAI,cAAc,IAAI,0BAA0B,CAAC,QAAQ,EAAE,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;YAC5E,oBAAoB,CAAC,QAAQ,EAAE,EAAE,GAAG,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,EAAE,GAAG,EAAE;gBACvE,KAAK,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;gBAC7B,IAAI,CAAC,KAAK,IAAI,gBAAgB,CAAC,QAAQ,EAAE,OAAO,CAAC,OAAO,CAAC;oBAAE,KAAK,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;YAC1F,CAAC,CAAC,CAAC;QACL,CAAC;QACD,IAAI,KAAK;YAAE,OAAO,KAAK,CAAC;QACxB,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,QAAQ,EAAE,CAAC,CAAC;QAC3F,SAAS,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAC7B,CAAC;AACH,CAAC;AAED,kFAAkF;AAClF,SAAgB,gBAAgB,CAC9B,UAAkB,EAClB,SAAkB,EAClB,UAAmE,EAAE;IAErE,MAAM,QAAQ,GAAG,GAAG,UAAU,OAAO,CAAC;IACtC,MAAM,eAAe,GAAG;QACtB,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,eAAe;QACzC,OAAO,EAAE,OAAO,CAAC,OAAO,IAAI,gBAAgB;QAC5C,OAAO,EAAE,OAAO,CAAC,OAAO,IAAI,gBAAgB;KAC7C,CAAC;IACF,MAAM,KAAK,GAAG,WAAW,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAC;IACrD,IAAI,CAAC;QACH,OAAO,SAAS,EAAE,CAAC;IACrB,CAAC;YAAS,CAAC;QACT,yEAAyE;QACzE,wEAAwE;QACxE,4EAA4E;QAC5E,0EAA0E;QAC1E,gBAAgB,CAAC,QAAQ,EAAE,KAAK,EAAE,mBAAmB,CAAC,CAAC;IACzD,CAAC;AACH,CAAC"}

package/dist/services/global-config.d.ts

@@ -32,6 +32,15 @@ export interface ProjectConfig {
 }
 /** How to handle tool permission checks that request interactive confirmation. */
 export type ToolConfirmationPolicy = 'ask' | 'allow' | 'deny';
+/** Browser appearance preferences persisted in the canonical global document. */
+export interface WebAppearanceConfigV1 {
+    theme?: 'system' | 'light' | 'dark';
+    motion?: 'system' | 'reduced';
+}
+/** Web-only preferences. Runtime/session state deliberately does not live here. */
+export interface WebConfigV1 {
+    appearance?: WebAppearanceConfigV1;
+}
 /**
  * OS-level isolation requested for shell command execution.
  * `none` is the default and reproduces pre-sandbox behaviour exactly.
@@ -176,6 +185,8 @@ export interface GlobalConfig {
     webSearch?: WebSearchMcpConfig;
     /** Terminal UI configuration. */
     ui?: UIConfig;
+    /** Browser UI configuration. */
+    web?: WebConfigV1;
     /** Additional user-managed skills roots. */
     skills?: SkillsConfig;
     /** Agent-loop guardrails. */
@@ -190,6 +201,20 @@ export interface GlobalConfig {
     firstStartTime?: string;
     projects?: Record<string, ProjectConfig>;
 }
+/** A parsed canonical config document, including forward-compatible unknown fields. */
+export type GlobalConfigDocument = Record<string, unknown>;
+/** Raised only by the strict Settings path; the legacy startup loader remains tolerant. */
+export declare class GlobalConfigDocumentValidationError extends Error {
+    readonly field: string;
+    constructor(field: string);
+}
+/**
+ * Validate the complete known schema without normalizing or dropping unknown
+ * fields. Settings mutations must call this before writing their raw clone.
+ */
+export declare function validateGlobalConfigDocumentStrict(value: unknown): asserts value is GlobalConfigDocument;
+/** Parse exact file bytes through the strict Settings validator. */
+export declare function parseGlobalConfigDocumentStrict(content: string | Buffer): GlobalConfigDocument;
 interface LegacyUsageFields {
     totalSessions?: unknown;
     totalTokens?: unknown;

package/dist/services/global-config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"global-config.d.ts","sourceRoot":"","sources":["../../src/services/global-config.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAQH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACzD,OAAO,EAAsB,KAAK,gBAAgB,EAAE,MAAM,UAAU,CAAC;AAMrE,YAAY;AACZ,MAAM,WAAW,aAAa;IAC5B,cAAc;IACd,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB;;;;OAIG;IACH,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B;;;OAGG;IACH,OAAO,CAAC,EAAE,aAAa,CAAC;IACxB,cAAc;IACd,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,cAAc;IACd,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,iBAAiB;IACjB,sBAAsB,CAAC,EAAE,OAAO,CAAC;IACjC,wCAAwC;IACxC,aAAa,CAAC,EAAE,gBAAgB,CAAC;CAClC;AAED,kFAAkF;AAClF,MAAM,MAAM,sBAAsB,GAAG,KAAK,GAAG,OAAO,GAAG,MAAM,CAAC;AAE9D;;;GAGG;AACH,MAAM,MAAM,cAAc,GAAG,MAAM,GAAG,WAAW,GAAG,iBAAiB,CAAC;AAEtE,mEAAmE;AACnE,MAAM,MAAM,cAAc,GAAG,UAAU,GAAG,YAAY,GAAG,QAAQ,CAAC;AAElE;;;;GAIG;AACH,MAAM,WAAW,aAAa;IAC5B,6EAA6E;IAC7E,OAAO,CAAC,EAAE,cAAc,CAAC;IACzB,yEAAyE;IACzE,OAAO,CAAC,EAAE,cAAc,GAAG,MAAM,CAAC;IAClC,8EAA8E;IAC9E,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,+EAA+E;IAC/E,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB,6EAA6E;IAC7E,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,0GAA0G;AAC1G,MAAM,MAAM,UAAU,GAAG,UAAU,GAAG,KAAK,CAAC;AAE5C,mDAAmD;AACnD,MAAM,MAAM,kBAAkB,GAAG,QAAQ,GAAG,aAAa,CAAC;AAE1D,4EAA4E;AAC5E,MAAM,MAAM,kBAAkB,GAAG,aAAa,GAAG,SAAS,GAAG,eAAe,GAAG,MAAM,CAAC;AACtF,MAAM,MAAM,mBAAmB,GAAG,MAAM,GAAG,SAAS,GAAG,KAAK,CAAC;AAC7D,MAAM,MAAM,aAAa,GACrB,MAAM,GACN,MAAM,GACN,OAAO,GACP,QAAQ,GACR,SAAS,GACT,YAAY,GACZ,OAAO,GACP,UAAU,CAAC;AAEf,kFAAkF;AAClF,MAAM,MAAM,eAAe,GACvB,QAAQ,GACR,OAAO,GACP,WAAW,GACX,gBAAgB,GAChB,iBAAiB,GACjB,YAAY,GACZ,QAAQ,GACR,MAAM,CAAC;AAEX,yDAAyD;AACzD,MAAM,WAAW,QAAQ;IACvB,qEAAqE;IACrE,QAAQ,CAAC,EAAE,UAAU,CAAC;IACtB,8EAA8E;IAC9E,aAAa,CAAC,EAAE,kBAAkB,CAAC;IACnC,8EAA8E;IAC9E,KAAK,CAAC,EAAE,kBAAkB,CAAC;IAC3B,qDAAqD;IACrD,MAAM,CAAC,EAAE,mBAAmB,CAAC;IAC7B,sDAAsD;IACtD,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,4CAA4C;IAC5C,UAAU,CAAC,EAAE,aAAa,EAAE,CAAC;IAC7B,gFAAgF;IAChF,MAAM,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,eAAe,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;CACrD;AAED,+DAA+D;AAC/D,MAAM,WAAW,kBAAkB;IACjC,8EAA8E;IAC9E,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,oCAAoC;IACpC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,6CAA6C;IAC7C,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,uEAAuE;IACvE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,uCAAuC;IACvC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,6DAA6D;IAC7D,QAAQ,CAAC,EAAE,QAAQ,GAAG,QAAQ,GAAG,OAAO,GAAG,MAAM,CAAC;IAClD,gFAAgF;IAChF,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,iDAAiD;IACjD,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,+CAA+C;IAC/C,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAClC;AAED,iDAAiD;AACjD,MAAM,WAAW,YAAY;IAC3B,wDAAwD;IACxD,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;CAClB;AAED,wFAAwF;AACxF,MAAM,WAAW,qBAAqB;IACpC,sDAAsD;IACtD,yBAAyB,CAAC,EAAE,MAAM,CAAC;IACnC,oDAAoD;IACpD,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC,kFAAkF;IAClF,wBAAwB,CAAC,EAAE,MAAM,CAAC;IAClC,iFAAiF;IACjF,wBAAwB,CAAC,EAAE,MAAM,CAAC;CACnC;AAED,MAAM,WAAW,eAAe;IAC9B,wFAAwF;IACxF,MAAM,CAAC,EAAE,qBAAqB,CAAC;CAChC;AAED,oFAAoF;AACpF,MAAM,MAAM,YAAY,GAAG,KAAK,GAAG,UAAU,GAAG,MAAM,CAAC;AAEvD,yDAAyD;AACzD,MAAM,MAAM,YAAY,GAAG,UAAU,GAAG,QAAQ,GAAG,kBAAkB,CAAC;AAEtE;;;;GAIG;AACH,MAAM,WAAW,kBAAkB;IACjC,IAAI,CAAC,EAAE,YAAY,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,YAAY,EAAE,CAAC;CACxB;AAED,2EAA2E;AAC3E,MAAM,WAAW,UAAU;IACzB,wEAAwE;IACxE,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;IAC5C,mFAAmF;IACnF,cAAc,CAAC,EAAE,YAAY,CAAC;CAC/B;AAED;;;GAGG;AACH,MAAM,WAAW,YAAY;IAC3B,sEAAsE;IACtE,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,kBAAkB;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,mBAAmB;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW;IACX,YAAY,EAAE,MAAM,CAAC;IACrB,uBAAuB;IACvB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,4EAA4E;IAC5E,gBAAgB,CAAC,EAAE,sBAAsB,CAAC;IAC1C,mEAAmE;IACnE,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,uCAAuC;IACvC,aAAa,CAAC,EAAE,gBAAgB,CAAC;IACjC,mCAAmC;IACnC,SAAS,CAAC,EAAE,kBAAkB,CAAC;IAC/B,iCAAiC;IACjC,EAAE,CAAC,EAAE,QAAQ,CAAC;IACd,4CAA4C;IAC5C,MAAM,CAAC,EAAE,YAAY,CAAC;IACtB,6BAA6B;IAC7B,SAAS,CAAC,EAAE,eAAe,CAAC;IAC5B,+DAA+D;IAC/D,SAAS,CAAC,EAAE,kBAAkB,CAAC;IAC/B,6DAA6D;IAC7D,IAAI,CAAC,EAAE,UAAU,CAAC;IAClB,+EAA+E;IAC/E,OAAO,CAAC,EAAE,aAAa,CAAC;IAGxB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,cAAc,CAAC,EAAE,MAAM,CAAC;IAGxB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;CAC1C;AAuGD,UAAU,iBAAiB;IACzB,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB;AAsGD;;;GAGG;AACH,wBAAgB,gBAAgB,IAAI,YAAY,CAe/C;AAED;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,YAAY,GAAG,iBAAiB,GAAG,IAAI,CAI/E;AAWD;;GAEG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,OAAO,CAAC,YAAY,CAAC,GAAG,YAAY,CAa/E;AAMD,wBAAgB,gBAAgB,CAAC,WAAW,EAAE,MAAM,GAAG,aAAa,CAGnE;AAED,wBAAgB,iBAAiB,CAAC,WAAW,EAAE,MAAM,EAAE,aAAa,EAAE,aAAa,GAAG,IAAI,CAezF;AAMD,wBAAgB,iBAAiB,IAAI,MAAM,CAc1C;AAED,wBAAgB,oBAAoB,IAAI,IAAI,CAa3C;AAED,OAAO,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAQxE,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;CACnB;AAMD,wBAAgB,eAAe,IAAI,iBAAiB,EAAE,CAGrD;AAoBD,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAiBvD;AAED,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,iBAAiB,EAAE,CAIrE"}
+{"version":3,"file":"global-config.d.ts","sourceRoot":"","sources":["../../src/services/global-config.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAQH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACzD,OAAO,EAAsB,KAAK,gBAAgB,EAAE,MAAM,UAAU,CAAC;AAOrE,YAAY;AACZ,MAAM,WAAW,aAAa;IAC5B,cAAc;IACd,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB;;;;OAIG;IACH,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B;;;OAGG;IACH,OAAO,CAAC,EAAE,aAAa,CAAC;IACxB,cAAc;IACd,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,cAAc;IACd,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,iBAAiB;IACjB,sBAAsB,CAAC,EAAE,OAAO,CAAC;IACjC,wCAAwC;IACxC,aAAa,CAAC,EAAE,gBAAgB,CAAC;CAClC;AAED,kFAAkF;AAClF,MAAM,MAAM,sBAAsB,GAAG,KAAK,GAAG,OAAO,GAAG,MAAM,CAAC;AAE9D,iFAAiF;AACjF,MAAM,WAAW,qBAAqB;IACpC,KAAK,CAAC,EAAE,QAAQ,GAAG,OAAO,GAAG,MAAM,CAAC;IACpC,MAAM,CAAC,EAAE,QAAQ,GAAG,SAAS,CAAC;CAC/B;AAED,mFAAmF;AACnF,MAAM,WAAW,WAAW;IAC1B,UAAU,CAAC,EAAE,qBAAqB,CAAC;CACpC;AAED;;;GAGG;AACH,MAAM,MAAM,cAAc,GAAG,MAAM,GAAG,WAAW,GAAG,iBAAiB,CAAC;AAEtE,mEAAmE;AACnE,MAAM,MAAM,cAAc,GAAG,UAAU,GAAG,YAAY,GAAG,QAAQ,CAAC;AAElE;;;;GAIG;AACH,MAAM,WAAW,aAAa;IAC5B,6EAA6E;IAC7E,OAAO,CAAC,EAAE,cAAc,CAAC;IACzB,yEAAyE;IACzE,OAAO,CAAC,EAAE,cAAc,GAAG,MAAM,CAAC;IAClC,8EAA8E;IAC9E,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,+EAA+E;IAC/E,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB,6EAA6E;IAC7E,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,0GAA0G;AAC1G,MAAM,MAAM,UAAU,GAAG,UAAU,GAAG,KAAK,CAAC;AAE5C,mDAAmD;AACnD,MAAM,MAAM,kBAAkB,GAAG,QAAQ,GAAG,aAAa,CAAC;AAE1D,4EAA4E;AAC5E,MAAM,MAAM,kBAAkB,GAAG,aAAa,GAAG,SAAS,GAAG,eAAe,GAAG,MAAM,CAAC;AACtF,MAAM,MAAM,mBAAmB,GAAG,MAAM,GAAG,SAAS,GAAG,KAAK,CAAC;AAC7D,MAAM,MAAM,aAAa,GACrB,MAAM,GACN,MAAM,GACN,OAAO,GACP,QAAQ,GACR,SAAS,GACT,YAAY,GACZ,OAAO,GACP,UAAU,CAAC;AAEf,kFAAkF;AAClF,MAAM,MAAM,eAAe,GACvB,QAAQ,GACR,OAAO,GACP,WAAW,GACX,gBAAgB,GAChB,iBAAiB,GACjB,YAAY,GACZ,QAAQ,GACR,MAAM,CAAC;AAEX,yDAAyD;AACzD,MAAM,WAAW,QAAQ;IACvB,qEAAqE;IACrE,QAAQ,CAAC,EAAE,UAAU,CAAC;IACtB,8EAA8E;IAC9E,aAAa,CAAC,EAAE,kBAAkB,CAAC;IACnC,8EAA8E;IAC9E,KAAK,CAAC,EAAE,kBAAkB,CAAC;IAC3B,qDAAqD;IACrD,MAAM,CAAC,EAAE,mBAAmB,CAAC;IAC7B,sDAAsD;IACtD,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,4CAA4C;IAC5C,UAAU,CAAC,EAAE,aAAa,EAAE,CAAC;IAC7B,gFAAgF;IAChF,MAAM,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,eAAe,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;CACrD;AAED,+DAA+D;AAC/D,MAAM,WAAW,kBAAkB;IACjC,8EAA8E;IAC9E,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,oCAAoC;IACpC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,6CAA6C;IAC7C,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,uEAAuE;IACvE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,uCAAuC;IACvC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,6DAA6D;IAC7D,QAAQ,CAAC,EAAE,QAAQ,GAAG,QAAQ,GAAG,OAAO,GAAG,MAAM,CAAC;IAClD,gFAAgF;IAChF,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,iDAAiD;IACjD,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,+CAA+C;IAC/C,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAClC;AAED,iDAAiD;AACjD,MAAM,WAAW,YAAY;IAC3B,wDAAwD;IACxD,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;CAClB;AAED,wFAAwF;AACxF,MAAM,WAAW,qBAAqB;IACpC,sDAAsD;IACtD,yBAAyB,CAAC,EAAE,MAAM,CAAC;IACnC,oDAAoD;IACpD,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC,kFAAkF;IAClF,wBAAwB,CAAC,EAAE,MAAM,CAAC;IAClC,iFAAiF;IACjF,wBAAwB,CAAC,EAAE,MAAM,CAAC;CACnC;AAED,MAAM,WAAW,eAAe;IAC9B,wFAAwF;IACxF,MAAM,CAAC,EAAE,qBAAqB,CAAC;CAChC;AAED,oFAAoF;AACpF,MAAM,MAAM,YAAY,GAAG,KAAK,GAAG,UAAU,GAAG,MAAM,CAAC;AAEvD,yDAAyD;AACzD,MAAM,MAAM,YAAY,GAAG,UAAU,GAAG,QAAQ,GAAG,kBAAkB,CAAC;AAEtE;;;;GAIG;AACH,MAAM,WAAW,kBAAkB;IACjC,IAAI,CAAC,EAAE,YAAY,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,YAAY,EAAE,CAAC;CACxB;AAED,2EAA2E;AAC3E,MAAM,WAAW,UAAU;IACzB,wEAAwE;IACxE,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;IAC5C,mFAAmF;IACnF,cAAc,CAAC,EAAE,YAAY,CAAC;CAC/B;AAED;;;GAGG;AACH,MAAM,WAAW,YAAY;IAC3B,sEAAsE;IACtE,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,kBAAkB;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,mBAAmB;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW;IACX,YAAY,EAAE,MAAM,CAAC;IACrB,uBAAuB;IACvB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,4EAA4E;IAC5E,gBAAgB,CAAC,EAAE,sBAAsB,CAAC;IAC1C,mEAAmE;IACnE,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,uCAAuC;IACvC,aAAa,CAAC,EAAE,gBAAgB,CAAC;IACjC,mCAAmC;IACnC,SAAS,CAAC,EAAE,kBAAkB,CAAC;IAC/B,iCAAiC;IACjC,EAAE,CAAC,EAAE,QAAQ,CAAC;IACd,gCAAgC;IAChC,GAAG,CAAC,EAAE,WAAW,CAAC;IAClB,4CAA4C;IAC5C,MAAM,CAAC,EAAE,YAAY,CAAC;IACtB,6BAA6B;IAC7B,SAAS,CAAC,EAAE,eAAe,CAAC;IAC5B,+DAA+D;IAC/D,SAAS,CAAC,EAAE,kBAAkB,CAAC;IAC/B,6DAA6D;IAC7D,IAAI,CAAC,EAAE,UAAU,CAAC;IAClB,+EAA+E;IAC/E,OAAO,CAAC,EAAE,aAAa,CAAC;IAGxB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,cAAc,CAAC,EAAE,MAAM,CAAC;IAGxB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;CAC1C;AAcD,uFAAuF;AACvF,MAAM,MAAM,oBAAoB,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAE3D,2FAA2F;AAC3F,qBAAa,mCAAoC,SAAQ,KAAK;IAChD,QAAQ,CAAC,KAAK,EAAE,MAAM;gBAAb,KAAK,EAAE,MAAM;CAInC;AA0GD;;;GAGG;AACH,wBAAgB,kCAAkC,CAChD,KAAK,EAAE,OAAO,GACb,OAAO,CAAC,KAAK,IAAI,oBAAoB,CA6NvC;AAED,oEAAoE;AACpE,wBAAgB,+BAA+B,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,oBAAoB,CAS9F;AAoHD,UAAU,iBAAiB;IACzB,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB;AA0GD;;;GAGG;AACH,wBAAgB,gBAAgB,IAAI,YAAY,CAe/C;AAED;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,YAAY,GAAG,iBAAiB,GAAG,IAAI,CAI/E;AAWD;;GAEG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,OAAO,CAAC,YAAY,CAAC,GAAG,YAAY,CAa/E;AAMD,wBAAgB,gBAAgB,CAAC,WAAW,EAAE,MAAM,GAAG,aAAa,CAGnE;AAED,wBAAgB,iBAAiB,CAAC,WAAW,EAAE,MAAM,EAAE,aAAa,EAAE,aAAa,GAAG,IAAI,CAezF;AAMD,wBAAgB,iBAAiB,IAAI,MAAM,CAc1C;AAED,wBAAgB,oBAAoB,IAAI,IAAI,CA8B3C;AAED,OAAO,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAQxE,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;CACnB;AAMD,wBAAgB,eAAe,IAAI,iBAAiB,EAAE,CAGrD;AAoBD,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAiBvD;AAED,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,iBAAiB,EAAE,CAIrE"}

package/dist/services/global-config.js

@@ -6,7 +6,9 @@
  * Environment variable overrides use ORION_CODE_ prefix.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.updateTokenStats = exports.incrementSessionCount = void 0;
+exports.updateTokenStats = exports.incrementSessionCount = exports.GlobalConfigDocumentValidationError = void 0;
+exports.validateGlobalConfigDocumentStrict = validateGlobalConfigDocumentStrict;
+exports.parseGlobalConfigDocumentStrict = parseGlobalConfigDocumentStrict;
 exports.loadGlobalConfig = loadGlobalConfig;
 exports.saveGlobalConfig = saveGlobalConfig;
 exports.updateGlobalConfig = updateGlobalConfig;
@@ -24,6 +26,7 @@ const config_dir_1 = require("./config-dir");
 const atomic_write_1 = require("./atomic-write");
 const file_lock_1 = require("./file-lock");
 const effort_1 = require("./effort");
+const model_registry_1 = require("./model-registry");
 // ============================================================================
 // 默认配置
 // ============================================================================
@@ -33,6 +36,323 @@ const DEFAULT_CONFIG = {
     toolConfirmation: 'allow',
 };
 const CONFIG_SCHEMA_VERSION = 1;
+/** Raised only by the strict Settings path; the legacy startup loader remains tolerant. */
+class GlobalConfigDocumentValidationError extends Error {
+    constructor(field) {
+        super(`Invalid Orion configuration field: ${field}`);
+        this.field = field;
+        this.name = 'GlobalConfigDocumentValidationError';
+    }
+}
+exports.GlobalConfigDocumentValidationError = GlobalConfigDocumentValidationError;
+function isRecord(value) {
+    return value !== null && typeof value === 'object' && !Array.isArray(value);
+}
+function invalidField(field) {
+    throw new GlobalConfigDocumentValidationError(field);
+}
+function validateOptionalString(record, key, field, allowEmpty = true) {
+    const value = record[key];
+    if (value === undefined)
+        return;
+    if (typeof value !== 'string' || (!allowEmpty && value.trim().length === 0))
+        invalidField(field);
+}
+function validateOptionalStringArray(record, key, field) {
+    const value = record[key];
+    if (value === undefined)
+        return;
+    if (!Array.isArray(value) || !value.every(item => typeof item === 'string'))
+        invalidField(field);
+}
+function validateOptionalBoolean(record, key, field) {
+    const value = record[key];
+    if (value !== undefined && typeof value !== 'boolean')
+        invalidField(field);
+}
+function validateOptionalPositiveInteger(record, key, field) {
+    const value = record[key];
+    if (value !== undefined && (!Number.isSafeInteger(value) || Number(value) <= 0)) {
+        invalidField(field);
+    }
+}
+function validateSandboxDocument(value, field) {
+    if (value === undefined)
+        return;
+    if (!isRecord(value))
+        invalidField(field);
+    if (value.profile !== undefined &&
+        value.profile !== 'none' &&
+        value.profile !== 'read-only' &&
+        value.profile !== 'workspace-write') {
+        invalidField(`${field}.profile`);
+    }
+    if (value.backend !== undefined &&
+        value.backend !== 'auto' &&
+        value.backend !== 'seatbelt' &&
+        value.backend !== 'bubblewrap' &&
+        value.backend !== 'docker') {
+        invalidField(`${field}.backend`);
+    }
+    validateOptionalBoolean(value, 'allowNetwork', `${field}.allowNetwork`);
+    validateOptionalStringArray(value, 'writableRoots', `${field}.writableRoots`);
+    validateOptionalString(value, 'image', `${field}.image`);
+}
+function validateProjectDocument(value) {
+    if (!isRecord(value))
+        invalidField('projects.*');
+    validateOptionalStringArray(value, 'allowedTools', 'projects.*.allowedTools');
+    validateOptionalString(value, 'compactInstructions', 'projects.*.compactInstructions');
+    validateSandboxDocument(value.sandbox, 'projects.*.sandbox');
+    validateOptionalString(value, 'lastSessionId', 'projects.*.lastSessionId');
+    validateOptionalString(value, 'lastModel', 'projects.*.lastModel');
+    validateOptionalBoolean(value, 'hasTrustDialogAccepted', 'projects.*.hasTrustDialogAccepted');
+    if (value.defaultEffort !== undefined && !(0, effort_1.isEffortPreference)(value.defaultEffort)) {
+        invalidField('projects.*.defaultEffort');
+    }
+}
+function validatePricing(value, field) {
+    if (!isRecord(value))
+        invalidField(field);
+    for (const key of ['input', 'output']) {
+        if (typeof value[key] !== 'number' || !Number.isFinite(value[key]) || value[key] < 0) {
+            invalidField(`${field}.${key}`);
+        }
+    }
+    if (value.cachedInput !== undefined &&
+        (typeof value.cachedInput !== 'number' ||
+            !Number.isFinite(value.cachedInput) ||
+            value.cachedInput < 0)) {
+        invalidField(`${field}.cachedInput`);
+    }
+}
+/**
+ * Validate the complete known schema without normalizing or dropping unknown
+ * fields. Settings mutations must call this before writing their raw clone.
+ */
+function validateGlobalConfigDocumentStrict(value) {
+    if (!isRecord(value))
+        invalidField('$');
+    if (value.schemaVersion !== undefined && value.schemaVersion !== CONFIG_SCHEMA_VERSION) {
+        invalidField('schemaVersion');
+    }
+    validateOptionalString(value, 'apiKey', 'apiKey');
+    validateOptionalString(value, 'apiBaseUrl', 'apiBaseUrl');
+    validateOptionalString(value, 'defaultModel', 'defaultModel', false);
+    validateOptionalString(value, 'fallbackModel', 'fallbackModel', false);
+    validateOptionalString(value, 'userId', 'userId', false);
+    validateOptionalString(value, 'firstStartTime', 'firstStartTime', false);
+    validateOptionalStringArray(value, 'allowedTools', 'allowedTools');
+    if (value.toolConfirmation !== undefined &&
+        value.toolConfirmation !== 'ask' &&
+        value.toolConfirmation !== 'allow' &&
+        value.toolConfirmation !== 'deny') {
+        invalidField('toolConfirmation');
+    }
+    if (value.defaultEffort !== undefined && !(0, effort_1.isEffortPreference)(value.defaultEffort)) {
+        invalidField('defaultEffort');
+    }
+    validateSandboxDocument(value.sandbox, 'sandbox');
+    if (value.projects !== undefined) {
+        if (!isRecord(value.projects))
+            invalidField('projects');
+        for (const project of Object.values(value.projects))
+            validateProjectDocument(project);
+    }
+    if (value.web !== undefined) {
+        if (!isRecord(value.web))
+            invalidField('web');
+        if (value.web.appearance !== undefined) {
+            if (!isRecord(value.web.appearance))
+                invalidField('web.appearance');
+            const { theme, motion } = value.web.appearance;
+            if (theme !== undefined && theme !== 'system' && theme !== 'light' && theme !== 'dark') {
+                invalidField('web.appearance.theme');
+            }
+            if (motion !== undefined && motion !== 'system' && motion !== 'reduced') {
+                invalidField('web.appearance.motion');
+            }
+        }
+    }
+    if (value.ui !== undefined) {
+        if (!isRecord(value.ui))
+            invalidField('ui');
+        const { renderer, confirmations, theme, motion } = value.ui;
+        if (renderer !== undefined && renderer !== 'terminal' && renderer !== 'tui') {
+            invalidField('ui.renderer');
+        }
+        if (confirmations !== undefined &&
+            confirmations !== 'config' &&
+            confirmations !== 'interactive') {
+            invalidField('ui.confirmations');
+        }
+        if (theme !== undefined && !TUI_THEME_PREFERENCES.has(theme)) {
+            invalidField('ui.theme');
+        }
+        if (motion !== undefined && !TUI_MOTION_PREFERENCES.has(motion)) {
+            invalidField('ui.motion');
+        }
+        validateOptionalBoolean(value.ui, 'mascot', 'ui.mascot');
+        validateOptionalStringArray(value.ui, 'statusLine', 'ui.statusLine');
+        if (value.ui.keymap !== undefined && !isRecord(value.ui.keymap))
+            invalidField('ui.keymap');
+    }
+    if (value.webSearch !== undefined) {
+        if (!isRecord(value.webSearch))
+            invalidField('webSearch');
+        for (const key of [
+            'provider',
+            'endpoint',
+            'apiKey',
+            'toolName',
+            'apiKeyHeader',
+            'apiKeyQueryParam',
+        ]) {
+            validateOptionalString(value.webSearch, key, `webSearch.${key}`);
+        }
+        validateOptionalPositiveInteger(value.webSearch, 'timeoutMs', 'webSearch.timeoutMs');
+        if (value.webSearch.authType !== undefined &&
+            !['bearer', 'header', 'query', 'none'].includes(String(value.webSearch.authType))) {
+            invalidField('webSearch.authType');
+        }
+        if (value.webSearch.headers !== undefined) {
+            if (!isRecord(value.webSearch.headers) ||
+                !Object.values(value.webSearch.headers).every(header => typeof header === 'string')) {
+                invalidField('webSearch.headers');
+            }
+        }
+    }
+    if (value.skills !== undefined) {
+        if (!isRecord(value.skills))
+            invalidField('skills');
+        validateOptionalStringArray(value.skills, 'paths', 'skills.paths');
+    }
+    if (value.agentLoop !== undefined) {
+        if (!isRecord(value.agentLoop))
+            invalidField('agentLoop');
+        if (value.agentLoop.budget !== undefined) {
+            if (!isRecord(value.agentLoop.budget))
+                invalidField('agentLoop.budget');
+            for (const key of [
+                'maxLlmRequestsPerUserTurn',
+                'maxToolCallsPerUserTurn',
+                'maxReadOnlyFragmentation',
+                'maxModelVisibleToolBytes',
+            ]) {
+                validateOptionalPositiveInteger(value.agentLoop.budget, key, `agentLoop.budget.${key}`);
+            }
+        }
+    }
+    if (value.subagents !== undefined) {
+        if (!isRecord(value.subagents))
+            invalidField('subagents');
+        if (value.subagents.mode !== undefined &&
+            value.subagents.mode !== 'off' &&
+            value.subagents.mode !== 'explicit' &&
+            value.subagents.mode !== 'auto') {
+            invalidField('subagents.mode');
+        }
+        for (const key of [
+            'maxParallel',
+            'maxTasksPerTurn',
+            'maxTurnsPerTask',
+            'maxModelRequestsPerTask',
+            'maxModelRequestsPerTurn',
+            'maxToolCallsPerTask',
+            'timeoutMs',
+        ]) {
+            validateOptionalPositiveInteger(value.subagents, key, `subagents.${key}`);
+        }
+        if (value.subagents.roles !== undefined) {
+            if (!Array.isArray(value.subagents.roles) ||
+                !value.subagents.roles.every(role => ['research', 'review', 'test-investigate'].includes(String(role)))) {
+                invalidField('subagents.roles');
+            }
+        }
+    }
+    if (value.cost !== undefined) {
+        if (!isRecord(value.cost))
+            invalidField('cost');
+        if (value.cost.defaultPricing !== undefined) {
+            validatePricing(value.cost.defaultPricing, 'cost.defaultPricing');
+        }
+        if (value.cost.modelPricing !== undefined) {
+            if (!isRecord(value.cost.modelPricing))
+                invalidField('cost.modelPricing');
+            for (const pricing of Object.values(value.cost.modelPricing)) {
+                validatePricing(pricing, 'cost.modelPricing.*');
+            }
+        }
+    }
+    const hasProviders = value.providers !== undefined;
+    const hasModels = value.models !== undefined;
+    if (hasProviders || hasModels) {
+        if (!Array.isArray(value.providers) || !value.providers.every(isRecord)) {
+            invalidField('providers');
+        }
+        if (!Array.isArray(value.models) || !value.models.every(isRecord))
+            invalidField('models');
+        for (const provider of value.providers) {
+            validateOptionalString(provider, 'id', 'providers.*.id', false);
+            validateOptionalString(provider, 'baseUrl', 'providers.*.baseUrl', false);
+            validateOptionalString(provider, 'apiKey', 'providers.*.apiKey', false);
+            validateOptionalString(provider, 'displayName', 'providers.*.displayName');
+            if (typeof provider.id !== 'string' ||
+                typeof provider.baseUrl !== 'string' ||
+                typeof provider.apiKey !== 'string') {
+                invalidField('providers');
+            }
+            if (provider.protocol !== 'openai-completions' &&
+                provider.protocol !== 'anthropic-messages') {
+                invalidField('providers.*.protocol');
+            }
+        }
+        for (const model of value.models) {
+            validateOptionalString(model, 'id', 'models.*.id', false);
+            validateOptionalString(model, 'displayName', 'models.*.displayName');
+            validateOptionalString(model, 'provider', 'models.*.provider', false);
+            validateOptionalString(model, 'model', 'models.*.model', false);
+            if (typeof model.id !== 'string' ||
+                typeof model.provider !== 'string' ||
+                typeof model.model !== 'string') {
+                invalidField('models');
+            }
+            validateOptionalPositiveInteger(model, 'contextWindow', 'models.*.contextWindow');
+            validateOptionalPositiveInteger(model, 'maxOutputTokens', 'models.*.maxOutputTokens');
+            validateOptionalStringArray(model, 'aliases', 'models.*.aliases');
+            validateOptionalBoolean(model, 'enabled', 'models.*.enabled');
+            validateOptionalBoolean(model, 'reasoning', 'models.*.reasoning');
+            if (model.temperatureMode !== undefined &&
+                model.temperatureMode !== 'supported' &&
+                model.temperatureMode !== 'unsupported') {
+                invalidField('models.*.temperatureMode');
+            }
+            if (model.cost !== undefined)
+                validatePricing(model.cost, 'models.*.cost');
+        }
+        let validation;
+        try {
+            validation = (0, model_registry_1.buildRegistry)(value);
+        }
+        catch {
+            invalidField('providers/models');
+        }
+        if (!validation.valid)
+            invalidField('providers/models');
+    }
+}
+/** Parse exact file bytes through the strict Settings validator. */
+function parseGlobalConfigDocumentStrict(content) {
+    let parsed;
+    try {
+        parsed = JSON.parse(typeof content === 'string' ? content : content.toString('utf8'));
+    }
+    catch {
+        invalidField('$json');
+    }
+    validateGlobalConfigDocumentStrict(parsed);
+    return parsed;
+}
 const TUI_THEME_PREFERENCES = new Set([
     'orion-pixel',
     'classic',
@@ -114,6 +434,32 @@ function sanitizeUiConfig(value) {
     }
     return Object.keys(ui).length > 0 ? ui : undefined;
 }
+function sanitizeWebConfig(value) {
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        return undefined;
+    const raw = value;
+    // Preserve forward-compatible Web fields while sanitizing the owned subtree.
+    const sanitized = { ...raw };
+    if (raw.appearance && typeof raw.appearance === 'object' && !Array.isArray(raw.appearance)) {
+        const appearance = { ...raw.appearance };
+        if (appearance.theme !== 'system' &&
+            appearance.theme !== 'light' &&
+            appearance.theme !== 'dark') {
+            delete appearance.theme;
+        }
+        if (appearance.motion !== 'system' && appearance.motion !== 'reduced') {
+            delete appearance.motion;
+        }
+        if (Object.keys(appearance).length > 0)
+            sanitized.appearance = appearance;
+        else
+            delete sanitized.appearance;
+    }
+    else {
+        delete sanitized.appearance;
+    }
+    return sanitized;
+}
 function sanitizeSandboxConfig(value) {
     if (!value || typeof value !== 'object' || Array.isArray(value))
         return undefined;
@@ -169,7 +515,7 @@ function sanitizeProjectConfig(value) {
     return sanitized;
 }
 function sanitizeGlobalConfig(config) {
-    const { ui, totalSessions: _totalSessions, totalTokens: _totalTokens, totalCost: _totalCost, ...rest } = config;
+    const { ui, web, totalSessions: _totalSessions, totalTokens: _totalTokens, totalCost: _totalCost, ...rest } = config;
     void _totalSessions;
     void _totalTokens;
     void _totalCost;
@@ -198,6 +544,9 @@ function sanitizeGlobalConfig(config) {
     const persistedUi = sanitizeUiConfig(ui);
     if (persistedUi)
         sanitized.ui = persistedUi;
+    const persistedWeb = sanitizeWebConfig(web);
+    if (persistedWeb)
+        sanitized.web = persistedWeb;
     return sanitized;
 }
 // ============================================================================
@@ -289,10 +638,29 @@ function recordFirstStartTime() {
     (0, config_dir_1.ensureConfigDir)();
     const path = (0, config_dir_1.getGlobalConfigPath)();
     (0, file_lock_1.withFileLockSync)(path, () => {
-        const config = loadGlobalConfig();
-        if (!config.firstStartTime) {
-            saveGlobalConfigUnlocked(path, { ...config, firstStartTime: new Date().toISOString() });
+        let document;
+        if ((0, fs_1.existsSync)(path)) {
+            try {
+                document = parseGlobalConfigDocumentStrict((0, fs_1.readFileSync)(path));
+            }
+            catch {
+                // Startup metadata is optional. Never let the tolerant compatibility
+                // loader turn an invalid user document into defaults and overwrite it.
+                return;
+            }
         }
+        else {
+            document = { schemaVersion: CONFIG_SCHEMA_VERSION };
+        }
+        if (typeof document.firstStartTime === 'string' && document.firstStartTime.trim())
+            return;
+        const candidate = {
+            ...document,
+            schemaVersion: document.schemaVersion ?? CONFIG_SCHEMA_VERSION,
+            firstStartTime: new Date().toISOString(),
+        };
+        validateGlobalConfigDocumentStrict(candidate);
+        (0, atomic_write_1.atomicWriteFileSync)(path, JSON.stringify(candidate, null, 2), { mode: 0o600, fsync: true });
     }, { waitMs: 10000 });
 }
 var usage_state_1 = require("./usage-state");