@oxagen/cli 0.5.0 → 0.6.1

package/dist/settings/schema.d.ts

@@ -0,0 +1,1387 @@
+/**
+ * schema.ts — The unified `settings.json` schema that drives the Oxagen CLI.
+ *
+ * This is the CLI harness spine: a single file format, resolved across three
+ * scopes (see resolve.ts), that configures the CLI's behavior the way Claude
+ * Code's `settings.json` does. Sections:
+ *
+ *   - model          default gateway model slug for the agent loop
+ *   - apiUrl         Oxagen platform API base URL
+ *   - env            environment variables made available to the session
+ *   - permissions    allow/deny rules + default mode for the agent's local tools
+ *   - hooks          shell commands fired on lifecycle events (SessionStart /
+ *                    PreToolUse / PostToolUse) — PreToolUse can block a tool
+ *   - mcpServers     external MCP server definitions (reused from @oxagen/mcp-config)
+ *   - toolVisibility per-MCP-server tool include/exclude (reused from @oxagen/mcp-config)
+ *
+ * Credentials (token / org / workspace / gatewayKey) intentionally do NOT live
+ * here — they stay in the user-only `config.json` credential store so a project
+ * `settings.json` is safe to commit. This mirrors Claude Code, which keeps
+ * `.credentials.json` separate from `settings.json`.
+ *
+ * The MCP sections deliberately reuse the schemas from `@oxagen/mcp-config` so a
+ * single `settings.json` validates identically here and in the platform agent
+ * runtime that already reads MCP servers from the same file — no second source
+ * of truth, no drift.
+ */
+import { z } from "zod";
+/**
+ * Permission mode when no explicit allow/deny rule matches a tool call.
+ *
+ *   - "default" / "acceptEdits" → allow unless a deny rule matches
+ *   - "deny"                    → block unless an allow rule matches (deny-by-default)
+ *   - "bypassPermissions"       → allow everything (deny rules still take priority)
+ *
+ * Enforced for the agent's local tools in gate.ts. (Interactive "ask"/"plan"
+ * prompting lands with the MCP-client PR; only the modes enforced today are
+ * accepted here so the schema never advertises behavior that does not exist.)
+ */
+export declare const permissionModeSchema: z.ZodEnum<["default", "acceptEdits", "deny", "bypassPermissions"]>;
+export type PermissionMode = z.infer<typeof permissionModeSchema>;
+/**
+ * Permission rules for the agent's local tools, in Claude Code's rule syntax:
+ *
+ *   "Bash"              → the whole bash tool
+ *   "Bash(git*)"        → bash commands matching the glob `git*`
+ *   "Write"             → any file write
+ *   "Write(src/**)"     → writes whose path matches `src/**`
+ *   "Read(.env*)"       → reads whose path matches `.env*`
+ *   "mcp__github__*"    → (reserved for the MCP gate) any tool on the `github` server
+ *
+ * `deny` always wins over `allow` at the same scope. The MCP-specific
+ * `defaultMcpPolicy` / `mcpServers` fields are carried through unchanged so the
+ * same `permissions` object also feeds @oxagen/mcp-config's per-server gate when
+ * the MCP client lands.
+ */
+export declare const permissionsSchema: z.ZodObject<{
+    /** Mode applied when no allow/deny rule matches. Default: "default". */
+    defaultMode: z.ZodOptional<z.ZodEnum<["default", "acceptEdits", "deny", "bypassPermissions"]>>;
+    /** Rules that explicitly permit a tool call (escape hatch from deny mode). */
+    allow: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    /** Rules that explicitly block a tool call. Highest priority. */
+    deny: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    /** Global default policy for MCP tool invocations. */
+    defaultMcpPolicy: z.ZodOptional<z.ZodEnum<["allow", "deny", "ask"]>>;
+    /** Per-MCP-server permission overrides, keyed by server name. */
+    mcpServers: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
+        defaultPolicy: z.ZodOptional<z.ZodEnum<["allow", "deny", "ask"]>>;
+        allow: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        deny: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    }, "strip", z.ZodTypeAny, {
+        allow?: string[] | undefined;
+        deny?: string[] | undefined;
+        defaultPolicy?: "ask" | "allow" | "deny" | undefined;
+    }, {
+        allow?: string[] | undefined;
+        deny?: string[] | undefined;
+        defaultPolicy?: "ask" | "allow" | "deny" | undefined;
+    }>>>;
+}, "strip", z.ZodTypeAny, {
+    allow?: string[] | undefined;
+    deny?: string[] | undefined;
+    defaultMcpPolicy?: "ask" | "allow" | "deny" | undefined;
+    mcpServers?: Record<string, {
+        allow?: string[] | undefined;
+        deny?: string[] | undefined;
+        defaultPolicy?: "ask" | "allow" | "deny" | undefined;
+    }> | undefined;
+    defaultMode?: "default" | "acceptEdits" | "deny" | "bypassPermissions" | undefined;
+}, {
+    allow?: string[] | undefined;
+    deny?: string[] | undefined;
+    defaultMcpPolicy?: "ask" | "allow" | "deny" | undefined;
+    mcpServers?: Record<string, {
+        allow?: string[] | undefined;
+        deny?: string[] | undefined;
+        defaultPolicy?: "ask" | "allow" | "deny" | undefined;
+    }> | undefined;
+    defaultMode?: "default" | "acceptEdits" | "deny" | "bypassPermissions" | undefined;
+}>;
+export type Permissions = z.infer<typeof permissionsSchema>;
+/** Lifecycle events a hook can fire on. */
+export declare const HOOK_EVENTS: readonly ["SessionStart", "PreToolUse", "PostToolUse"];
+export type HookEvent = (typeof HOOK_EVENTS)[number];
+/** A single shell command a hook runs. */
+export declare const hookActionSchema: z.ZodObject<{
+    /** Only "command" hooks are supported. */
+    type: z.ZodDefault<z.ZodLiteral<"command">>;
+    /** Shell command. Receives the event payload as JSON on stdin. */
+    command: z.ZodString;
+    /** Per-hook timeout in milliseconds (default 60000, max 600000). */
+    timeoutMs: z.ZodOptional<z.ZodNumber>;
+}, "strip", z.ZodTypeAny, {
+    type: "command";
+    command: string;
+    timeoutMs?: number | undefined;
+}, {
+    command: string;
+    type?: "command" | undefined;
+    timeoutMs?: number | undefined;
+}>;
+export type HookAction = z.infer<typeof hookActionSchema>;
+/**
+ * A matcher groups hook actions under a tool-name pattern. For PreToolUse /
+ * PostToolUse, `matcher` is a glob over the tool name (e.g. "bash",
+ * "write_file", "*"). For SessionStart it is ignored (all actions run).
+ */
+export declare const hookMatcherSchema: z.ZodObject<{
+    /** Glob over the tool name. Omit (or "*") to match every tool. */
+    matcher: z.ZodOptional<z.ZodString>;
+    /** Actions to run when this matcher matches. */
+    hooks: z.ZodArray<z.ZodObject<{
+        /** Only "command" hooks are supported. */
+        type: z.ZodDefault<z.ZodLiteral<"command">>;
+        /** Shell command. Receives the event payload as JSON on stdin. */
+        command: z.ZodString;
+        /** Per-hook timeout in milliseconds (default 60000, max 600000). */
+        timeoutMs: z.ZodOptional<z.ZodNumber>;
+    }, "strip", z.ZodTypeAny, {
+        type: "command";
+        command: string;
+        timeoutMs?: number | undefined;
+    }, {
+        command: string;
+        type?: "command" | undefined;
+        timeoutMs?: number | undefined;
+    }>, "many">;
+}, "strip", z.ZodTypeAny, {
+    hooks: {
+        type: "command";
+        command: string;
+        timeoutMs?: number | undefined;
+    }[];
+    matcher?: string | undefined;
+}, {
+    hooks: {
+        command: string;
+        type?: "command" | undefined;
+        timeoutMs?: number | undefined;
+    }[];
+    matcher?: string | undefined;
+}>;
+export type HookMatcher = z.infer<typeof hookMatcherSchema>;
+/** Hooks keyed by lifecycle event. */
+export declare const hooksSchema: z.ZodObject<{
+    SessionStart: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        /** Glob over the tool name. Omit (or "*") to match every tool. */
+        matcher: z.ZodOptional<z.ZodString>;
+        /** Actions to run when this matcher matches. */
+        hooks: z.ZodArray<z.ZodObject<{
+            /** Only "command" hooks are supported. */
+            type: z.ZodDefault<z.ZodLiteral<"command">>;
+            /** Shell command. Receives the event payload as JSON on stdin. */
+            command: z.ZodString;
+            /** Per-hook timeout in milliseconds (default 60000, max 600000). */
+            timeoutMs: z.ZodOptional<z.ZodNumber>;
+        }, "strip", z.ZodTypeAny, {
+            type: "command";
+            command: string;
+            timeoutMs?: number | undefined;
+        }, {
+            command: string;
+            type?: "command" | undefined;
+            timeoutMs?: number | undefined;
+        }>, "many">;
+    }, "strip", z.ZodTypeAny, {
+        hooks: {
+            type: "command";
+            command: string;
+            timeoutMs?: number | undefined;
+        }[];
+        matcher?: string | undefined;
+    }, {
+        hooks: {
+            command: string;
+            type?: "command" | undefined;
+            timeoutMs?: number | undefined;
+        }[];
+        matcher?: string | undefined;
+    }>, "many">>;
+    PreToolUse: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        /** Glob over the tool name. Omit (or "*") to match every tool. */
+        matcher: z.ZodOptional<z.ZodString>;
+        /** Actions to run when this matcher matches. */
+        hooks: z.ZodArray<z.ZodObject<{
+            /** Only "command" hooks are supported. */
+            type: z.ZodDefault<z.ZodLiteral<"command">>;
+            /** Shell command. Receives the event payload as JSON on stdin. */
+            command: z.ZodString;
+            /** Per-hook timeout in milliseconds (default 60000, max 600000). */
+            timeoutMs: z.ZodOptional<z.ZodNumber>;
+        }, "strip", z.ZodTypeAny, {
+            type: "command";
+            command: string;
+            timeoutMs?: number | undefined;
+        }, {
+            command: string;
+            type?: "command" | undefined;
+            timeoutMs?: number | undefined;
+        }>, "many">;
+    }, "strip", z.ZodTypeAny, {
+        hooks: {
+            type: "command";
+            command: string;
+            timeoutMs?: number | undefined;
+        }[];
+        matcher?: string | undefined;
+    }, {
+        hooks: {
+            command: string;
+            type?: "command" | undefined;
+            timeoutMs?: number | undefined;
+        }[];
+        matcher?: string | undefined;
+    }>, "many">>;
+    PostToolUse: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        /** Glob over the tool name. Omit (or "*") to match every tool. */
+        matcher: z.ZodOptional<z.ZodString>;
+        /** Actions to run when this matcher matches. */
+        hooks: z.ZodArray<z.ZodObject<{
+            /** Only "command" hooks are supported. */
+            type: z.ZodDefault<z.ZodLiteral<"command">>;
+            /** Shell command. Receives the event payload as JSON on stdin. */
+            command: z.ZodString;
+            /** Per-hook timeout in milliseconds (default 60000, max 600000). */
+            timeoutMs: z.ZodOptional<z.ZodNumber>;
+        }, "strip", z.ZodTypeAny, {
+            type: "command";
+            command: string;
+            timeoutMs?: number | undefined;
+        }, {
+            command: string;
+            type?: "command" | undefined;
+            timeoutMs?: number | undefined;
+        }>, "many">;
+    }, "strip", z.ZodTypeAny, {
+        hooks: {
+            type: "command";
+            command: string;
+            timeoutMs?: number | undefined;
+        }[];
+        matcher?: string | undefined;
+    }, {
+        hooks: {
+            command: string;
+            type?: "command" | undefined;
+            timeoutMs?: number | undefined;
+        }[];
+        matcher?: string | undefined;
+    }>, "many">>;
+}, "strip", z.ZodTypeAny, {
+    SessionStart?: {
+        hooks: {
+            type: "command";
+            command: string;
+            timeoutMs?: number | undefined;
+        }[];
+        matcher?: string | undefined;
+    }[] | undefined;
+    PreToolUse?: {
+        hooks: {
+            type: "command";
+            command: string;
+            timeoutMs?: number | undefined;
+        }[];
+        matcher?: string | undefined;
+    }[] | undefined;
+    PostToolUse?: {
+        hooks: {
+            type: "command";
+            command: string;
+            timeoutMs?: number | undefined;
+        }[];
+        matcher?: string | undefined;
+    }[] | undefined;
+}, {
+    SessionStart?: {
+        hooks: {
+            command: string;
+            type?: "command" | undefined;
+            timeoutMs?: number | undefined;
+        }[];
+        matcher?: string | undefined;
+    }[] | undefined;
+    PreToolUse?: {
+        hooks: {
+            command: string;
+            type?: "command" | undefined;
+            timeoutMs?: number | undefined;
+        }[];
+        matcher?: string | undefined;
+    }[] | undefined;
+    PostToolUse?: {
+        hooks: {
+            command: string;
+            type?: "command" | undefined;
+            timeoutMs?: number | undefined;
+        }[];
+        matcher?: string | undefined;
+    }[] | undefined;
+}>;
+export type Hooks = z.infer<typeof hooksSchema>;
+/**
+ * A named agent declared inline in settings.json (an alternative to a markdown
+ * file under `.oxagen/agents/`). `prompt` is the system prompt; `tools` is the
+ * permission-syntax allowlist (omit to inherit every tool).
+ */
+export declare const inlineAgentSchema: z.ZodObject<{
+    description: z.ZodOptional<z.ZodString>;
+    prompt: z.ZodString;
+    tools: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    model: z.ZodOptional<z.ZodString>;
+}, "strip", z.ZodTypeAny, {
+    prompt: string;
+    model?: string | undefined;
+    description?: string | undefined;
+    tools?: string[] | undefined;
+}, {
+    prompt: string;
+    model?: string | undefined;
+    description?: string | undefined;
+    tools?: string[] | undefined;
+}>;
+export type InlineAgent = z.infer<typeof inlineAgentSchema>;
+export declare const oxagenSettingsSchema: z.ZodObject<{
+    /** Optional JSON-Schema reference for editor autocompletion. */
+    $schema: z.ZodOptional<z.ZodString>;
+    /** Default gateway model slug for the agent loop (e.g. "anthropic/claude-sonnet-4.6"). */
+    model: z.ZodOptional<z.ZodString>;
+    /** Oxagen platform API base URL (overrides config.json; env still wins). */
+    apiUrl: z.ZodOptional<z.ZodString>;
+    /** Environment variables exported into the session (fills only unset vars; shell wins). */
+    env: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+    /** Allow/deny rules + default mode for the agent's local tools. */
+    permissions: z.ZodOptional<z.ZodObject<{
+        /** Mode applied when no allow/deny rule matches. Default: "default". */
+        defaultMode: z.ZodOptional<z.ZodEnum<["default", "acceptEdits", "deny", "bypassPermissions"]>>;
+        /** Rules that explicitly permit a tool call (escape hatch from deny mode). */
+        allow: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        /** Rules that explicitly block a tool call. Highest priority. */
+        deny: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        /** Global default policy for MCP tool invocations. */
+        defaultMcpPolicy: z.ZodOptional<z.ZodEnum<["allow", "deny", "ask"]>>;
+        /** Per-MCP-server permission overrides, keyed by server name. */
+        mcpServers: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
+            defaultPolicy: z.ZodOptional<z.ZodEnum<["allow", "deny", "ask"]>>;
+            allow: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+            deny: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        }, "strip", z.ZodTypeAny, {
+            allow?: string[] | undefined;
+            deny?: string[] | undefined;
+            defaultPolicy?: "ask" | "allow" | "deny" | undefined;
+        }, {
+            allow?: string[] | undefined;
+            deny?: string[] | undefined;
+            defaultPolicy?: "ask" | "allow" | "deny" | undefined;
+        }>>>;
+    }, "strip", z.ZodTypeAny, {
+        allow?: string[] | undefined;
+        deny?: string[] | undefined;
+        defaultMcpPolicy?: "ask" | "allow" | "deny" | undefined;
+        mcpServers?: Record<string, {
+            allow?: string[] | undefined;
+            deny?: string[] | undefined;
+            defaultPolicy?: "ask" | "allow" | "deny" | undefined;
+        }> | undefined;
+        defaultMode?: "default" | "acceptEdits" | "deny" | "bypassPermissions" | undefined;
+    }, {
+        allow?: string[] | undefined;
+        deny?: string[] | undefined;
+        defaultMcpPolicy?: "ask" | "allow" | "deny" | undefined;
+        mcpServers?: Record<string, {
+            allow?: string[] | undefined;
+            deny?: string[] | undefined;
+            defaultPolicy?: "ask" | "allow" | "deny" | undefined;
+        }> | undefined;
+        defaultMode?: "default" | "acceptEdits" | "deny" | "bypassPermissions" | undefined;
+    }>>;
+    /** Shell commands fired on lifecycle events. */
+    hooks: z.ZodOptional<z.ZodObject<{
+        SessionStart: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            /** Glob over the tool name. Omit (or "*") to match every tool. */
+            matcher: z.ZodOptional<z.ZodString>;
+            /** Actions to run when this matcher matches. */
+            hooks: z.ZodArray<z.ZodObject<{
+                /** Only "command" hooks are supported. */
+                type: z.ZodDefault<z.ZodLiteral<"command">>;
+                /** Shell command. Receives the event payload as JSON on stdin. */
+                command: z.ZodString;
+                /** Per-hook timeout in milliseconds (default 60000, max 600000). */
+                timeoutMs: z.ZodOptional<z.ZodNumber>;
+            }, "strip", z.ZodTypeAny, {
+                type: "command";
+                command: string;
+                timeoutMs?: number | undefined;
+            }, {
+                command: string;
+                type?: "command" | undefined;
+                timeoutMs?: number | undefined;
+            }>, "many">;
+        }, "strip", z.ZodTypeAny, {
+            hooks: {
+                type: "command";
+                command: string;
+                timeoutMs?: number | undefined;
+            }[];
+            matcher?: string | undefined;
+        }, {
+            hooks: {
+                command: string;
+                type?: "command" | undefined;
+                timeoutMs?: number | undefined;
+            }[];
+            matcher?: string | undefined;
+        }>, "many">>;
+        PreToolUse: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            /** Glob over the tool name. Omit (or "*") to match every tool. */
+            matcher: z.ZodOptional<z.ZodString>;
+            /** Actions to run when this matcher matches. */
+            hooks: z.ZodArray<z.ZodObject<{
+                /** Only "command" hooks are supported. */
+                type: z.ZodDefault<z.ZodLiteral<"command">>;
+                /** Shell command. Receives the event payload as JSON on stdin. */
+                command: z.ZodString;
+                /** Per-hook timeout in milliseconds (default 60000, max 600000). */
+                timeoutMs: z.ZodOptional<z.ZodNumber>;
+            }, "strip", z.ZodTypeAny, {
+                type: "command";
+                command: string;
+                timeoutMs?: number | undefined;
+            }, {
+                command: string;
+                type?: "command" | undefined;
+                timeoutMs?: number | undefined;
+            }>, "many">;
+        }, "strip", z.ZodTypeAny, {
+            hooks: {
+                type: "command";
+                command: string;
+                timeoutMs?: number | undefined;
+            }[];
+            matcher?: string | undefined;
+        }, {
+            hooks: {
+                command: string;
+                type?: "command" | undefined;
+                timeoutMs?: number | undefined;
+            }[];
+            matcher?: string | undefined;
+        }>, "many">>;
+        PostToolUse: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            /** Glob over the tool name. Omit (or "*") to match every tool. */
+            matcher: z.ZodOptional<z.ZodString>;
+            /** Actions to run when this matcher matches. */
+            hooks: z.ZodArray<z.ZodObject<{
+                /** Only "command" hooks are supported. */
+                type: z.ZodDefault<z.ZodLiteral<"command">>;
+                /** Shell command. Receives the event payload as JSON on stdin. */
+                command: z.ZodString;
+                /** Per-hook timeout in milliseconds (default 60000, max 600000). */
+                timeoutMs: z.ZodOptional<z.ZodNumber>;
+            }, "strip", z.ZodTypeAny, {
+                type: "command";
+                command: string;
+                timeoutMs?: number | undefined;
+            }, {
+                command: string;
+                type?: "command" | undefined;
+                timeoutMs?: number | undefined;
+            }>, "many">;
+        }, "strip", z.ZodTypeAny, {
+            hooks: {
+                type: "command";
+                command: string;
+                timeoutMs?: number | undefined;
+            }[];
+            matcher?: string | undefined;
+        }, {
+            hooks: {
+                command: string;
+                type?: "command" | undefined;
+                timeoutMs?: number | undefined;
+            }[];
+            matcher?: string | undefined;
+        }>, "many">>;
+    }, "strip", z.ZodTypeAny, {
+        SessionStart?: {
+            hooks: {
+                type: "command";
+                command: string;
+                timeoutMs?: number | undefined;
+            }[];
+            matcher?: string | undefined;
+        }[] | undefined;
+        PreToolUse?: {
+            hooks: {
+                type: "command";
+                command: string;
+                timeoutMs?: number | undefined;
+            }[];
+            matcher?: string | undefined;
+        }[] | undefined;
+        PostToolUse?: {
+            hooks: {
+                type: "command";
+                command: string;
+                timeoutMs?: number | undefined;
+            }[];
+            matcher?: string | undefined;
+        }[] | undefined;
+    }, {
+        SessionStart?: {
+            hooks: {
+                command: string;
+                type?: "command" | undefined;
+                timeoutMs?: number | undefined;
+            }[];
+            matcher?: string | undefined;
+        }[] | undefined;
+        PreToolUse?: {
+            hooks: {
+                command: string;
+                type?: "command" | undefined;
+                timeoutMs?: number | undefined;
+            }[];
+            matcher?: string | undefined;
+        }[] | undefined;
+        PostToolUse?: {
+            hooks: {
+                command: string;
+                type?: "command" | undefined;
+                timeoutMs?: number | undefined;
+            }[];
+            matcher?: string | undefined;
+        }[] | undefined;
+    }>>;
+    /** External MCP server definitions, keyed by name. */
+    mcpServers: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodDiscriminatedUnion<"transport", [z.ZodObject<{
+        transport: z.ZodLiteral<"streamable-http">;
+        url: z.ZodString;
+        auth: z.ZodDefault<z.ZodEnum<["oauth", "bearer", "header", "none"]>>;
+        oauthServerUrl: z.ZodOptional<z.ZodString>;
+        scopes: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        envToken: z.ZodOptional<z.ZodString>;
+        headers: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+        env: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+        disabled: z.ZodOptional<z.ZodBoolean>;
+    }, "strip", z.ZodTypeAny, {
+        transport: "streamable-http";
+        url: string;
+        auth: "none" | "oauth" | "bearer" | "header";
+        headers?: Record<string, string> | undefined;
+        oauthServerUrl?: string | undefined;
+        scopes?: string[] | undefined;
+        envToken?: string | undefined;
+        env?: Record<string, string> | undefined;
+        disabled?: boolean | undefined;
+    }, {
+        transport: "streamable-http";
+        url: string;
+        headers?: Record<string, string> | undefined;
+        auth?: "none" | "oauth" | "bearer" | "header" | undefined;
+        oauthServerUrl?: string | undefined;
+        scopes?: string[] | undefined;
+        envToken?: string | undefined;
+        env?: Record<string, string> | undefined;
+        disabled?: boolean | undefined;
+    }>, z.ZodObject<{
+        transport: z.ZodLiteral<"sse">;
+        url: z.ZodString;
+        auth: z.ZodDefault<z.ZodEnum<["oauth", "bearer", "header", "none"]>>;
+        oauthServerUrl: z.ZodOptional<z.ZodString>;
+        scopes: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        envToken: z.ZodOptional<z.ZodString>;
+        headers: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+        env: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+        disabled: z.ZodOptional<z.ZodBoolean>;
+    }, "strip", z.ZodTypeAny, {
+        transport: "sse";
+        url: string;
+        auth: "none" | "oauth" | "bearer" | "header";
+        headers?: Record<string, string> | undefined;
+        oauthServerUrl?: string | undefined;
+        scopes?: string[] | undefined;
+        envToken?: string | undefined;
+        env?: Record<string, string> | undefined;
+        disabled?: boolean | undefined;
+    }, {
+        transport: "sse";
+        url: string;
+        headers?: Record<string, string> | undefined;
+        auth?: "none" | "oauth" | "bearer" | "header" | undefined;
+        oauthServerUrl?: string | undefined;
+        scopes?: string[] | undefined;
+        envToken?: string | undefined;
+        env?: Record<string, string> | undefined;
+        disabled?: boolean | undefined;
+    }>, z.ZodObject<{
+        transport: z.ZodLiteral<"stdio">;
+        command: z.ZodString;
+        args: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+        env: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+        cwd: z.ZodOptional<z.ZodString>;
+        disabled: z.ZodOptional<z.ZodBoolean>;
+    }, "strip", z.ZodTypeAny, {
+        args: string[];
+        command: string;
+        transport: "stdio";
+        cwd?: string | undefined;
+        env?: Record<string, string> | undefined;
+        disabled?: boolean | undefined;
+    }, {
+        command: string;
+        transport: "stdio";
+        cwd?: string | undefined;
+        args?: string[] | undefined;
+        env?: Record<string, string> | undefined;
+        disabled?: boolean | undefined;
+    }>, z.ZodObject<{
+        transport: z.ZodLiteral<"websocket">;
+        url: z.ZodString;
+        auth: z.ZodDefault<z.ZodEnum<["bearer", "header", "none"]>>;
+        envToken: z.ZodOptional<z.ZodString>;
+        headers: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+        env: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+        disabled: z.ZodOptional<z.ZodBoolean>;
+    }, "strip", z.ZodTypeAny, {
+        transport: "websocket";
+        url: string;
+        auth: "none" | "bearer" | "header";
+        headers?: Record<string, string> | undefined;
+        envToken?: string | undefined;
+        env?: Record<string, string> | undefined;
+        disabled?: boolean | undefined;
+    }, {
+        transport: "websocket";
+        url: string;
+        headers?: Record<string, string> | undefined;
+        auth?: "none" | "bearer" | "header" | undefined;
+        envToken?: string | undefined;
+        env?: Record<string, string> | undefined;
+        disabled?: boolean | undefined;
+    }>]>>>;
+    /** Per-MCP-server tool visibility, keyed by server name. */
+    toolVisibility: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
+        include: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        exclude: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    }, "strip", z.ZodTypeAny, {
+        include?: string[] | undefined;
+        exclude?: string[] | undefined;
+    }, {
+        include?: string[] | undefined;
+        exclude?: string[] | undefined;
+    }>>>;
+    /** Inline named agent definitions, keyed by agent name. */
+    agents: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
+        description: z.ZodOptional<z.ZodString>;
+        prompt: z.ZodString;
+        tools: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        model: z.ZodOptional<z.ZodString>;
+    }, "strip", z.ZodTypeAny, {
+        prompt: string;
+        model?: string | undefined;
+        description?: string | undefined;
+        tools?: string[] | undefined;
+    }, {
+        prompt: string;
+        model?: string | undefined;
+        description?: string | undefined;
+        tools?: string[] | undefined;
+    }>>>;
+}, "passthrough", z.ZodTypeAny, z.objectOutputType<{
+    /** Optional JSON-Schema reference for editor autocompletion. */
+    $schema: z.ZodOptional<z.ZodString>;
+    /** Default gateway model slug for the agent loop (e.g. "anthropic/claude-sonnet-4.6"). */
+    model: z.ZodOptional<z.ZodString>;
+    /** Oxagen platform API base URL (overrides config.json; env still wins). */
+    apiUrl: z.ZodOptional<z.ZodString>;
+    /** Environment variables exported into the session (fills only unset vars; shell wins). */
+    env: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+    /** Allow/deny rules + default mode for the agent's local tools. */
+    permissions: z.ZodOptional<z.ZodObject<{
+        /** Mode applied when no allow/deny rule matches. Default: "default". */
+        defaultMode: z.ZodOptional<z.ZodEnum<["default", "acceptEdits", "deny", "bypassPermissions"]>>;
+        /** Rules that explicitly permit a tool call (escape hatch from deny mode). */
+        allow: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        /** Rules that explicitly block a tool call. Highest priority. */
+        deny: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        /** Global default policy for MCP tool invocations. */
+        defaultMcpPolicy: z.ZodOptional<z.ZodEnum<["allow", "deny", "ask"]>>;
+        /** Per-MCP-server permission overrides, keyed by server name. */
+        mcpServers: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
+            defaultPolicy: z.ZodOptional<z.ZodEnum<["allow", "deny", "ask"]>>;
+            allow: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+            deny: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        }, "strip", z.ZodTypeAny, {
+            allow?: string[] | undefined;
+            deny?: string[] | undefined;
+            defaultPolicy?: "ask" | "allow" | "deny" | undefined;
+        }, {
+            allow?: string[] | undefined;
+            deny?: string[] | undefined;
+            defaultPolicy?: "ask" | "allow" | "deny" | undefined;
+        }>>>;
+    }, "strip", z.ZodTypeAny, {
+        allow?: string[] | undefined;
+        deny?: string[] | undefined;
+        defaultMcpPolicy?: "ask" | "allow" | "deny" | undefined;
+        mcpServers?: Record<string, {
+            allow?: string[] | undefined;
+            deny?: string[] | undefined;
+            defaultPolicy?: "ask" | "allow" | "deny" | undefined;
+        }> | undefined;
+        defaultMode?: "default" | "acceptEdits" | "deny" | "bypassPermissions" | undefined;
+    }, {
+        allow?: string[] | undefined;
+        deny?: string[] | undefined;
+        defaultMcpPolicy?: "ask" | "allow" | "deny" | undefined;
+        mcpServers?: Record<string, {
+            allow?: string[] | undefined;
+            deny?: string[] | undefined;
+            defaultPolicy?: "ask" | "allow" | "deny" | undefined;
+        }> | undefined;
+        defaultMode?: "default" | "acceptEdits" | "deny" | "bypassPermissions" | undefined;
+    }>>;
+    /** Shell commands fired on lifecycle events. */
+    hooks: z.ZodOptional<z.ZodObject<{
+        SessionStart: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            /** Glob over the tool name. Omit (or "*") to match every tool. */
+            matcher: z.ZodOptional<z.ZodString>;
+            /** Actions to run when this matcher matches. */
+            hooks: z.ZodArray<z.ZodObject<{
+                /** Only "command" hooks are supported. */
+                type: z.ZodDefault<z.ZodLiteral<"command">>;
+                /** Shell command. Receives the event payload as JSON on stdin. */
+                command: z.ZodString;
+                /** Per-hook timeout in milliseconds (default 60000, max 600000). */
+                timeoutMs: z.ZodOptional<z.ZodNumber>;
+            }, "strip", z.ZodTypeAny, {
+                type: "command";
+                command: string;
+                timeoutMs?: number | undefined;
+            }, {
+                command: string;
+                type?: "command" | undefined;
+                timeoutMs?: number | undefined;
+            }>, "many">;
+        }, "strip", z.ZodTypeAny, {
+            hooks: {
+                type: "command";
+                command: string;
+                timeoutMs?: number | undefined;
+            }[];
+            matcher?: string | undefined;
+        }, {
+            hooks: {
+                command: string;
+                type?: "command" | undefined;
+                timeoutMs?: number | undefined;
+            }[];
+            matcher?: string | undefined;
+        }>, "many">>;
+        PreToolUse: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            /** Glob over the tool name. Omit (or "*") to match every tool. */
+            matcher: z.ZodOptional<z.ZodString>;
+            /** Actions to run when this matcher matches. */
+            hooks: z.ZodArray<z.ZodObject<{
+                /** Only "command" hooks are supported. */
+                type: z.ZodDefault<z.ZodLiteral<"command">>;
+                /** Shell command. Receives the event payload as JSON on stdin. */
+                command: z.ZodString;
+                /** Per-hook timeout in milliseconds (default 60000, max 600000). */
+                timeoutMs: z.ZodOptional<z.ZodNumber>;
+            }, "strip", z.ZodTypeAny, {
+                type: "command";
+                command: string;
+                timeoutMs?: number | undefined;
+            }, {
+                command: string;
+                type?: "command" | undefined;
+                timeoutMs?: number | undefined;
+            }>, "many">;
+        }, "strip", z.ZodTypeAny, {
+            hooks: {
+                type: "command";
+                command: string;
+                timeoutMs?: number | undefined;
+            }[];
+            matcher?: string | undefined;
+        }, {
+            hooks: {
+                command: string;
+                type?: "command" | undefined;
+                timeoutMs?: number | undefined;
+            }[];
+            matcher?: string | undefined;
+        }>, "many">>;
+        PostToolUse: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            /** Glob over the tool name. Omit (or "*") to match every tool. */
+            matcher: z.ZodOptional<z.ZodString>;
+            /** Actions to run when this matcher matches. */
+            hooks: z.ZodArray<z.ZodObject<{
+                /** Only "command" hooks are supported. */
+                type: z.ZodDefault<z.ZodLiteral<"command">>;
+                /** Shell command. Receives the event payload as JSON on stdin. */
+                command: z.ZodString;
+                /** Per-hook timeout in milliseconds (default 60000, max 600000). */
+                timeoutMs: z.ZodOptional<z.ZodNumber>;
+            }, "strip", z.ZodTypeAny, {
+                type: "command";
+                command: string;
+                timeoutMs?: number | undefined;
+            }, {
+                command: string;
+                type?: "command" | undefined;
+                timeoutMs?: number | undefined;
+            }>, "many">;
+        }, "strip", z.ZodTypeAny, {
+            hooks: {
+                type: "command";
+                command: string;
+                timeoutMs?: number | undefined;
+            }[];
+            matcher?: string | undefined;
+        }, {
+            hooks: {
+                command: string;
+                type?: "command" | undefined;
+                timeoutMs?: number | undefined;
+            }[];
+            matcher?: string | undefined;
+        }>, "many">>;
+    }, "strip", z.ZodTypeAny, {
+        SessionStart?: {
+            hooks: {
+                type: "command";
+                command: string;
+                timeoutMs?: number | undefined;
+            }[];
+            matcher?: string | undefined;
+        }[] | undefined;
+        PreToolUse?: {
+            hooks: {
+                type: "command";
+                command: string;
+                timeoutMs?: number | undefined;
+            }[];
+            matcher?: string | undefined;
+        }[] | undefined;
+        PostToolUse?: {
+            hooks: {
+                type: "command";
+                command: string;
+                timeoutMs?: number | undefined;
+            }[];
+            matcher?: string | undefined;
+        }[] | undefined;
+    }, {
+        SessionStart?: {
+            hooks: {
+                command: string;
+                type?: "command" | undefined;
+                timeoutMs?: number | undefined;
+            }[];
+            matcher?: string | undefined;
+        }[] | undefined;
+        PreToolUse?: {
+            hooks: {
+                command: string;
+                type?: "command" | undefined;
+                timeoutMs?: number | undefined;
+            }[];
+            matcher?: string | undefined;
+        }[] | undefined;
+        PostToolUse?: {
+            hooks: {
+                command: string;
+                type?: "command" | undefined;
+                timeoutMs?: number | undefined;
+            }[];
+            matcher?: string | undefined;
+        }[] | undefined;
+    }>>;
+    /** External MCP server definitions, keyed by name. */
+    mcpServers: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodDiscriminatedUnion<"transport", [z.ZodObject<{
+        transport: z.ZodLiteral<"streamable-http">;
+        url: z.ZodString;
+        auth: z.ZodDefault<z.ZodEnum<["oauth", "bearer", "header", "none"]>>;
+        oauthServerUrl: z.ZodOptional<z.ZodString>;
+        scopes: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        envToken: z.ZodOptional<z.ZodString>;
+        headers: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+        env: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+        disabled: z.ZodOptional<z.ZodBoolean>;
+    }, "strip", z.ZodTypeAny, {
+        transport: "streamable-http";
+        url: string;
+        auth: "none" | "oauth" | "bearer" | "header";
+        headers?: Record<string, string> | undefined;
+        oauthServerUrl?: string | undefined;
+        scopes?: string[] | undefined;
+        envToken?: string | undefined;
+        env?: Record<string, string> | undefined;
+        disabled?: boolean | undefined;
+    }, {
+        transport: "streamable-http";
+        url: string;
+        headers?: Record<string, string> | undefined;
+        auth?: "none" | "oauth" | "bearer" | "header" | undefined;
+        oauthServerUrl?: string | undefined;
+        scopes?: string[] | undefined;
+        envToken?: string | undefined;
+        env?: Record<string, string> | undefined;
+        disabled?: boolean | undefined;
+    }>, z.ZodObject<{
+        transport: z.ZodLiteral<"sse">;
+        url: z.ZodString;
+        auth: z.ZodDefault<z.ZodEnum<["oauth", "bearer", "header", "none"]>>;
+        oauthServerUrl: z.ZodOptional<z.ZodString>;
+        scopes: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        envToken: z.ZodOptional<z.ZodString>;
+        headers: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+        env: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+        disabled: z.ZodOptional<z.ZodBoolean>;
+    }, "strip", z.ZodTypeAny, {
+        transport: "sse";
+        url: string;
+        auth: "none" | "oauth" | "bearer" | "header";
+        headers?: Record<string, string> | undefined;
+        oauthServerUrl?: string | undefined;
+        scopes?: string[] | undefined;
+        envToken?: string | undefined;
+        env?: Record<string, string> | undefined;
+        disabled?: boolean | undefined;
+    }, {
+        transport: "sse";
+        url: string;
+        headers?: Record<string, string> | undefined;
+        auth?: "none" | "oauth" | "bearer" | "header" | undefined;
+        oauthServerUrl?: string | undefined;
+        scopes?: string[] | undefined;
+        envToken?: string | undefined;
+        env?: Record<string, string> | undefined;
+        disabled?: boolean | undefined;
+    }>, z.ZodObject<{
+        transport: z.ZodLiteral<"stdio">;
+        command: z.ZodString;
+        args: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+        env: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+        cwd: z.ZodOptional<z.ZodString>;
+        disabled: z.ZodOptional<z.ZodBoolean>;
+    }, "strip", z.ZodTypeAny, {
+        args: string[];
+        command: string;
+        transport: "stdio";
+        cwd?: string | undefined;
+        env?: Record<string, string> | undefined;
+        disabled?: boolean | undefined;
+    }, {
+        command: string;
+        transport: "stdio";
+        cwd?: string | undefined;
+        args?: string[] | undefined;
+        env?: Record<string, string> | undefined;
+        disabled?: boolean | undefined;
+    }>, z.ZodObject<{
+        transport: z.ZodLiteral<"websocket">;
+        url: z.ZodString;
+        auth: z.ZodDefault<z.ZodEnum<["bearer", "header", "none"]>>;
+        envToken: z.ZodOptional<z.ZodString>;
+        headers: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+        env: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+        disabled: z.ZodOptional<z.ZodBoolean>;
+    }, "strip", z.ZodTypeAny, {
+        transport: "websocket";
+        url: string;
+        auth: "none" | "bearer" | "header";
+        headers?: Record<string, string> | undefined;
+        envToken?: string | undefined;
+        env?: Record<string, string> | undefined;
+        disabled?: boolean | undefined;
+    }, {
+        transport: "websocket";
+        url: string;
+        headers?: Record<string, string> | undefined;
+        auth?: "none" | "bearer" | "header" | undefined;
+        envToken?: string | undefined;
+        env?: Record<string, string> | undefined;
+        disabled?: boolean | undefined;
+    }>]>>>;
+    /** Per-MCP-server tool visibility, keyed by server name. */
+    toolVisibility: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
+        include: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        exclude: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    }, "strip", z.ZodTypeAny, {
+        include?: string[] | undefined;
+        exclude?: string[] | undefined;
+    }, {
+        include?: string[] | undefined;
+        exclude?: string[] | undefined;
+    }>>>;
+    /** Inline named agent definitions, keyed by agent name. */
+    agents: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
+        description: z.ZodOptional<z.ZodString>;
+        prompt: z.ZodString;
+        tools: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        model: z.ZodOptional<z.ZodString>;
+    }, "strip", z.ZodTypeAny, {
+        prompt: string;
+        model?: string | undefined;
+        description?: string | undefined;
+        tools?: string[] | undefined;
+    }, {
+        prompt: string;
+        model?: string | undefined;
+        description?: string | undefined;
+        tools?: string[] | undefined;
+    }>>>;
+}, z.ZodTypeAny, "passthrough">, z.objectInputType<{
+    /** Optional JSON-Schema reference for editor autocompletion. */
+    $schema: z.ZodOptional<z.ZodString>;
+    /** Default gateway model slug for the agent loop (e.g. "anthropic/claude-sonnet-4.6"). */
+    model: z.ZodOptional<z.ZodString>;
+    /** Oxagen platform API base URL (overrides config.json; env still wins). */
+    apiUrl: z.ZodOptional<z.ZodString>;
+    /** Environment variables exported into the session (fills only unset vars; shell wins). */
+    env: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+    /** Allow/deny rules + default mode for the agent's local tools. */
+    permissions: z.ZodOptional<z.ZodObject<{
+        /** Mode applied when no allow/deny rule matches. Default: "default". */
+        defaultMode: z.ZodOptional<z.ZodEnum<["default", "acceptEdits", "deny", "bypassPermissions"]>>;
+        /** Rules that explicitly permit a tool call (escape hatch from deny mode). */
+        allow: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        /** Rules that explicitly block a tool call. Highest priority. */
+        deny: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        /** Global default policy for MCP tool invocations. */
+        defaultMcpPolicy: z.ZodOptional<z.ZodEnum<["allow", "deny", "ask"]>>;
+        /** Per-MCP-server permission overrides, keyed by server name. */
+        mcpServers: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
+            defaultPolicy: z.ZodOptional<z.ZodEnum<["allow", "deny", "ask"]>>;
+            allow: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+            deny: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        }, "strip", z.ZodTypeAny, {
+            allow?: string[] | undefined;
+            deny?: string[] | undefined;
+            defaultPolicy?: "ask" | "allow" | "deny" | undefined;
+        }, {
+            allow?: string[] | undefined;
+            deny?: string[] | undefined;
+            defaultPolicy?: "ask" | "allow" | "deny" | undefined;
+        }>>>;
+    }, "strip", z.ZodTypeAny, {
+        allow?: string[] | undefined;
+        deny?: string[] | undefined;
+        defaultMcpPolicy?: "ask" | "allow" | "deny" | undefined;
+        mcpServers?: Record<string, {
+            allow?: string[] | undefined;
+            deny?: string[] | undefined;
+            defaultPolicy?: "ask" | "allow" | "deny" | undefined;
+        }> | undefined;
+        defaultMode?: "default" | "acceptEdits" | "deny" | "bypassPermissions" | undefined;
+    }, {
+        allow?: string[] | undefined;
+        deny?: string[] | undefined;
+        defaultMcpPolicy?: "ask" | "allow" | "deny" | undefined;
+        mcpServers?: Record<string, {
+            allow?: string[] | undefined;
+            deny?: string[] | undefined;
+            defaultPolicy?: "ask" | "allow" | "deny" | undefined;
+        }> | undefined;
+        defaultMode?: "default" | "acceptEdits" | "deny" | "bypassPermissions" | undefined;
+    }>>;
+    /** Shell commands fired on lifecycle events. */
+    hooks: z.ZodOptional<z.ZodObject<{
+        SessionStart: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            /** Glob over the tool name. Omit (or "*") to match every tool. */
+            matcher: z.ZodOptional<z.ZodString>;
+            /** Actions to run when this matcher matches. */
+            hooks: z.ZodArray<z.ZodObject<{
+                /** Only "command" hooks are supported. */
+                type: z.ZodDefault<z.ZodLiteral<"command">>;
+                /** Shell command. Receives the event payload as JSON on stdin. */
+                command: z.ZodString;
+                /** Per-hook timeout in milliseconds (default 60000, max 600000). */
+                timeoutMs: z.ZodOptional<z.ZodNumber>;
+            }, "strip", z.ZodTypeAny, {
+                type: "command";
+                command: string;
+                timeoutMs?: number | undefined;
+            }, {
+                command: string;
+                type?: "command" | undefined;
+                timeoutMs?: number | undefined;
+            }>, "many">;
+        }, "strip", z.ZodTypeAny, {
+            hooks: {
+                type: "command";
+                command: string;
+                timeoutMs?: number | undefined;
+            }[];
+            matcher?: string | undefined;
+        }, {
+            hooks: {
+                command: string;
+                type?: "command" | undefined;
+                timeoutMs?: number | undefined;
+            }[];
+            matcher?: string | undefined;
+        }>, "many">>;
+        PreToolUse: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            /** Glob over the tool name. Omit (or "*") to match every tool. */
+            matcher: z.ZodOptional<z.ZodString>;
+            /** Actions to run when this matcher matches. */
+            hooks: z.ZodArray<z.ZodObject<{
+                /** Only "command" hooks are supported. */
+                type: z.ZodDefault<z.ZodLiteral<"command">>;
+                /** Shell command. Receives the event payload as JSON on stdin. */
+                command: z.ZodString;
+                /** Per-hook timeout in milliseconds (default 60000, max 600000). */
+                timeoutMs: z.ZodOptional<z.ZodNumber>;
+            }, "strip", z.ZodTypeAny, {
+                type: "command";
+                command: string;
+                timeoutMs?: number | undefined;
+            }, {
+                command: string;
+                type?: "command" | undefined;
+                timeoutMs?: number | undefined;
+            }>, "many">;
+        }, "strip", z.ZodTypeAny, {
+            hooks: {
+                type: "command";
+                command: string;
+                timeoutMs?: number | undefined;
+            }[];
+            matcher?: string | undefined;
+        }, {
+            hooks: {
+                command: string;
+                type?: "command" | undefined;
+                timeoutMs?: number | undefined;
+            }[];
+            matcher?: string | undefined;
+        }>, "many">>;
+        PostToolUse: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            /** Glob over the tool name. Omit (or "*") to match every tool. */
+            matcher: z.ZodOptional<z.ZodString>;
+            /** Actions to run when this matcher matches. */
+            hooks: z.ZodArray<z.ZodObject<{
+                /** Only "command" hooks are supported. */
+                type: z.ZodDefault<z.ZodLiteral<"command">>;
+                /** Shell command. Receives the event payload as JSON on stdin. */
+                command: z.ZodString;
+                /** Per-hook timeout in milliseconds (default 60000, max 600000). */
+                timeoutMs: z.ZodOptional<z.ZodNumber>;
+            }, "strip", z.ZodTypeAny, {
+                type: "command";
+                command: string;
+                timeoutMs?: number | undefined;
+            }, {
+                command: string;
+                type?: "command" | undefined;
+                timeoutMs?: number | undefined;
+            }>, "many">;
+        }, "strip", z.ZodTypeAny, {
+            hooks: {
+                type: "command";
+                command: string;
+                timeoutMs?: number | undefined;
+            }[];
+            matcher?: string | undefined;
+        }, {
+            hooks: {
+                command: string;
+                type?: "command" | undefined;
+                timeoutMs?: number | undefined;
+            }[];
+            matcher?: string | undefined;
+        }>, "many">>;
+    }, "strip", z.ZodTypeAny, {
+        SessionStart?: {
+            hooks: {
+                type: "command";
+                command: string;
+                timeoutMs?: number | undefined;
+            }[];
+            matcher?: string | undefined;
+        }[] | undefined;
+        PreToolUse?: {
+            hooks: {
+                type: "command";
+                command: string;
+                timeoutMs?: number | undefined;
+            }[];
+            matcher?: string | undefined;
+        }[] | undefined;
+        PostToolUse?: {
+            hooks: {
+                type: "command";
+                command: string;
+                timeoutMs?: number | undefined;
+            }[];
+            matcher?: string | undefined;
+        }[] | undefined;
+    }, {
+        SessionStart?: {
+            hooks: {
+                command: string;
+                type?: "command" | undefined;
+                timeoutMs?: number | undefined;
+            }[];
+            matcher?: string | undefined;
+        }[] | undefined;
+        PreToolUse?: {
+            hooks: {
+                command: string;
+                type?: "command" | undefined;
+                timeoutMs?: number | undefined;
+            }[];
+            matcher?: string | undefined;
+        }[] | undefined;
+        PostToolUse?: {
+            hooks: {
+                command: string;
+                type?: "command" | undefined;
+                timeoutMs?: number | undefined;
+            }[];
+            matcher?: string | undefined;
+        }[] | undefined;
+    }>>;
+    /** External MCP server definitions, keyed by name. */
+    mcpServers: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodDiscriminatedUnion<"transport", [z.ZodObject<{
+        transport: z.ZodLiteral<"streamable-http">;
+        url: z.ZodString;
+        auth: z.ZodDefault<z.ZodEnum<["oauth", "bearer", "header", "none"]>>;
+        oauthServerUrl: z.ZodOptional<z.ZodString>;
+        scopes: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        envToken: z.ZodOptional<z.ZodString>;
+        headers: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+        env: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+        disabled: z.ZodOptional<z.ZodBoolean>;
+    }, "strip", z.ZodTypeAny, {
+        transport: "streamable-http";
+        url: string;
+        auth: "none" | "oauth" | "bearer" | "header";
+        headers?: Record<string, string> | undefined;
+        oauthServerUrl?: string | undefined;
+        scopes?: string[] | undefined;
+        envToken?: string | undefined;
+        env?: Record<string, string> | undefined;
+        disabled?: boolean | undefined;
+    }, {
+        transport: "streamable-http";
+        url: string;
+        headers?: Record<string, string> | undefined;
+        auth?: "none" | "oauth" | "bearer" | "header" | undefined;
+        oauthServerUrl?: string | undefined;
+        scopes?: string[] | undefined;
+        envToken?: string | undefined;
+        env?: Record<string, string> | undefined;
+        disabled?: boolean | undefined;
+    }>, z.ZodObject<{
+        transport: z.ZodLiteral<"sse">;
+        url: z.ZodString;
+        auth: z.ZodDefault<z.ZodEnum<["oauth", "bearer", "header", "none"]>>;
+        oauthServerUrl: z.ZodOptional<z.ZodString>;
+        scopes: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        envToken: z.ZodOptional<z.ZodString>;
+        headers: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+        env: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+        disabled: z.ZodOptional<z.ZodBoolean>;
+    }, "strip", z.ZodTypeAny, {
+        transport: "sse";
+        url: string;
+        auth: "none" | "oauth" | "bearer" | "header";
+        headers?: Record<string, string> | undefined;
+        oauthServerUrl?: string | undefined;
+        scopes?: string[] | undefined;
+        envToken?: string | undefined;
+        env?: Record<string, string> | undefined;
+        disabled?: boolean | undefined;
+    }, {
+        transport: "sse";
+        url: string;
+        headers?: Record<string, string> | undefined;
+        auth?: "none" | "oauth" | "bearer" | "header" | undefined;
+        oauthServerUrl?: string | undefined;
+        scopes?: string[] | undefined;
+        envToken?: string | undefined;
+        env?: Record<string, string> | undefined;
+        disabled?: boolean | undefined;
+    }>, z.ZodObject<{
+        transport: z.ZodLiteral<"stdio">;
+        command: z.ZodString;
+        args: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+        env: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+        cwd: z.ZodOptional<z.ZodString>;
+        disabled: z.ZodOptional<z.ZodBoolean>;
+    }, "strip", z.ZodTypeAny, {
+        args: string[];
+        command: string;
+        transport: "stdio";
+        cwd?: string | undefined;
+        env?: Record<string, string> | undefined;
+        disabled?: boolean | undefined;
+    }, {
+        command: string;
+        transport: "stdio";
+        cwd?: string | undefined;
+        args?: string[] | undefined;
+        env?: Record<string, string> | undefined;
+        disabled?: boolean | undefined;
+    }>, z.ZodObject<{
+        transport: z.ZodLiteral<"websocket">;
+        url: z.ZodString;
+        auth: z.ZodDefault<z.ZodEnum<["bearer", "header", "none"]>>;
+        envToken: z.ZodOptional<z.ZodString>;
+        headers: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+        env: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+        disabled: z.ZodOptional<z.ZodBoolean>;
+    }, "strip", z.ZodTypeAny, {
+        transport: "websocket";
+        url: string;
+        auth: "none" | "bearer" | "header";
+        headers?: Record<string, string> | undefined;
+        envToken?: string | undefined;
+        env?: Record<string, string> | undefined;
+        disabled?: boolean | undefined;
+    }, {
+        transport: "websocket";
+        url: string;
+        headers?: Record<string, string> | undefined;
+        auth?: "none" | "bearer" | "header" | undefined;
+        envToken?: string | undefined;
+        env?: Record<string, string> | undefined;
+        disabled?: boolean | undefined;
+    }>]>>>;
+    /** Per-MCP-server tool visibility, keyed by server name. */
+    toolVisibility: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
+        include: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        exclude: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    }, "strip", z.ZodTypeAny, {
+        include?: string[] | undefined;
+        exclude?: string[] | undefined;
+    }, {
+        include?: string[] | undefined;
+        exclude?: string[] | undefined;
+    }>>>;
+    /** Inline named agent definitions, keyed by agent name. */
+    agents: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
+        description: z.ZodOptional<z.ZodString>;
+        prompt: z.ZodString;
+        tools: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        model: z.ZodOptional<z.ZodString>;
+    }, "strip", z.ZodTypeAny, {
+        prompt: string;
+        model?: string | undefined;
+        description?: string | undefined;
+        tools?: string[] | undefined;
+    }, {
+        prompt: string;
+        model?: string | undefined;
+        description?: string | undefined;
+        tools?: string[] | undefined;
+    }>>>;
+}, z.ZodTypeAny, "passthrough">>;
+export type OxagenSettings = z.infer<typeof oxagenSettingsSchema>;
+//# sourceMappingURL=schema.d.ts.map