codex-configurator 0.2.3 → 0.2.4

package/src/reference/config-reference.json

@@ -1,35 +1,61 @@
 {
   "source": {
     "url": "https://developers.openai.com/codex/config-reference/",
-    "fetched_at_utc": "2026-02-18T23:29:43.124Z"
+    "fetched_at_utc": "2026-02-25T19:25:09.285Z"
   },
   "documents": [
     {
       "id": "config.toml",
-      "option_count": 151,
+      "option_count": 167,
       "sections": [
         {
           "name": "agents",
-          "option_count": 3,
+          "option_count": 4,
           "keys": [
-            "agents.max_threads",
+            "agents.<name>.config_file",
             "agents.<name>.description",
-            "agents.<name>.config_file"
+            "agents.max_depth",
+            "agents.max_threads"
           ]
         },
         {
-          "name": "approval_policy",
+          "name": "allow_login_shell",
           "option_count": 1,
           "keys": [
-            "approval_policy"
+            "allow_login_shell"
+          ]
+        },
+        {
+          "name": "approval_policy",
+          "option_count": 4,
+          "keys": [
+            "approval_policy",
+            "approval_policy.reject.mcp_elicitations",
+            "approval_policy.reject.rules",
+            "approval_policy.reject.sandbox_approval"
           ]
         },
         {
           "name": "apps",
-          "option_count": 2,
+          "option_count": 10,
           "keys": [
+            "apps._default.destructive_enabled",
+            "apps._default.enabled",
+            "apps._default.open_world_enabled",
+            "apps.<id>.default_tools_approval_mode",
+            "apps.<id>.default_tools_enabled",
+            "apps.<id>.destructive_enabled",
             "apps.<id>.enabled",
-            "apps.<id>.disabled_reason"
+            "apps.<id>.open_world_enabled",
+            "apps.<id>.tools.<tool>.approval_mode",
+            "apps.<id>.tools.<tool>.enabled"
+          ]
+        },
+        {
+          "name": "background_terminal_max_timeout",
+          "option_count": 1,
+          "keys": [
+            "background_terminal_max_timeout"
           ]
         },
         {
@@ -97,29 +123,27 @@
         },
         {
           "name": "features",
-          "option_count": 21,
+          "option_count": 19,
           "keys": [
+            "features.apply_patch_freeform",
             "features.apps",
             "features.apps_mcp_gateway",
-            "features.unified_exec",
-            "features.shell_snapshot",
-            "features.apply_patch_freeform",
+            "features.child_agents_md",
+            "features.collaboration_modes",
             "features.multi_agent",
             "features.personality",
-            "features.web_search",
-            "features.web_search_cached",
-            "features.web_search_request",
-            "features.shell_tool",
+            "features.powershell_utf8",
+            "features.remote_models",
             "features.request_rule",
+            "features.runtime_metrics",
             "features.search_tool",
-            "features.collaboration_modes",
+            "features.shell_snapshot",
+            "features.shell_tool",
+            "features.unified_exec",
             "features.use_linux_sandbox_bwrap",
-            "features.experimental_windows_sandbox",
-            "features.elevated_windows_sandbox",
-            "features.remote_models",
-            "features.runtime_metrics",
-            "features.powershell_utf8",
-            "features.child_agents_md"
+            "features.web_search",
+            "features.web_search_cached",
+            "features.web_search_request"
           ]
         },
         {
@@ -161,8 +185,8 @@
           "name": "history",
           "option_count": 2,
           "keys": [
-            "history.persistence",
-            "history.max_bytes"
+            "history.max_bytes",
+            "history.persistence"
           ]
         },
         {
@@ -193,6 +217,13 @@
             "mcp_oauth_callback_port"
           ]
         },
+        {
+          "name": "mcp_oauth_callback_url",
+          "option_count": 1,
+          "keys": [
+            "mcp_oauth_callback_url"
+          ]
+        },
         {
           "name": "mcp_oauth_credentials_store",
           "option_count": 1,
@@ -204,22 +235,22 @@
           "name": "mcp_servers",
           "option_count": 16,
           "keys": [
-            "mcp_servers.<id>.command",
             "mcp_servers.<id>.args",
+            "mcp_servers.<id>.bearer_token_env_var",
+            "mcp_servers.<id>.command",
+            "mcp_servers.<id>.cwd",
+            "mcp_servers.<id>.disabled_tools",
+            "mcp_servers.<id>.enabled",
+            "mcp_servers.<id>.enabled_tools",
             "mcp_servers.<id>.env",
+            "mcp_servers.<id>.env_http_headers",
             "mcp_servers.<id>.env_vars",
-            "mcp_servers.<id>.cwd",
-            "mcp_servers.<id>.url",
-            "mcp_servers.<id>.bearer_token_env_var",
             "mcp_servers.<id>.http_headers",
-            "mcp_servers.<id>.env_http_headers",
-            "mcp_servers.<id>.enabled",
             "mcp_servers.<id>.required",
-            "mcp_servers.<id>.startup_timeout_sec",
             "mcp_servers.<id>.startup_timeout_ms",
+            "mcp_servers.<id>.startup_timeout_sec",
             "mcp_servers.<id>.tool_timeout_sec",
-            "mcp_servers.<id>.enabled_tools",
-            "mcp_servers.<id>.disabled_tools"
+            "mcp_servers.<id>.url"
           ]
         },
         {
@@ -236,6 +267,13 @@
             "model_auto_compact_token_limit"
           ]
         },
+        {
+          "name": "model_catalog_json",
+          "option_count": 1,
+          "keys": [
+            "model_catalog_json"
+          ]
+        },
         {
           "name": "model_context_window",
           "option_count": 1,
@@ -261,19 +299,19 @@
           "name": "model_providers",
           "option_count": 13,
           "keys": [
-            "model_providers.<id>.name",
             "model_providers.<id>.base_url",
+            "model_providers.<id>.env_http_headers",
             "model_providers.<id>.env_key",
             "model_providers.<id>.env_key_instructions",
             "model_providers.<id>.experimental_bearer_token",
-            "model_providers.<id>.requires_openai_auth",
-            "model_providers.<id>.wire_api",
-            "model_providers.<id>.query_params",
             "model_providers.<id>.http_headers",
-            "model_providers.<id>.env_http_headers",
+            "model_providers.<id>.name",
+            "model_providers.<id>.query_params",
             "model_providers.<id>.request_max_retries",
+            "model_providers.<id>.requires_openai_auth",
+            "model_providers.<id>.stream_idle_timeout_ms",
             "model_providers.<id>.stream_max_retries",
-            "model_providers.<id>.stream_idle_timeout_ms"
+            "model_providers.<id>.wire_api"
           ]
         },
         {
@@ -309,10 +347,10 @@
           "option_count": 6,
           "keys": [
             "notice.hide_full_access_warning",
-            "notice.hide_world_writable_warning",
-            "notice.hide_rate_limit_model_nudge",
-            "notice.hide_gpt5_1_migration_prompt",
             "notice.hide_gpt-5.1-codex-max_migration_prompt",
+            "notice.hide_gpt5_1_migration_prompt",
+            "notice.hide_rate_limit_model_nudge",
+            "notice.hide_world_writable_warning",
             "notice.model_migrations"
           ]
         },
@@ -336,17 +374,17 @@
           "keys": [
             "otel.environment",
             "otel.exporter",
-            "otel.trace_exporter",
-            "otel.log_user_prompt",
             "otel.exporter.<id>.endpoint",
-            "otel.exporter.<id>.protocol",
             "otel.exporter.<id>.headers",
-            "otel.trace_exporter.<id>.endpoint",
-            "otel.trace_exporter.<id>.protocol",
-            "otel.trace_exporter.<id>.headers",
+            "otel.exporter.<id>.protocol",
             "otel.exporter.<id>.tls.ca-certificate",
             "otel.exporter.<id>.tls.client-certificate",
             "otel.exporter.<id>.tls.client-private-key",
+            "otel.log_user_prompt",
+            "otel.trace_exporter",
+            "otel.trace_exporter.<id>.endpoint",
+            "otel.trace_exporter.<id>.headers",
+            "otel.trace_exporter.<id>.protocol",
             "otel.trace_exporter.<id>.tls.ca-certificate",
             "otel.trace_exporter.<id>.tls.client-certificate",
             "otel.trace_exporter.<id>.tls.client-private-key"
@@ -368,15 +406,16 @@
         },
         {
           "name": "profiles",
-          "option_count": 7,
+          "option_count": 8,
           "keys": [
             "profiles.<name>.*",
+            "profiles.<name>.experimental_use_freeform_apply_patch",
+            "profiles.<name>.experimental_use_unified_exec_tool",
             "profiles.<name>.include_apply_patch_tool",
-            "profiles.<name>.web_search",
+            "profiles.<name>.model_catalog_json",
+            "profiles.<name>.oss_provider",
             "profiles.<name>.personality",
-            "profiles.<name>.experimental_use_unified_exec_tool",
-            "profiles.<name>.experimental_use_freeform_apply_patch",
-            "profiles.<name>.oss_provider"
+            "profiles.<name>.web_search"
           ]
         },
         {
@@ -425,22 +464,22 @@
           "name": "sandbox_workspace_write",
           "option_count": 4,
           "keys": [
-            "sandbox_workspace_write.writable_roots",
-            "sandbox_workspace_write.network_access",
+            "sandbox_workspace_write.exclude_slash_tmp",
             "sandbox_workspace_write.exclude_tmpdir_env_var",
-            "sandbox_workspace_write.exclude_slash_tmp"
+            "sandbox_workspace_write.network_access",
+            "sandbox_workspace_write.writable_roots"
           ]
         },
         {
           "name": "shell_environment_policy",
           "option_count": 6,
           "keys": [
-            "shell_environment_policy.inherit",
-            "shell_environment_policy.ignore_default_excludes",
             "shell_environment_policy.exclude",
+            "shell_environment_policy.experimental_use_profile",
+            "shell_environment_policy.ignore_default_excludes",
             "shell_environment_policy.include_only",
-            "shell_environment_policy.set",
-            "shell_environment_policy.experimental_use_profile"
+            "shell_environment_policy.inherit",
+            "shell_environment_policy.set"
           ]
         },
         {
@@ -455,8 +494,8 @@
           "option_count": 3,
           "keys": [
             "skills.config",
-            "skills.config.<index>.path",
-            "skills.config.<index>.enabled"
+            "skills.config.<index>.enabled",
+            "skills.config.<index>.path"
           ]
         },
         {
@@ -485,10 +524,10 @@
           "option_count": 7,
           "keys": [
             "tui",
-            "tui.notifications",
-            "tui.notification_method",
-            "tui.animations",
             "tui.alternate_screen",
+            "tui.animations",
+            "tui.notification_method",
+            "tui.notifications",
             "tui.show_tooltips",
             "tui.status_line"
           ]
@@ -500,6 +539,13 @@
             "web_search"
           ]
         },
+        {
+          "name": "windows",
+          "option_count": 1,
+          "keys": [
+            "windows.sandbox"
+          ]
+        },
         {
           "name": "windows_wsl_setup_acknowledged",
           "option_count": 1,
@@ -516,18 +562,11 @@
           ],
           "top_level": "model",
           "type": "string",
-          "enum_values": [
-            "gpt-5.3-codex",
-            "gpt-5.3-codex-spark",
-            "gpt-5.2-codex",
-            "gpt-5.1-codex-max",
-            "gpt-5.2",
-            "gpt-5.1-codex-mini"
-          ],
+          "enum_values": [],
           "description": "Model to use (e.g., `gpt-5-codex`).",
           "deprecated": false,
           "ui": {
-            "control": "select"
+            "control": "text"
           }
         },
         {
@@ -569,7 +608,7 @@
           "description": "Context window tokens available to the active model.",
           "deprecated": false,
           "ui": {
-            "control": "number"
+            "control": "text"
           }
         },
         {
@@ -583,7 +622,21 @@
           "description": "Token threshold that triggers automatic history compaction (unset uses model defaults).",
           "deprecated": false,
           "ui": {
-            "control": "number"
+            "control": "text"
+          }
+        },
+        {
+          "key": "model_catalog_json",
+          "key_path": [
+            "model_catalog_json"
+          ],
+          "top_level": "model_catalog_json",
+          "type": "string (path)",
+          "enum_values": [],
+          "description": "Optional path to a JSON model catalog loaded on startup. Profile-level `profiles.<name>.model_catalog_json` can override this per profile.",
+          "deprecated": false,
+          "ui": {
+            "control": "text"
           }
         },
         {
@@ -609,18 +662,80 @@
             "approval_policy"
           ],
           "top_level": "approval_policy",
-          "type": "untrusted | on-request | never",
+          "type": "untrusted | on-request | never | { reject = { sandbox_approval = bool, rules = bool, mcp_elicitations = bool } }",
           "enum_values": [
             "untrusted",
             "on-request",
             "never"
           ],
-          "description": "Controls when Codex pauses for approval before executing commands. `on-failure` is deprecated; use `on-request` for interactive runs or `never` for non-interactive runs.",
-          "deprecated": true,
+          "description": "Controls when Codex pauses for approval before executing commands. You can also use `approval_policy = { reject = { ... } }` to auto-reject specific prompt categories while keeping other prompts interactive. `on-failure` is deprecated; use `on-request` for interactive runs or `never` for non-interactive runs.",
+          "deprecated": false,
           "ui": {
             "control": "select"
           }
         },
+        {
+          "key": "approval_policy.reject.sandbox_approval",
+          "key_path": [
+            "approval_policy",
+            "reject",
+            "sandbox_approval"
+          ],
+          "top_level": "approval_policy",
+          "type": "boolean",
+          "enum_values": [],
+          "description": "When `true`, sandbox escalation approval prompts are auto-rejected.",
+          "deprecated": false,
+          "ui": {
+            "control": "text"
+          }
+        },
+        {
+          "key": "approval_policy.reject.rules",
+          "key_path": [
+            "approval_policy",
+            "reject",
+            "rules"
+          ],
+          "top_level": "approval_policy",
+          "type": "boolean",
+          "enum_values": [],
+          "description": "When `true`, approvals triggered by execpolicy `prompt` rules are auto-rejected.",
+          "deprecated": false,
+          "ui": {
+            "control": "text"
+          }
+        },
+        {
+          "key": "approval_policy.reject.mcp_elicitations",
+          "key_path": [
+            "approval_policy",
+            "reject",
+            "mcp_elicitations"
+          ],
+          "top_level": "approval_policy",
+          "type": "boolean",
+          "enum_values": [],
+          "description": "When `true`, MCP elicitation prompts are auto-rejected instead of shown to the user.",
+          "deprecated": false,
+          "ui": {
+            "control": "text"
+          }
+        },
+        {
+          "key": "allow_login_shell",
+          "key_path": [
+            "allow_login_shell"
+          ],
+          "top_level": "allow_login_shell",
+          "type": "boolean",
+          "enum_values": [],
+          "description": "Allow shell-based tools to use login-shell semantics. Defaults to `true`; when `false`, `login = true` requests are rejected and omitted `login` defaults to non-login shells.",
+          "deprecated": false,
+          "ui": {
+            "control": "text"
+          }
+        },
         {
           "key": "sandbox_mode",
           "key_path": [
@@ -666,7 +781,7 @@
           "description": "Allow outbound network access inside the workspace-write sandbox.",
           "deprecated": false,
           "ui": {
-            "control": "toggle"
+            "control": "text"
           }
         },
         {
@@ -681,7 +796,7 @@
           "description": "Exclude `$TMPDIR` from writable roots in workspace-write mode.",
           "deprecated": false,
           "ui": {
-            "control": "toggle"
+            "control": "text"
           }
         },
         {
@@ -696,7 +811,25 @@
           "description": "Exclude `/tmp` from writable roots in workspace-write mode.",
           "deprecated": false,
           "ui": {
-            "control": "toggle"
+            "control": "text"
+          }
+        },
+        {
+          "key": "windows.sandbox",
+          "key_path": [
+            "windows",
+            "sandbox"
+          ],
+          "top_level": "windows",
+          "type": "unelevated | elevated",
+          "enum_values": [
+            "unelevated",
+            "elevated"
+          ],
+          "description": "Windows-only native sandbox mode when running Codex natively on Windows.",
+          "deprecated": false,
+          "ui": {
+            "control": "select"
           }
         },
         {
@@ -724,7 +857,7 @@
           "description": "Check for Codex updates on startup (set to false only when updates are centrally managed).",
           "deprecated": false,
           "ui": {
-            "control": "toggle"
+            "control": "text"
           }
         },
         {
@@ -739,7 +872,7 @@
           "description": "Enable feedback submission via `/feedback` across Codex surfaces (default: true).",
           "deprecated": false,
           "ui": {
-            "control": "toggle"
+            "control": "text"
           }
         },
         {
@@ -781,7 +914,7 @@
           "description": "Directory where Codex writes log files (for example `codex-tui.log`); defaults to `$CODEX_HOME/log`.",
           "deprecated": false,
           "ui": {
-            "control": "path"
+            "control": "text"
           }
         },
         {
@@ -809,7 +942,7 @@
           "description": "Replacement for built-in instructions instead of `AGENTS.md`.",
           "deprecated": false,
           "ui": {
-            "control": "path"
+            "control": "text"
           }
         },
         {
@@ -841,7 +974,7 @@
           "description": "Load the compaction prompt override from a file (experimental).",
           "deprecated": false,
           "ui": {
-            "control": "path"
+            "control": "text"
           }
         },
         {
@@ -873,7 +1006,7 @@
           "description": "Path to a skill folder containing `SKILL.md`.",
           "deprecated": false,
           "ui": {
-            "control": "path"
+            "control": "text"
           }
         },
         {
@@ -890,7 +1023,7 @@
           "description": "Enable or disable the referenced skill.",
           "deprecated": false,
           "ui": {
-            "control": "toggle"
+            "control": "text"
           }
         },
         {
@@ -906,120 +1039,257 @@
           "description": "Enable or disable a specific app/connector by id (default: true).",
           "deprecated": false,
           "ui": {
-            "control": "toggle"
+            "control": "text"
           }
         },
         {
-          "key": "apps.<id>.disabled_reason",
+          "key": "apps._default.enabled",
           "key_path": [
             "apps",
-            "<id>",
-            "disabled_reason"
+            "_default",
+            "enabled"
           ],
           "top_level": "apps",
-          "type": "unknown | user",
-          "enum_values": [
-            "unknown",
-            "user"
-          ],
-          "description": "Optional reason attached when an app/connector is disabled.",
+          "type": "boolean",
+          "enum_values": [],
+          "description": "Default app enabled state for all apps unless overridden per app.",
           "deprecated": false,
           "ui": {
-            "control": "select"
+            "control": "text"
           }
         },
         {
-          "key": "features.apps",
+          "key": "apps._default.destructive_enabled",
           "key_path": [
-            "features",
-            "apps"
+            "apps",
+            "_default",
+            "destructive_enabled"
           ],
-          "top_level": "features",
+          "top_level": "apps",
           "type": "boolean",
           "enum_values": [],
-          "description": "Enable ChatGPT Apps/connectors support (experimental).",
+          "description": "Default allow/deny for app tools with `destructive_hint = true`.",
           "deprecated": false,
           "ui": {
-            "control": "toggle"
+            "control": "text"
           }
         },
         {
-          "key": "features.apps_mcp_gateway",
+          "key": "apps._default.open_world_enabled",
           "key_path": [
-            "features",
-            "apps_mcp_gateway"
+            "apps",
+            "_default",
+            "open_world_enabled"
           ],
-          "top_level": "features",
+          "top_level": "apps",
           "type": "boolean",
           "enum_values": [],
-          "description": "Route Apps MCP calls through the OpenAI connectors MCP gateway (`https://api.openai.com/v1/connectors/mcp/`) instead of legacy routing (experimental).",
+          "description": "Default allow/deny for app tools with `open_world_hint = true`.",
           "deprecated": false,
           "ui": {
-            "control": "toggle"
+            "control": "text"
           }
         },
         {
-          "key": "mcp_servers.<id>.command",
+          "key": "apps.<id>.destructive_enabled",
           "key_path": [
-            "mcp_servers",
+            "apps",
             "<id>",
-            "command"
+            "destructive_enabled"
           ],
-          "top_level": "mcp_servers",
-          "type": "string",
+          "top_level": "apps",
+          "type": "boolean",
           "enum_values": [],
-          "description": "Launcher command for an MCP stdio server.",
+          "description": "Allow or block tools in this app that advertise `destructive_hint = true`.",
           "deprecated": false,
           "ui": {
             "control": "text"
           }
         },
         {
-          "key": "mcp_servers.<id>.args",
+          "key": "apps.<id>.open_world_enabled",
           "key_path": [
-            "mcp_servers",
+            "apps",
             "<id>",
-            "args"
+            "open_world_enabled"
           ],
-          "top_level": "mcp_servers",
-          "type": "array<string>",
+          "top_level": "apps",
+          "type": "boolean",
           "enum_values": [],
-          "description": "Arguments passed to the MCP stdio server command.",
+          "description": "Allow or block tools in this app that advertise `open_world_hint = true`.",
           "deprecated": false,
           "ui": {
-            "control": "list"
+            "control": "text"
           }
         },
         {
-          "key": "mcp_servers.<id>.env",
+          "key": "apps.<id>.default_tools_enabled",
           "key_path": [
-            "mcp_servers",
+            "apps",
             "<id>",
-            "env"
+            "default_tools_enabled"
           ],
-          "top_level": "mcp_servers",
-          "type": "map<string,string>",
+          "top_level": "apps",
+          "type": "boolean",
           "enum_values": [],
-          "description": "Environment variables forwarded to the MCP stdio server.",
+          "description": "Default enabled state for tools in this app unless a per-tool override exists.",
           "deprecated": false,
           "ui": {
-            "control": "key-value"
+            "control": "text"
           }
         },
         {
-          "key": "mcp_servers.<id>.env_vars",
+          "key": "apps.<id>.default_tools_approval_mode",
           "key_path": [
-            "mcp_servers",
+            "apps",
             "<id>",
-            "env_vars"
+            "default_tools_approval_mode"
           ],
-          "top_level": "mcp_servers",
-          "type": "array<string>",
-          "enum_values": [],
-          "description": "Additional environment variables to whitelist for an MCP stdio server.",
-          "deprecated": false,
-          "ui": {
-            "control": "list"
+          "top_level": "apps",
+          "type": "auto | prompt | approve",
+          "enum_values": [
+            "auto",
+            "prompt",
+            "approve"
+          ],
+          "description": "Default approval behavior for tools in this app unless a per-tool override exists.",
+          "deprecated": false,
+          "ui": {
+            "control": "select"
+          }
+        },
+        {
+          "key": "apps.<id>.tools.<tool>.enabled",
+          "key_path": [
+            "apps",
+            "<id>",
+            "tools",
+            "<tool>",
+            "enabled"
+          ],
+          "top_level": "apps",
+          "type": "boolean",
+          "enum_values": [],
+          "description": "Per-tool enabled override for an app tool (for example `repos/list`).",
+          "deprecated": false,
+          "ui": {
+            "control": "text"
+          }
+        },
+        {
+          "key": "apps.<id>.tools.<tool>.approval_mode",
+          "key_path": [
+            "apps",
+            "<id>",
+            "tools",
+            "<tool>",
+            "approval_mode"
+          ],
+          "top_level": "apps",
+          "type": "auto | prompt | approve",
+          "enum_values": [
+            "auto",
+            "prompt",
+            "approve"
+          ],
+          "description": "Per-tool approval behavior override for a single app tool.",
+          "deprecated": false,
+          "ui": {
+            "control": "select"
+          }
+        },
+        {
+          "key": "features.apps",
+          "key_path": [
+            "features",
+            "apps"
+          ],
+          "top_level": "features",
+          "type": "boolean",
+          "enum_values": [],
+          "description": "Enable ChatGPT Apps/connectors support (experimental).",
+          "deprecated": false,
+          "ui": {
+            "control": "text"
+          }
+        },
+        {
+          "key": "features.apps_mcp_gateway",
+          "key_path": [
+            "features",
+            "apps_mcp_gateway"
+          ],
+          "top_level": "features",
+          "type": "boolean",
+          "enum_values": [],
+          "description": "Route Apps MCP calls through the OpenAI connectors MCP gateway (`https://api.openai.com/v1/connectors/mcp/`) instead of legacy routing (experimental).",
+          "deprecated": false,
+          "ui": {
+            "control": "text"
+          }
+        },
+        {
+          "key": "mcp_servers.<id>.command",
+          "key_path": [
+            "mcp_servers",
+            "<id>",
+            "command"
+          ],
+          "top_level": "mcp_servers",
+          "type": "string",
+          "enum_values": [],
+          "description": "Launcher command for an MCP stdio server.",
+          "deprecated": false,
+          "ui": {
+            "control": "text"
+          }
+        },
+        {
+          "key": "mcp_servers.<id>.args",
+          "key_path": [
+            "mcp_servers",
+            "<id>",
+            "args"
+          ],
+          "top_level": "mcp_servers",
+          "type": "array<string>",
+          "enum_values": [],
+          "description": "Arguments passed to the MCP stdio server command.",
+          "deprecated": false,
+          "ui": {
+            "control": "list"
+          }
+        },
+        {
+          "key": "mcp_servers.<id>.env",
+          "key_path": [
+            "mcp_servers",
+            "<id>",
+            "env"
+          ],
+          "top_level": "mcp_servers",
+          "type": "map<string,string>",
+          "enum_values": [],
+          "description": "Environment variables forwarded to the MCP stdio server.",
+          "deprecated": false,
+          "ui": {
+            "control": "text"
+          }
+        },
+        {
+          "key": "mcp_servers.<id>.env_vars",
+          "key_path": [
+            "mcp_servers",
+            "<id>",
+            "env_vars"
+          ],
+          "top_level": "mcp_servers",
+          "type": "array<string>",
+          "enum_values": [],
+          "description": "Additional environment variables to whitelist for an MCP stdio server.",
+          "deprecated": false,
+          "ui": {
+            "control": "list"
           }
         },
         {
@@ -1083,7 +1353,7 @@
           "description": "Static HTTP headers included with each MCP HTTP request.",
           "deprecated": false,
           "ui": {
-            "control": "key-value"
+            "control": "text"
           }
         },
         {
@@ -1099,7 +1369,7 @@
           "description": "HTTP headers populated from environment variables for an MCP HTTP server.",
           "deprecated": false,
           "ui": {
-            "control": "key-value"
+            "control": "text"
           }
         },
         {
@@ -1115,7 +1385,7 @@
           "description": "Disable an MCP server without removing its configuration.",
           "deprecated": false,
           "ui": {
-            "control": "toggle"
+            "control": "text"
           }
         },
         {
@@ -1131,7 +1401,7 @@
           "description": "When true, fail startup/resume if this enabled MCP server cannot initialize.",
           "deprecated": false,
           "ui": {
-            "control": "toggle"
+            "control": "text"
           }
         },
         {
@@ -1147,7 +1417,7 @@
           "description": "Override the default 10s startup timeout for an MCP server.",
           "deprecated": false,
           "ui": {
-            "control": "number"
+            "control": "text"
           }
         },
         {
@@ -1163,7 +1433,7 @@
           "description": "Alias for `startup_timeout_sec` in milliseconds.",
           "deprecated": false,
           "ui": {
-            "control": "number"
+            "control": "text"
           }
         },
         {
@@ -1179,7 +1449,7 @@
           "description": "Override the default 60s per-tool timeout for an MCP server.",
           "deprecated": false,
           "ui": {
-            "control": "number"
+            "control": "text"
           }
         },
         {
@@ -1226,7 +1496,22 @@
           "description": "Maximum number of agent threads that can be open concurrently.",
           "deprecated": false,
           "ui": {
-            "control": "number"
+            "control": "text"
+          }
+        },
+        {
+          "key": "agents.max_depth",
+          "key_path": [
+            "agents",
+            "max_depth"
+          ],
+          "top_level": "agents",
+          "type": "number",
+          "enum_values": [],
+          "description": "Maximum nesting depth allowed for spawned agent threads (root sessions start at depth 0; default: 1).",
+          "deprecated": false,
+          "ui": {
+            "control": "text"
           }
         },
         {
@@ -1258,7 +1543,7 @@
           "description": "Path to a TOML config layer for that role; relative paths resolve from the config file that declares the role.",
           "deprecated": false,
           "ui": {
-            "control": "path"
+            "control": "text"
           }
         },
         {
@@ -1273,7 +1558,7 @@
           "description": "Use the unified PTY-backed exec tool (beta).",
           "deprecated": false,
           "ui": {
-            "control": "toggle"
+            "control": "text"
           }
         },
         {
@@ -1288,7 +1573,7 @@
           "description": "Snapshot shell environment to speed up repeated commands (beta).",
           "deprecated": false,
           "ui": {
-            "control": "toggle"
+            "control": "text"
           }
         },
         {
@@ -1303,7 +1588,7 @@
           "description": "Expose the freeform `apply_patch` tool (experimental).",
           "deprecated": false,
           "ui": {
-            "control": "toggle"
+            "control": "text"
           }
         },
         {
@@ -1318,7 +1603,7 @@
           "description": "Enable multi-agent collaboration tools (`spawn_agent`, `send_input`, `resume_agent`, `wait`, and `close_agent`) (experimental; off by default).",
           "deprecated": false,
           "ui": {
-            "control": "toggle"
+            "control": "text"
           }
         },
         {
@@ -1333,7 +1618,7 @@
           "description": "Enable personality selection controls (stable; on by default).",
           "deprecated": false,
           "ui": {
-            "control": "toggle"
+            "control": "text"
           }
         },
         {
@@ -1346,9 +1631,9 @@
           "type": "boolean",
           "enum_values": [],
           "description": "Deprecated legacy toggle; prefer the top-level `web_search` setting.",
-          "deprecated": true,
+          "deprecated": false,
           "ui": {
-            "control": "toggle"
+            "control": "text"
           }
         },
         {
@@ -1361,9 +1646,9 @@
           "type": "boolean",
           "enum_values": [],
           "description": "Deprecated legacy toggle. When `web_search` is unset, true maps to `web_search = \"cached\"`.",
-          "deprecated": true,
+          "deprecated": false,
           "ui": {
-            "control": "toggle"
+            "control": "text"
           }
         },
         {
@@ -1376,9 +1661,9 @@
           "type": "boolean",
           "enum_values": [],
           "description": "Deprecated legacy toggle. When `web_search` is unset, true maps to `web_search = \"live\"`.",
-          "deprecated": true,
+          "deprecated": false,
           "ui": {
-            "control": "toggle"
+            "control": "text"
           }
         },
         {
@@ -1393,7 +1678,7 @@
           "description": "Enable the default `shell` tool for running commands (stable; on by default).",
           "deprecated": false,
           "ui": {
-            "control": "toggle"
+            "control": "text"
           }
         },
         {
@@ -1408,7 +1693,7 @@
           "description": "Enable Smart approvals (`prefix_rule` suggestions on escalation requests; stable; on by default).",
           "deprecated": false,
           "ui": {
-            "control": "toggle"
+            "control": "text"
           }
         },
         {
@@ -1423,7 +1708,7 @@
           "description": "Enable `search_tool_bm25` for Apps tool discovery before invoking app MCP tools (experimental).",
           "deprecated": false,
           "ui": {
-            "control": "toggle"
+            "control": "text"
           }
         },
         {
@@ -1438,7 +1723,7 @@
           "description": "Enable collaboration modes such as plan mode (stable; on by default).",
           "deprecated": false,
           "ui": {
-            "control": "toggle"
+            "control": "text"
           }
         },
         {
@@ -1453,37 +1738,7 @@
           "description": "Use the bubblewrap-based Linux sandbox pipeline (experimental; off by default).",
           "deprecated": false,
           "ui": {
-            "control": "toggle"
-          }
-        },
-        {
-          "key": "features.experimental_windows_sandbox",
-          "key_path": [
-            "features",
-            "experimental_windows_sandbox"
-          ],
-          "top_level": "features",
-          "type": "boolean",
-          "enum_values": [],
-          "description": "Run the Windows restricted-token sandbox (experimental).",
-          "deprecated": false,
-          "ui": {
-            "control": "toggle"
-          }
-        },
-        {
-          "key": "features.elevated_windows_sandbox",
-          "key_path": [
-            "features",
-            "elevated_windows_sandbox"
-          ],
-          "top_level": "features",
-          "type": "boolean",
-          "enum_values": [],
-          "description": "Enable the elevated Windows sandbox pipeline (experimental).",
-          "deprecated": false,
-          "ui": {
-            "control": "toggle"
+            "control": "text"
           }
         },
         {
@@ -1498,7 +1753,7 @@
           "description": "Refresh remote model list before showing readiness (experimental).",
           "deprecated": false,
           "ui": {
-            "control": "toggle"
+            "control": "text"
           }
         },
         {
@@ -1513,7 +1768,7 @@
           "description": "Show runtime metrics summary in TUI turn separators (experimental).",
           "deprecated": false,
           "ui": {
-            "control": "toggle"
+            "control": "text"
           }
         },
         {
@@ -1528,7 +1783,7 @@
           "description": "Force PowerShell UTF-8 output (defaults to true).",
           "deprecated": false,
           "ui": {
-            "control": "toggle"
+            "control": "text"
           }
         },
         {
@@ -1543,7 +1798,7 @@
           "description": "Append AGENTS.md scope/precedence guidance even when no AGENTS.md is present (experimental).",
           "deprecated": false,
           "ui": {
-            "control": "toggle"
+            "control": "text"
           }
         },
         {
@@ -1557,7 +1812,7 @@
           "description": "Suppress the warning that appears when under-development feature flags are enabled.",
           "deprecated": false,
           "ui": {
-            "control": "toggle"
+            "control": "text"
           }
         },
         {
@@ -1653,7 +1908,7 @@
           "description": "The provider uses OpenAI authentication (defaults to false).",
           "deprecated": false,
           "ui": {
-            "control": "toggle"
+            "control": "text"
           }
         },
         {
@@ -1688,7 +1943,7 @@
           "description": "Extra query parameters appended to provider requests.",
           "deprecated": false,
           "ui": {
-            "control": "key-value"
+            "control": "text"
           }
         },
         {
@@ -1704,7 +1959,7 @@
           "description": "Static HTTP headers added to provider requests.",
           "deprecated": false,
           "ui": {
-            "control": "key-value"
+            "control": "text"
           }
         },
         {
@@ -1720,7 +1975,7 @@
           "description": "HTTP headers populated from environment variables when present.",
           "deprecated": false,
           "ui": {
-            "control": "key-value"
+            "control": "text"
           }
         },
         {
@@ -1736,7 +1991,7 @@
           "description": "Retry count for HTTP requests to the provider (default: 4).",
           "deprecated": false,
           "ui": {
-            "control": "number"
+            "control": "text"
           }
         },
         {
@@ -1752,7 +2007,7 @@
           "description": "Retry count for SSE streaming interruptions (default: 5).",
           "deprecated": false,
           "ui": {
-            "control": "number"
+            "control": "text"
           }
         },
         {
@@ -1768,7 +2023,7 @@
           "description": "Idle timeout for SSE streams in milliseconds (default: 300000).",
           "deprecated": false,
           "ui": {
-            "control": "number"
+            "control": "text"
           }
         },
         {
@@ -1839,7 +2094,7 @@
           "description": "Force Codex to send or not send reasoning metadata.",
           "deprecated": false,
           "ui": {
-            "control": "toggle"
+            "control": "text"
           }
         },
         {
@@ -1873,7 +2128,7 @@
           "description": "Keep variables containing KEY/SECRET/TOKEN before other filters run.",
           "deprecated": false,
           "ui": {
-            "control": "toggle"
+            "control": "text"
           }
         },
         {
@@ -1918,7 +2173,7 @@
           "description": "Explicit environment overrides injected into every subprocess.",
           "deprecated": false,
           "ui": {
-            "control": "key-value"
+            "control": "text"
           }
         },
         {
@@ -1933,7 +2188,7 @@
           "description": "Use the user shell profile when spawning subprocesses.",
           "deprecated": false,
           "ui": {
-            "control": "toggle"
+            "control": "text"
           }
         },
         {
@@ -1961,7 +2216,7 @@
           "description": "Maximum bytes read from `AGENTS.md` when building project instructions.",
           "deprecated": false,
           "ui": {
-            "control": "number"
+            "control": "text"
           }
         },
         {
@@ -2001,11 +2256,13 @@
           ],
           "top_level": "profiles",
           "type": "various",
-          "enum_values": [],
+          "enum_values": [
+            "various"
+          ],
           "description": "Profile-scoped overrides for any of the supported configuration keys.",
           "deprecated": false,
           "ui": {
-            "control": "text"
+            "control": "select"
           }
         },
         {
@@ -2021,7 +2278,7 @@
           "description": "Legacy name for enabling freeform apply_patch; prefer `[features].apply_patch_freeform`.",
           "deprecated": false,
           "ui": {
-            "control": "toggle"
+            "control": "text"
           }
         },
         {
@@ -2064,6 +2321,22 @@
             "control": "select"
           }
         },
+        {
+          "key": "profiles.<name>.model_catalog_json",
+          "key_path": [
+            "profiles",
+            "<name>",
+            "model_catalog_json"
+          ],
+          "top_level": "profiles",
+          "type": "string (path)",
+          "enum_values": [],
+          "description": "Profile-scoped model catalog JSON path override (applied on startup only; overrides the top-level `model_catalog_json` for that profile).",
+          "deprecated": false,
+          "ui": {
+            "control": "text"
+          }
+        },
         {
           "key": "profiles.<name>.experimental_use_unified_exec_tool",
           "key_path": [
@@ -2077,7 +2350,7 @@
           "description": "Legacy name for enabling unified exec; prefer `[features].unified_exec`.",
           "deprecated": false,
           "ui": {
-            "control": "toggle"
+            "control": "text"
           }
         },
         {
@@ -2093,7 +2366,7 @@
           "description": "Legacy name for enabling freeform apply_patch; prefer `[features].apply_patch_freeform`.",
           "deprecated": false,
           "ui": {
-            "control": "toggle"
+            "control": "text"
           }
         },
         {
@@ -2144,7 +2417,21 @@
           "description": "Token budget for storing individual tool/function outputs in history.",
           "deprecated": false,
           "ui": {
-            "control": "number"
+            "control": "text"
+          }
+        },
+        {
+          "key": "background_terminal_max_timeout",
+          "key_path": [
+            "background_terminal_max_timeout"
+          ],
+          "top_level": "background_terminal_max_timeout",
+          "type": "number",
+          "enum_values": [],
+          "description": "Maximum poll window in milliseconds for empty `write_stdin` polls (background terminal polling). Default: `300000` (5 minutes). Replaces the older `background_terminal_timeout` key.",
+          "deprecated": false,
+          "ui": {
+            "control": "text"
           }
         },
         {
@@ -2159,7 +2446,7 @@
           "description": "If set, caps the history file size in bytes by dropping oldest entries.",
           "deprecated": false,
           "ui": {
-            "control": "number"
+            "control": "text"
           }
         },
         {
@@ -2247,7 +2534,7 @@
           "description": "Opt in to exporting raw user prompts with OpenTelemetry logs.",
           "deprecated": false,
           "ui": {
-            "control": "toggle"
+            "control": "text"
           }
         },
         {
@@ -2301,7 +2588,7 @@
           "description": "Static headers included with OTEL exporter requests.",
           "deprecated": false,
           "ui": {
-            "control": "key-value"
+            "control": "text"
           }
         },
         {
@@ -2355,7 +2642,7 @@
           "description": "Static headers included with OTEL trace exporter requests.",
           "deprecated": false,
           "ui": {
-            "control": "key-value"
+            "control": "text"
           }
         },
         {
@@ -2488,14 +2775,11 @@
           ],
           "top_level": "tui",
           "type": "boolean | array<string>",
-          "enum_values": [
-            "boolean",
-            "array<string>"
-          ],
+          "enum_values": [],
           "description": "Enable TUI notifications; optionally restrict to specific event types.",
           "deprecated": false,
           "ui": {
-            "control": "select"
+            "control": "text"
           }
         },
         {
@@ -2529,7 +2813,7 @@
           "description": "Enable terminal animations (welcome screen, shimmer, spinner) (default: true).",
           "deprecated": false,
           "ui": {
-            "control": "toggle"
+            "control": "text"
           }
         },
         {
@@ -2563,7 +2847,7 @@
           "description": "Show onboarding tooltips in the TUI welcome screen (default: true).",
           "deprecated": false,
           "ui": {
-            "control": "toggle"
+            "control": "text"
           }
         },
         {
@@ -2574,14 +2858,11 @@
           ],
           "top_level": "tui",
           "type": "array<string> | null",
-          "enum_values": [
-            "array<string>",
-            "null"
-          ],
+          "enum_values": [],
           "description": "Ordered list of TUI footer status-line item identifiers. `null` disables the status line.",
           "deprecated": false,
           "ui": {
-            "control": "select"
+            "control": "list"
           }
         },
         {
@@ -2595,7 +2876,7 @@
           "description": "Suppress reasoning events in both the TUI and `codex exec` output.",
           "deprecated": false,
           "ui": {
-            "control": "toggle"
+            "control": "text"
           }
         },
         {
@@ -2608,2424 +2889,11 @@
           "enum_values": [],
           "description": "Surface raw reasoning content when the active model emits it.",
           "deprecated": false,
-          "ui": {
-            "control": "toggle"
-          }
-        },
-        {
-          "key": "disable_paste_burst",
-          "key_path": [
-            "disable_paste_burst"
-          ],
-          "top_level": "disable_paste_burst",
-          "type": "boolean",
-          "enum_values": [],
-          "description": "Disable burst-paste detection in the TUI.",
-          "deprecated": false,
-          "ui": {
-            "control": "toggle"
-          }
-        },
-        {
-          "key": "windows_wsl_setup_acknowledged",
-          "key_path": [
-            "windows_wsl_setup_acknowledged"
-          ],
-          "top_level": "windows_wsl_setup_acknowledged",
-          "type": "boolean",
-          "enum_values": [],
-          "description": "Track Windows onboarding acknowledgement (Windows only).",
-          "deprecated": false,
-          "ui": {
-            "control": "toggle"
-          }
-        },
-        {
-          "key": "chatgpt_base_url",
-          "key_path": [
-            "chatgpt_base_url"
-          ],
-          "top_level": "chatgpt_base_url",
-          "type": "string",
-          "enum_values": [],
-          "description": "Override the base URL used during the ChatGPT login flow.",
-          "deprecated": false,
-          "ui": {
-            "control": "text"
-          }
-        },
-        {
-          "key": "cli_auth_credentials_store",
-          "key_path": [
-            "cli_auth_credentials_store"
-          ],
-          "top_level": "cli_auth_credentials_store",
-          "type": "file | keyring | auto",
-          "enum_values": [
-            "file",
-            "keyring",
-            "auto"
-          ],
-          "description": "Control where the CLI stores cached credentials (file-based auth.json vs OS keychain).",
-          "deprecated": false,
-          "ui": {
-            "control": "select"
-          }
-        },
-        {
-          "key": "mcp_oauth_credentials_store",
-          "key_path": [
-            "mcp_oauth_credentials_store"
-          ],
-          "top_level": "mcp_oauth_credentials_store",
-          "type": "auto | file | keyring",
-          "enum_values": [
-            "auto",
-            "file",
-            "keyring"
-          ],
-          "description": "Preferred store for MCP OAuth credentials.",
-          "deprecated": false,
-          "ui": {
-            "control": "select"
-          }
-        },
-        {
-          "key": "mcp_oauth_callback_port",
-          "key_path": [
-            "mcp_oauth_callback_port"
-          ],
-          "top_level": "mcp_oauth_callback_port",
-          "type": "integer",
-          "enum_values": [],
-          "description": "Optional fixed port for the local HTTP callback server used during MCP OAuth login. When unset, Codex binds to an ephemeral port chosen by the OS.",
-          "deprecated": false,
           "ui": {
             "control": "text"
           }
         },
         {
-          "key": "experimental_use_unified_exec_tool",
-          "key_path": [
-            "experimental_use_unified_exec_tool"
-          ],
-          "top_level": "experimental_use_unified_exec_tool",
-          "type": "boolean",
-          "enum_values": [],
-          "description": "Legacy name for enabling unified exec; prefer `[features].unified_exec` or `codex --enable unified_exec`.",
-          "deprecated": false,
-          "ui": {
-            "control": "toggle"
-          }
-        },
-        {
-          "key": "experimental_use_freeform_apply_patch",
-          "key_path": [
-            "experimental_use_freeform_apply_patch"
-          ],
-          "top_level": "experimental_use_freeform_apply_patch",
-          "type": "boolean",
-          "enum_values": [],
-          "description": "Legacy name for enabling freeform apply_patch; prefer `[features].apply_patch_freeform` or `codex --enable apply_patch_freeform`.",
-          "deprecated": false,
-          "ui": {
-            "control": "toggle"
-          }
-        },
-        {
-          "key": "include_apply_patch_tool",
-          "key_path": [
-            "include_apply_patch_tool"
-          ],
-          "top_level": "include_apply_patch_tool",
-          "type": "boolean",
-          "enum_values": [],
-          "description": "Legacy name for enabling freeform apply_patch; prefer `[features].apply_patch_freeform`.",
-          "deprecated": false,
-          "ui": {
-            "control": "toggle"
-          }
-        },
-        {
-          "key": "tools.web_search",
-          "key_path": [
-            "tools",
-            "web_search"
-          ],
-          "top_level": "tools",
-          "type": "boolean",
-          "enum_values": [],
-          "description": "Deprecated legacy toggle for web search; prefer the top-level `web_search` setting.",
-          "deprecated": true,
-          "ui": {
-            "control": "toggle"
-          }
-        },
-        {
-          "key": "web_search",
-          "key_path": [
-            "web_search"
-          ],
-          "top_level": "web_search",
-          "type": "disabled | cached | live",
-          "enum_values": [
-            "disabled",
-            "cached",
-            "live"
-          ],
-          "description": "Web search mode (default: `\"cached\"`; cached uses an OpenAI-maintained index and does not fetch live pages; if you use `--yolo` or another full access sandbox setting, it defaults to `\"live\"`). Use `\"live\"` to fetch the most recent data from the web, or `\"disabled\"` to remove the tool.",
-          "deprecated": false,
-          "ui": {
-            "control": "select"
-          }
-        },
-        {
-          "key": "projects.<path>.trust_level",
-          "key_path": [
-            "projects",
-            "<path>",
-            "trust_level"
-          ],
-          "top_level": "projects",
-          "type": "trusted | untrusted",
-          "enum_values": [
-            "trusted",
-            "untrusted"
-          ],
-          "description": "Mark a project or worktree as trusted or untrusted (`\"trusted\"` | `\"untrusted\"`). Untrusted projects skip project-scoped `.codex/` layers.",
-          "deprecated": false,
-          "ui": {
-            "control": "select"
-          }
-        },
-        {
-          "key": "notice.hide_full_access_warning",
-          "key_path": [
-            "notice",
-            "hide_full_access_warning"
-          ],
-          "top_level": "notice",
-          "type": "boolean",
-          "enum_values": [],
-          "description": "Track acknowledgement of the full access warning prompt.",
-          "deprecated": false,
-          "ui": {
-            "control": "toggle"
-          }
-        },
-        {
-          "key": "notice.hide_world_writable_warning",
-          "key_path": [
-            "notice",
-            "hide_world_writable_warning"
-          ],
-          "top_level": "notice",
-          "type": "boolean",
-          "enum_values": [],
-          "description": "Track acknowledgement of the Windows world-writable directories warning.",
-          "deprecated": false,
-          "ui": {
-            "control": "toggle"
-          }
-        },
-        {
-          "key": "notice.hide_rate_limit_model_nudge",
-          "key_path": [
-            "notice",
-            "hide_rate_limit_model_nudge"
-          ],
-          "top_level": "notice",
-          "type": "boolean",
-          "enum_values": [],
-          "description": "Track opt-out of the rate limit model switch reminder.",
-          "deprecated": false,
-          "ui": {
-            "control": "toggle"
-          }
-        },
-        {
-          "key": "notice.hide_gpt5_1_migration_prompt",
-          "key_path": [
-            "notice",
-            "hide_gpt5_1_migration_prompt"
-          ],
-          "top_level": "notice",
-          "type": "boolean",
-          "enum_values": [],
-          "description": "Track acknowledgement of the GPT-5.1 migration prompt.",
-          "deprecated": false,
-          "ui": {
-            "control": "toggle"
-          }
-        },
-        {
-          "key": "notice.hide_gpt-5.1-codex-max_migration_prompt",
-          "key_path": [
-            "notice",
-            "hide_gpt-5",
-            "1-codex-max_migration_prompt"
-          ],
-          "top_level": "notice",
-          "type": "boolean",
-          "enum_values": [],
-          "description": "Track acknowledgement of the gpt-5.1-codex-max migration prompt.",
-          "deprecated": false,
-          "ui": {
-            "control": "toggle"
-          }
-        },
-        {
-          "key": "notice.model_migrations",
-          "key_path": [
-            "notice",
-            "model_migrations"
-          ],
-          "top_level": "notice",
-          "type": "map<string,string>",
-          "enum_values": [],
-          "description": "Track acknowledged model migrations as old->new mappings.",
-          "deprecated": false,
-          "ui": {
-            "control": "key-value"
-          }
-        },
-        {
-          "key": "forced_login_method",
-          "key_path": [
-            "forced_login_method"
-          ],
-          "top_level": "forced_login_method",
-          "type": "chatgpt | api",
-          "enum_values": [
-            "chatgpt",
-            "api"
-          ],
-          "description": "Restrict Codex to a specific authentication method.",
-          "deprecated": false,
-          "ui": {
-            "control": "select"
-          }
-        },
-        {
-          "key": "forced_chatgpt_workspace_id",
-          "key_path": [
-            "forced_chatgpt_workspace_id"
-          ],
-          "top_level": "forced_chatgpt_workspace_id",
-          "type": "string (uuid)",
-          "enum_values": [],
-          "description": "Limit ChatGPT logins to a specific workspace identifier.",
-          "deprecated": false,
-          "ui": {
-            "control": "text"
-          }
-        }
-      ],
-      "key_index": {
-        "model": {
-          "key": "model",
-          "key_path": [
-            "model"
-          ],
-          "top_level": "model",
-          "type": "string",
-          "enum_values": [
-            "gpt-5.3-codex",
-            "gpt-5.3-codex-spark",
-            "gpt-5.2-codex",
-            "gpt-5.1-codex-max",
-            "gpt-5.2",
-            "gpt-5.1-codex-mini"
-          ],
-          "description": "Model to use (e.g., `gpt-5-codex`).",
-          "deprecated": false,
-          "ui": {
-            "control": "select"
-          }
-        },
-        "review_model": {
-          "key": "review_model",
-          "key_path": [
-            "review_model"
-          ],
-          "top_level": "review_model",
-          "type": "string",
-          "enum_values": [],
-          "description": "Optional model override used by `/review` (defaults to the current session model).",
-          "deprecated": false,
-          "ui": {
-            "control": "text"
-          }
-        },
-        "model_provider": {
-          "key": "model_provider",
-          "key_path": [
-            "model_provider"
-          ],
-          "top_level": "model_provider",
-          "type": "string",
-          "enum_values": [],
-          "description": "Provider id from `model_providers` (default: `openai`).",
-          "deprecated": false,
-          "ui": {
-            "control": "text"
-          }
-        },
-        "model_context_window": {
-          "key": "model_context_window",
-          "key_path": [
-            "model_context_window"
-          ],
-          "top_level": "model_context_window",
-          "type": "number",
-          "enum_values": [],
-          "description": "Context window tokens available to the active model.",
-          "deprecated": false,
-          "ui": {
-            "control": "number"
-          }
-        },
-        "model_auto_compact_token_limit": {
-          "key": "model_auto_compact_token_limit",
-          "key_path": [
-            "model_auto_compact_token_limit"
-          ],
-          "top_level": "model_auto_compact_token_limit",
-          "type": "number",
-          "enum_values": [],
-          "description": "Token threshold that triggers automatic history compaction (unset uses model defaults).",
-          "deprecated": false,
-          "ui": {
-            "control": "number"
-          }
-        },
-        "oss_provider": {
-          "key": "oss_provider",
-          "key_path": [
-            "oss_provider"
-          ],
-          "top_level": "oss_provider",
-          "type": "lmstudio | ollama",
-          "enum_values": [
-            "lmstudio",
-            "ollama"
-          ],
-          "description": "Default local provider used when running with `--oss` (defaults to prompting if unset).",
-          "deprecated": false,
-          "ui": {
-            "control": "select"
-          }
-        },
-        "approval_policy": {
-          "key": "approval_policy",
-          "key_path": [
-            "approval_policy"
-          ],
-          "top_level": "approval_policy",
-          "type": "untrusted | on-request | never",
-          "enum_values": [
-            "untrusted",
-            "on-request",
-            "never"
-          ],
-          "description": "Controls when Codex pauses for approval before executing commands. `on-failure` is deprecated; use `on-request` for interactive runs or `never` for non-interactive runs.",
-          "deprecated": true,
-          "ui": {
-            "control": "select"
-          }
-        },
-        "sandbox_mode": {
-          "key": "sandbox_mode",
-          "key_path": [
-            "sandbox_mode"
-          ],
-          "top_level": "sandbox_mode",
-          "type": "read-only | workspace-write | danger-full-access",
-          "enum_values": [
-            "read-only",
-            "workspace-write",
-            "danger-full-access"
-          ],
-          "description": "Sandbox policy for filesystem and network access during command execution.",
-          "deprecated": false,
-          "ui": {
-            "control": "select"
-          }
-        },
-        "sandbox_workspace_write.writable_roots": {
-          "key": "sandbox_workspace_write.writable_roots",
-          "key_path": [
-            "sandbox_workspace_write",
-            "writable_roots"
-          ],
-          "top_level": "sandbox_workspace_write",
-          "type": "array<string>",
-          "enum_values": [],
-          "description": "Additional writable roots when `sandbox_mode = \"workspace-write\"`.",
-          "deprecated": false,
-          "ui": {
-            "control": "list"
-          }
-        },
-        "sandbox_workspace_write.network_access": {
-          "key": "sandbox_workspace_write.network_access",
-          "key_path": [
-            "sandbox_workspace_write",
-            "network_access"
-          ],
-          "top_level": "sandbox_workspace_write",
-          "type": "boolean",
-          "enum_values": [],
-          "description": "Allow outbound network access inside the workspace-write sandbox.",
-          "deprecated": false,
-          "ui": {
-            "control": "toggle"
-          }
-        },
-        "sandbox_workspace_write.exclude_tmpdir_env_var": {
-          "key": "sandbox_workspace_write.exclude_tmpdir_env_var",
-          "key_path": [
-            "sandbox_workspace_write",
-            "exclude_tmpdir_env_var"
-          ],
-          "top_level": "sandbox_workspace_write",
-          "type": "boolean",
-          "enum_values": [],
-          "description": "Exclude `$TMPDIR` from writable roots in workspace-write mode.",
-          "deprecated": false,
-          "ui": {
-            "control": "toggle"
-          }
-        },
-        "sandbox_workspace_write.exclude_slash_tmp": {
-          "key": "sandbox_workspace_write.exclude_slash_tmp",
-          "key_path": [
-            "sandbox_workspace_write",
-            "exclude_slash_tmp"
-          ],
-          "top_level": "sandbox_workspace_write",
-          "type": "boolean",
-          "enum_values": [],
-          "description": "Exclude `/tmp` from writable roots in workspace-write mode.",
-          "deprecated": false,
-          "ui": {
-            "control": "toggle"
-          }
-        },
-        "notify": {
-          "key": "notify",
-          "key_path": [
-            "notify"
-          ],
-          "top_level": "notify",
-          "type": "array<string>",
-          "enum_values": [],
-          "description": "Command invoked for notifications; receives a JSON payload from Codex.",
-          "deprecated": false,
-          "ui": {
-            "control": "list"
-          }
-        },
-        "check_for_update_on_startup": {
-          "key": "check_for_update_on_startup",
-          "key_path": [
-            "check_for_update_on_startup"
-          ],
-          "top_level": "check_for_update_on_startup",
-          "type": "boolean",
-          "enum_values": [],
-          "description": "Check for Codex updates on startup (set to false only when updates are centrally managed).",
-          "deprecated": false,
-          "ui": {
-            "control": "toggle"
-          }
-        },
-        "feedback.enabled": {
-          "key": "feedback.enabled",
-          "key_path": [
-            "feedback",
-            "enabled"
-          ],
-          "top_level": "feedback",
-          "type": "boolean",
-          "enum_values": [],
-          "description": "Enable feedback submission via `/feedback` across Codex surfaces (default: true).",
-          "deprecated": false,
-          "ui": {
-            "control": "toggle"
-          }
-        },
-        "instructions": {
-          "key": "instructions",
-          "key_path": [
-            "instructions"
-          ],
-          "top_level": "instructions",
-          "type": "string",
-          "enum_values": [],
-          "description": "Reserved for future use; prefer `model_instructions_file` or `AGENTS.md`.",
-          "deprecated": false,
-          "ui": {
-            "control": "text"
-          }
-        },
-        "developer_instructions": {
-          "key": "developer_instructions",
-          "key_path": [
-            "developer_instructions"
-          ],
-          "top_level": "developer_instructions",
-          "type": "string",
-          "enum_values": [],
-          "description": "Additional developer instructions injected into the session (optional).",
-          "deprecated": false,
-          "ui": {
-            "control": "text"
-          }
-        },
-        "log_dir": {
-          "key": "log_dir",
-          "key_path": [
-            "log_dir"
-          ],
-          "top_level": "log_dir",
-          "type": "string (path)",
-          "enum_values": [],
-          "description": "Directory where Codex writes log files (for example `codex-tui.log`); defaults to `$CODEX_HOME/log`.",
-          "deprecated": false,
-          "ui": {
-            "control": "path"
-          }
-        },
-        "compact_prompt": {
-          "key": "compact_prompt",
-          "key_path": [
-            "compact_prompt"
-          ],
-          "top_level": "compact_prompt",
-          "type": "string",
-          "enum_values": [],
-          "description": "Inline override for the history compaction prompt.",
-          "deprecated": false,
-          "ui": {
-            "control": "text"
-          }
-        },
-        "model_instructions_file": {
-          "key": "model_instructions_file",
-          "key_path": [
-            "model_instructions_file"
-          ],
-          "top_level": "model_instructions_file",
-          "type": "string (path)",
-          "enum_values": [],
-          "description": "Replacement for built-in instructions instead of `AGENTS.md`.",
-          "deprecated": false,
-          "ui": {
-            "control": "path"
-          }
-        },
-        "personality": {
-          "key": "personality",
-          "key_path": [
-            "personality"
-          ],
-          "top_level": "personality",
-          "type": "none | friendly | pragmatic",
-          "enum_values": [
-            "none",
-            "friendly",
-            "pragmatic"
-          ],
-          "description": "Default communication style for models that advertise `supportsPersonality`; can be overridden per thread/turn or via `/personality`.",
-          "deprecated": false,
-          "ui": {
-            "control": "select"
-          }
-        },
-        "experimental_compact_prompt_file": {
-          "key": "experimental_compact_prompt_file",
-          "key_path": [
-            "experimental_compact_prompt_file"
-          ],
-          "top_level": "experimental_compact_prompt_file",
-          "type": "string (path)",
-          "enum_values": [],
-          "description": "Load the compaction prompt override from a file (experimental).",
-          "deprecated": false,
-          "ui": {
-            "control": "path"
-          }
-        },
-        "skills.config": {
-          "key": "skills.config",
-          "key_path": [
-            "skills",
-            "config"
-          ],
-          "top_level": "skills",
-          "type": "array<object>",
-          "enum_values": [],
-          "description": "Per-skill enablement overrides stored in config.toml.",
-          "deprecated": false,
-          "ui": {
-            "control": "list"
-          }
-        },
-        "skills.config.<index>.path": {
-          "key": "skills.config.<index>.path",
-          "key_path": [
-            "skills",
-            "config",
-            "<index>",
-            "path"
-          ],
-          "top_level": "skills",
-          "type": "string (path)",
-          "enum_values": [],
-          "description": "Path to a skill folder containing `SKILL.md`.",
-          "deprecated": false,
-          "ui": {
-            "control": "path"
-          }
-        },
-        "skills.config.<index>.enabled": {
-          "key": "skills.config.<index>.enabled",
-          "key_path": [
-            "skills",
-            "config",
-            "<index>",
-            "enabled"
-          ],
-          "top_level": "skills",
-          "type": "boolean",
-          "enum_values": [],
-          "description": "Enable or disable the referenced skill.",
-          "deprecated": false,
-          "ui": {
-            "control": "toggle"
-          }
-        },
-        "apps.<id>.enabled": {
-          "key": "apps.<id>.enabled",
-          "key_path": [
-            "apps",
-            "<id>",
-            "enabled"
-          ],
-          "top_level": "apps",
-          "type": "boolean",
-          "enum_values": [],
-          "description": "Enable or disable a specific app/connector by id (default: true).",
-          "deprecated": false,
-          "ui": {
-            "control": "toggle"
-          }
-        },
-        "apps.<id>.disabled_reason": {
-          "key": "apps.<id>.disabled_reason",
-          "key_path": [
-            "apps",
-            "<id>",
-            "disabled_reason"
-          ],
-          "top_level": "apps",
-          "type": "unknown | user",
-          "enum_values": [
-            "unknown",
-            "user"
-          ],
-          "description": "Optional reason attached when an app/connector is disabled.",
-          "deprecated": false,
-          "ui": {
-            "control": "select"
-          }
-        },
-        "features.apps": {
-          "key": "features.apps",
-          "key_path": [
-            "features",
-            "apps"
-          ],
-          "top_level": "features",
-          "type": "boolean",
-          "enum_values": [],
-          "description": "Enable ChatGPT Apps/connectors support (experimental).",
-          "deprecated": false,
-          "ui": {
-            "control": "toggle"
-          }
-        },
-        "features.apps_mcp_gateway": {
-          "key": "features.apps_mcp_gateway",
-          "key_path": [
-            "features",
-            "apps_mcp_gateway"
-          ],
-          "top_level": "features",
-          "type": "boolean",
-          "enum_values": [],
-          "description": "Route Apps MCP calls through the OpenAI connectors MCP gateway (`https://api.openai.com/v1/connectors/mcp/`) instead of legacy routing (experimental).",
-          "deprecated": false,
-          "ui": {
-            "control": "toggle"
-          }
-        },
-        "mcp_servers.<id>.command": {
-          "key": "mcp_servers.<id>.command",
-          "key_path": [
-            "mcp_servers",
-            "<id>",
-            "command"
-          ],
-          "top_level": "mcp_servers",
-          "type": "string",
-          "enum_values": [],
-          "description": "Launcher command for an MCP stdio server.",
-          "deprecated": false,
-          "ui": {
-            "control": "text"
-          }
-        },
-        "mcp_servers.<id>.args": {
-          "key": "mcp_servers.<id>.args",
-          "key_path": [
-            "mcp_servers",
-            "<id>",
-            "args"
-          ],
-          "top_level": "mcp_servers",
-          "type": "array<string>",
-          "enum_values": [],
-          "description": "Arguments passed to the MCP stdio server command.",
-          "deprecated": false,
-          "ui": {
-            "control": "list"
-          }
-        },
-        "mcp_servers.<id>.env": {
-          "key": "mcp_servers.<id>.env",
-          "key_path": [
-            "mcp_servers",
-            "<id>",
-            "env"
-          ],
-          "top_level": "mcp_servers",
-          "type": "map<string,string>",
-          "enum_values": [],
-          "description": "Environment variables forwarded to the MCP stdio server.",
-          "deprecated": false,
-          "ui": {
-            "control": "key-value"
-          }
-        },
-        "mcp_servers.<id>.env_vars": {
-          "key": "mcp_servers.<id>.env_vars",
-          "key_path": [
-            "mcp_servers",
-            "<id>",
-            "env_vars"
-          ],
-          "top_level": "mcp_servers",
-          "type": "array<string>",
-          "enum_values": [],
-          "description": "Additional environment variables to whitelist for an MCP stdio server.",
-          "deprecated": false,
-          "ui": {
-            "control": "list"
-          }
-        },
-        "mcp_servers.<id>.cwd": {
-          "key": "mcp_servers.<id>.cwd",
-          "key_path": [
-            "mcp_servers",
-            "<id>",
-            "cwd"
-          ],
-          "top_level": "mcp_servers",
-          "type": "string",
-          "enum_values": [],
-          "description": "Working directory for the MCP stdio server process.",
-          "deprecated": false,
-          "ui": {
-            "control": "text"
-          }
-        },
-        "mcp_servers.<id>.url": {
-          "key": "mcp_servers.<id>.url",
-          "key_path": [
-            "mcp_servers",
-            "<id>",
-            "url"
-          ],
-          "top_level": "mcp_servers",
-          "type": "string",
-          "enum_values": [],
-          "description": "Endpoint for an MCP streamable HTTP server.",
-          "deprecated": false,
-          "ui": {
-            "control": "text"
-          }
-        },
-        "mcp_servers.<id>.bearer_token_env_var": {
-          "key": "mcp_servers.<id>.bearer_token_env_var",
-          "key_path": [
-            "mcp_servers",
-            "<id>",
-            "bearer_token_env_var"
-          ],
-          "top_level": "mcp_servers",
-          "type": "string",
-          "enum_values": [],
-          "description": "Environment variable sourcing the bearer token for an MCP HTTP server.",
-          "deprecated": false,
-          "ui": {
-            "control": "text"
-          }
-        },
-        "mcp_servers.<id>.http_headers": {
-          "key": "mcp_servers.<id>.http_headers",
-          "key_path": [
-            "mcp_servers",
-            "<id>",
-            "http_headers"
-          ],
-          "top_level": "mcp_servers",
-          "type": "map<string,string>",
-          "enum_values": [],
-          "description": "Static HTTP headers included with each MCP HTTP request.",
-          "deprecated": false,
-          "ui": {
-            "control": "key-value"
-          }
-        },
-        "mcp_servers.<id>.env_http_headers": {
-          "key": "mcp_servers.<id>.env_http_headers",
-          "key_path": [
-            "mcp_servers",
-            "<id>",
-            "env_http_headers"
-          ],
-          "top_level": "mcp_servers",
-          "type": "map<string,string>",
-          "enum_values": [],
-          "description": "HTTP headers populated from environment variables for an MCP HTTP server.",
-          "deprecated": false,
-          "ui": {
-            "control": "key-value"
-          }
-        },
-        "mcp_servers.<id>.enabled": {
-          "key": "mcp_servers.<id>.enabled",
-          "key_path": [
-            "mcp_servers",
-            "<id>",
-            "enabled"
-          ],
-          "top_level": "mcp_servers",
-          "type": "boolean",
-          "enum_values": [],
-          "description": "Disable an MCP server without removing its configuration.",
-          "deprecated": false,
-          "ui": {
-            "control": "toggle"
-          }
-        },
-        "mcp_servers.<id>.required": {
-          "key": "mcp_servers.<id>.required",
-          "key_path": [
-            "mcp_servers",
-            "<id>",
-            "required"
-          ],
-          "top_level": "mcp_servers",
-          "type": "boolean",
-          "enum_values": [],
-          "description": "When true, fail startup/resume if this enabled MCP server cannot initialize.",
-          "deprecated": false,
-          "ui": {
-            "control": "toggle"
-          }
-        },
-        "mcp_servers.<id>.startup_timeout_sec": {
-          "key": "mcp_servers.<id>.startup_timeout_sec",
-          "key_path": [
-            "mcp_servers",
-            "<id>",
-            "startup_timeout_sec"
-          ],
-          "top_level": "mcp_servers",
-          "type": "number",
-          "enum_values": [],
-          "description": "Override the default 10s startup timeout for an MCP server.",
-          "deprecated": false,
-          "ui": {
-            "control": "number"
-          }
-        },
-        "mcp_servers.<id>.startup_timeout_ms": {
-          "key": "mcp_servers.<id>.startup_timeout_ms",
-          "key_path": [
-            "mcp_servers",
-            "<id>",
-            "startup_timeout_ms"
-          ],
-          "top_level": "mcp_servers",
-          "type": "number",
-          "enum_values": [],
-          "description": "Alias for `startup_timeout_sec` in milliseconds.",
-          "deprecated": false,
-          "ui": {
-            "control": "number"
-          }
-        },
-        "mcp_servers.<id>.tool_timeout_sec": {
-          "key": "mcp_servers.<id>.tool_timeout_sec",
-          "key_path": [
-            "mcp_servers",
-            "<id>",
-            "tool_timeout_sec"
-          ],
-          "top_level": "mcp_servers",
-          "type": "number",
-          "enum_values": [],
-          "description": "Override the default 60s per-tool timeout for an MCP server.",
-          "deprecated": false,
-          "ui": {
-            "control": "number"
-          }
-        },
-        "mcp_servers.<id>.enabled_tools": {
-          "key": "mcp_servers.<id>.enabled_tools",
-          "key_path": [
-            "mcp_servers",
-            "<id>",
-            "enabled_tools"
-          ],
-          "top_level": "mcp_servers",
-          "type": "array<string>",
-          "enum_values": [],
-          "description": "Allow list of tool names exposed by the MCP server.",
-          "deprecated": false,
-          "ui": {
-            "control": "list"
-          }
-        },
-        "mcp_servers.<id>.disabled_tools": {
-          "key": "mcp_servers.<id>.disabled_tools",
-          "key_path": [
-            "mcp_servers",
-            "<id>",
-            "disabled_tools"
-          ],
-          "top_level": "mcp_servers",
-          "type": "array<string>",
-          "enum_values": [],
-          "description": "Deny list applied after `enabled_tools` for the MCP server.",
-          "deprecated": false,
-          "ui": {
-            "control": "list"
-          }
-        },
-        "agents.max_threads": {
-          "key": "agents.max_threads",
-          "key_path": [
-            "agents",
-            "max_threads"
-          ],
-          "top_level": "agents",
-          "type": "number",
-          "enum_values": [],
-          "description": "Maximum number of agent threads that can be open concurrently.",
-          "deprecated": false,
-          "ui": {
-            "control": "number"
-          }
-        },
-        "agents.<name>.description": {
-          "key": "agents.<name>.description",
-          "key_path": [
-            "agents",
-            "<name>",
-            "description"
-          ],
-          "top_level": "agents",
-          "type": "string",
-          "enum_values": [],
-          "description": "Role guidance shown to Codex when choosing and spawning that agent type.",
-          "deprecated": false,
-          "ui": {
-            "control": "text"
-          }
-        },
-        "agents.<name>.config_file": {
-          "key": "agents.<name>.config_file",
-          "key_path": [
-            "agents",
-            "<name>",
-            "config_file"
-          ],
-          "top_level": "agents",
-          "type": "string (path)",
-          "enum_values": [],
-          "description": "Path to a TOML config layer for that role; relative paths resolve from the config file that declares the role.",
-          "deprecated": false,
-          "ui": {
-            "control": "path"
-          }
-        },
-        "features.unified_exec": {
-          "key": "features.unified_exec",
-          "key_path": [
-            "features",
-            "unified_exec"
-          ],
-          "top_level": "features",
-          "type": "boolean",
-          "enum_values": [],
-          "description": "Use the unified PTY-backed exec tool (beta).",
-          "deprecated": false,
-          "ui": {
-            "control": "toggle"
-          }
-        },
-        "features.shell_snapshot": {
-          "key": "features.shell_snapshot",
-          "key_path": [
-            "features",
-            "shell_snapshot"
-          ],
-          "top_level": "features",
-          "type": "boolean",
-          "enum_values": [],
-          "description": "Snapshot shell environment to speed up repeated commands (beta).",
-          "deprecated": false,
-          "ui": {
-            "control": "toggle"
-          }
-        },
-        "features.apply_patch_freeform": {
-          "key": "features.apply_patch_freeform",
-          "key_path": [
-            "features",
-            "apply_patch_freeform"
-          ],
-          "top_level": "features",
-          "type": "boolean",
-          "enum_values": [],
-          "description": "Expose the freeform `apply_patch` tool (experimental).",
-          "deprecated": false,
-          "ui": {
-            "control": "toggle"
-          }
-        },
-        "features.multi_agent": {
-          "key": "features.multi_agent",
-          "key_path": [
-            "features",
-            "multi_agent"
-          ],
-          "top_level": "features",
-          "type": "boolean",
-          "enum_values": [],
-          "description": "Enable multi-agent collaboration tools (`spawn_agent`, `send_input`, `resume_agent`, `wait`, and `close_agent`) (experimental; off by default).",
-          "deprecated": false,
-          "ui": {
-            "control": "toggle"
-          }
-        },
-        "features.personality": {
-          "key": "features.personality",
-          "key_path": [
-            "features",
-            "personality"
-          ],
-          "top_level": "features",
-          "type": "boolean",
-          "enum_values": [],
-          "description": "Enable personality selection controls (stable; on by default).",
-          "deprecated": false,
-          "ui": {
-            "control": "toggle"
-          }
-        },
-        "features.web_search": {
-          "key": "features.web_search",
-          "key_path": [
-            "features",
-            "web_search"
-          ],
-          "top_level": "features",
-          "type": "boolean",
-          "enum_values": [],
-          "description": "Deprecated legacy toggle; prefer the top-level `web_search` setting.",
-          "deprecated": true,
-          "ui": {
-            "control": "toggle"
-          }
-        },
-        "features.web_search_cached": {
-          "key": "features.web_search_cached",
-          "key_path": [
-            "features",
-            "web_search_cached"
-          ],
-          "top_level": "features",
-          "type": "boolean",
-          "enum_values": [],
-          "description": "Deprecated legacy toggle. When `web_search` is unset, true maps to `web_search = \"cached\"`.",
-          "deprecated": true,
-          "ui": {
-            "control": "toggle"
-          }
-        },
-        "features.web_search_request": {
-          "key": "features.web_search_request",
-          "key_path": [
-            "features",
-            "web_search_request"
-          ],
-          "top_level": "features",
-          "type": "boolean",
-          "enum_values": [],
-          "description": "Deprecated legacy toggle. When `web_search` is unset, true maps to `web_search = \"live\"`.",
-          "deprecated": true,
-          "ui": {
-            "control": "toggle"
-          }
-        },
-        "features.shell_tool": {
-          "key": "features.shell_tool",
-          "key_path": [
-            "features",
-            "shell_tool"
-          ],
-          "top_level": "features",
-          "type": "boolean",
-          "enum_values": [],
-          "description": "Enable the default `shell` tool for running commands (stable; on by default).",
-          "deprecated": false,
-          "ui": {
-            "control": "toggle"
-          }
-        },
-        "features.request_rule": {
-          "key": "features.request_rule",
-          "key_path": [
-            "features",
-            "request_rule"
-          ],
-          "top_level": "features",
-          "type": "boolean",
-          "enum_values": [],
-          "description": "Enable Smart approvals (`prefix_rule` suggestions on escalation requests; stable; on by default).",
-          "deprecated": false,
-          "ui": {
-            "control": "toggle"
-          }
-        },
-        "features.search_tool": {
-          "key": "features.search_tool",
-          "key_path": [
-            "features",
-            "search_tool"
-          ],
-          "top_level": "features",
-          "type": "boolean",
-          "enum_values": [],
-          "description": "Enable `search_tool_bm25` for Apps tool discovery before invoking app MCP tools (experimental).",
-          "deprecated": false,
-          "ui": {
-            "control": "toggle"
-          }
-        },
-        "features.collaboration_modes": {
-          "key": "features.collaboration_modes",
-          "key_path": [
-            "features",
-            "collaboration_modes"
-          ],
-          "top_level": "features",
-          "type": "boolean",
-          "enum_values": [],
-          "description": "Enable collaboration modes such as plan mode (stable; on by default).",
-          "deprecated": false,
-          "ui": {
-            "control": "toggle"
-          }
-        },
-        "features.use_linux_sandbox_bwrap": {
-          "key": "features.use_linux_sandbox_bwrap",
-          "key_path": [
-            "features",
-            "use_linux_sandbox_bwrap"
-          ],
-          "top_level": "features",
-          "type": "boolean",
-          "enum_values": [],
-          "description": "Use the bubblewrap-based Linux sandbox pipeline (experimental; off by default).",
-          "deprecated": false,
-          "ui": {
-            "control": "toggle"
-          }
-        },
-        "features.experimental_windows_sandbox": {
-          "key": "features.experimental_windows_sandbox",
-          "key_path": [
-            "features",
-            "experimental_windows_sandbox"
-          ],
-          "top_level": "features",
-          "type": "boolean",
-          "enum_values": [],
-          "description": "Run the Windows restricted-token sandbox (experimental).",
-          "deprecated": false,
-          "ui": {
-            "control": "toggle"
-          }
-        },
-        "features.elevated_windows_sandbox": {
-          "key": "features.elevated_windows_sandbox",
-          "key_path": [
-            "features",
-            "elevated_windows_sandbox"
-          ],
-          "top_level": "features",
-          "type": "boolean",
-          "enum_values": [],
-          "description": "Enable the elevated Windows sandbox pipeline (experimental).",
-          "deprecated": false,
-          "ui": {
-            "control": "toggle"
-          }
-        },
-        "features.remote_models": {
-          "key": "features.remote_models",
-          "key_path": [
-            "features",
-            "remote_models"
-          ],
-          "top_level": "features",
-          "type": "boolean",
-          "enum_values": [],
-          "description": "Refresh remote model list before showing readiness (experimental).",
-          "deprecated": false,
-          "ui": {
-            "control": "toggle"
-          }
-        },
-        "features.runtime_metrics": {
-          "key": "features.runtime_metrics",
-          "key_path": [
-            "features",
-            "runtime_metrics"
-          ],
-          "top_level": "features",
-          "type": "boolean",
-          "enum_values": [],
-          "description": "Show runtime metrics summary in TUI turn separators (experimental).",
-          "deprecated": false,
-          "ui": {
-            "control": "toggle"
-          }
-        },
-        "features.powershell_utf8": {
-          "key": "features.powershell_utf8",
-          "key_path": [
-            "features",
-            "powershell_utf8"
-          ],
-          "top_level": "features",
-          "type": "boolean",
-          "enum_values": [],
-          "description": "Force PowerShell UTF-8 output (defaults to true).",
-          "deprecated": false,
-          "ui": {
-            "control": "toggle"
-          }
-        },
-        "features.child_agents_md": {
-          "key": "features.child_agents_md",
-          "key_path": [
-            "features",
-            "child_agents_md"
-          ],
-          "top_level": "features",
-          "type": "boolean",
-          "enum_values": [],
-          "description": "Append AGENTS.md scope/precedence guidance even when no AGENTS.md is present (experimental).",
-          "deprecated": false,
-          "ui": {
-            "control": "toggle"
-          }
-        },
-        "suppress_unstable_features_warning": {
-          "key": "suppress_unstable_features_warning",
-          "key_path": [
-            "suppress_unstable_features_warning"
-          ],
-          "top_level": "suppress_unstable_features_warning",
-          "type": "boolean",
-          "enum_values": [],
-          "description": "Suppress the warning that appears when under-development feature flags are enabled.",
-          "deprecated": false,
-          "ui": {
-            "control": "toggle"
-          }
-        },
-        "model_providers.<id>.name": {
-          "key": "model_providers.<id>.name",
-          "key_path": [
-            "model_providers",
-            "<id>",
-            "name"
-          ],
-          "top_level": "model_providers",
-          "type": "string",
-          "enum_values": [],
-          "description": "Display name for a custom model provider.",
-          "deprecated": false,
-          "ui": {
-            "control": "text"
-          }
-        },
-        "model_providers.<id>.base_url": {
-          "key": "model_providers.<id>.base_url",
-          "key_path": [
-            "model_providers",
-            "<id>",
-            "base_url"
-          ],
-          "top_level": "model_providers",
-          "type": "string",
-          "enum_values": [],
-          "description": "API base URL for the model provider.",
-          "deprecated": false,
-          "ui": {
-            "control": "text"
-          }
-        },
-        "model_providers.<id>.env_key": {
-          "key": "model_providers.<id>.env_key",
-          "key_path": [
-            "model_providers",
-            "<id>",
-            "env_key"
-          ],
-          "top_level": "model_providers",
-          "type": "string",
-          "enum_values": [],
-          "description": "Environment variable supplying the provider API key.",
-          "deprecated": false,
-          "ui": {
-            "control": "text"
-          }
-        },
-        "model_providers.<id>.env_key_instructions": {
-          "key": "model_providers.<id>.env_key_instructions",
-          "key_path": [
-            "model_providers",
-            "<id>",
-            "env_key_instructions"
-          ],
-          "top_level": "model_providers",
-          "type": "string",
-          "enum_values": [],
-          "description": "Optional setup guidance for the provider API key.",
-          "deprecated": false,
-          "ui": {
-            "control": "text"
-          }
-        },
-        "model_providers.<id>.experimental_bearer_token": {
-          "key": "model_providers.<id>.experimental_bearer_token",
-          "key_path": [
-            "model_providers",
-            "<id>",
-            "experimental_bearer_token"
-          ],
-          "top_level": "model_providers",
-          "type": "string",
-          "enum_values": [],
-          "description": "Direct bearer token for the provider (discouraged; use `env_key`).",
-          "deprecated": false,
-          "ui": {
-            "control": "text"
-          }
-        },
-        "model_providers.<id>.requires_openai_auth": {
-          "key": "model_providers.<id>.requires_openai_auth",
-          "key_path": [
-            "model_providers",
-            "<id>",
-            "requires_openai_auth"
-          ],
-          "top_level": "model_providers",
-          "type": "boolean",
-          "enum_values": [],
-          "description": "The provider uses OpenAI authentication (defaults to false).",
-          "deprecated": false,
-          "ui": {
-            "control": "toggle"
-          }
-        },
-        "model_providers.<id>.wire_api": {
-          "key": "model_providers.<id>.wire_api",
-          "key_path": [
-            "model_providers",
-            "<id>",
-            "wire_api"
-          ],
-          "top_level": "model_providers",
-          "type": "chat | responses",
-          "enum_values": [
-            "chat",
-            "responses"
-          ],
-          "description": "Protocol used by the provider (defaults to `chat` if omitted).",
-          "deprecated": false,
-          "ui": {
-            "control": "select"
-          }
-        },
-        "model_providers.<id>.query_params": {
-          "key": "model_providers.<id>.query_params",
-          "key_path": [
-            "model_providers",
-            "<id>",
-            "query_params"
-          ],
-          "top_level": "model_providers",
-          "type": "map<string,string>",
-          "enum_values": [],
-          "description": "Extra query parameters appended to provider requests.",
-          "deprecated": false,
-          "ui": {
-            "control": "key-value"
-          }
-        },
-        "model_providers.<id>.http_headers": {
-          "key": "model_providers.<id>.http_headers",
-          "key_path": [
-            "model_providers",
-            "<id>",
-            "http_headers"
-          ],
-          "top_level": "model_providers",
-          "type": "map<string,string>",
-          "enum_values": [],
-          "description": "Static HTTP headers added to provider requests.",
-          "deprecated": false,
-          "ui": {
-            "control": "key-value"
-          }
-        },
-        "model_providers.<id>.env_http_headers": {
-          "key": "model_providers.<id>.env_http_headers",
-          "key_path": [
-            "model_providers",
-            "<id>",
-            "env_http_headers"
-          ],
-          "top_level": "model_providers",
-          "type": "map<string,string>",
-          "enum_values": [],
-          "description": "HTTP headers populated from environment variables when present.",
-          "deprecated": false,
-          "ui": {
-            "control": "key-value"
-          }
-        },
-        "model_providers.<id>.request_max_retries": {
-          "key": "model_providers.<id>.request_max_retries",
-          "key_path": [
-            "model_providers",
-            "<id>",
-            "request_max_retries"
-          ],
-          "top_level": "model_providers",
-          "type": "number",
-          "enum_values": [],
-          "description": "Retry count for HTTP requests to the provider (default: 4).",
-          "deprecated": false,
-          "ui": {
-            "control": "number"
-          }
-        },
-        "model_providers.<id>.stream_max_retries": {
-          "key": "model_providers.<id>.stream_max_retries",
-          "key_path": [
-            "model_providers",
-            "<id>",
-            "stream_max_retries"
-          ],
-          "top_level": "model_providers",
-          "type": "number",
-          "enum_values": [],
-          "description": "Retry count for SSE streaming interruptions (default: 5).",
-          "deprecated": false,
-          "ui": {
-            "control": "number"
-          }
-        },
-        "model_providers.<id>.stream_idle_timeout_ms": {
-          "key": "model_providers.<id>.stream_idle_timeout_ms",
-          "key_path": [
-            "model_providers",
-            "<id>",
-            "stream_idle_timeout_ms"
-          ],
-          "top_level": "model_providers",
-          "type": "number",
-          "enum_values": [],
-          "description": "Idle timeout for SSE streams in milliseconds (default: 300000).",
-          "deprecated": false,
-          "ui": {
-            "control": "number"
-          }
-        },
-        "model_reasoning_effort": {
-          "key": "model_reasoning_effort",
-          "key_path": [
-            "model_reasoning_effort"
-          ],
-          "top_level": "model_reasoning_effort",
-          "type": "minimal | low | medium | high | xhigh",
-          "enum_values": [
-            "minimal",
-            "low",
-            "medium",
-            "high",
-            "xhigh"
-          ],
-          "description": "Adjust reasoning effort for supported models (Responses API only; `xhigh` is model-dependent).",
-          "deprecated": false,
-          "ui": {
-            "control": "select"
-          }
-        },
-        "model_reasoning_summary": {
-          "key": "model_reasoning_summary",
-          "key_path": [
-            "model_reasoning_summary"
-          ],
-          "top_level": "model_reasoning_summary",
-          "type": "auto | concise | detailed | none",
-          "enum_values": [
-            "auto",
-            "concise",
-            "detailed",
-            "none"
-          ],
-          "description": "Select reasoning summary detail or disable summaries entirely.",
-          "deprecated": false,
-          "ui": {
-            "control": "select"
-          }
-        },
-        "model_verbosity": {
-          "key": "model_verbosity",
-          "key_path": [
-            "model_verbosity"
-          ],
-          "top_level": "model_verbosity",
-          "type": "low | medium | high",
-          "enum_values": [
-            "low",
-            "medium",
-            "high"
-          ],
-          "description": "Control GPT-5 Responses API verbosity (defaults to `medium`).",
-          "deprecated": false,
-          "ui": {
-            "control": "select"
-          }
-        },
-        "model_supports_reasoning_summaries": {
-          "key": "model_supports_reasoning_summaries",
-          "key_path": [
-            "model_supports_reasoning_summaries"
-          ],
-          "top_level": "model_supports_reasoning_summaries",
-          "type": "boolean",
-          "enum_values": [],
-          "description": "Force Codex to send or not send reasoning metadata.",
-          "deprecated": false,
-          "ui": {
-            "control": "toggle"
-          }
-        },
-        "shell_environment_policy.inherit": {
-          "key": "shell_environment_policy.inherit",
-          "key_path": [
-            "shell_environment_policy",
-            "inherit"
-          ],
-          "top_level": "shell_environment_policy",
-          "type": "all | core | none",
-          "enum_values": [
-            "all",
-            "core",
-            "none"
-          ],
-          "description": "Baseline environment inheritance when spawning subprocesses.",
-          "deprecated": false,
-          "ui": {
-            "control": "select"
-          }
-        },
-        "shell_environment_policy.ignore_default_excludes": {
-          "key": "shell_environment_policy.ignore_default_excludes",
-          "key_path": [
-            "shell_environment_policy",
-            "ignore_default_excludes"
-          ],
-          "top_level": "shell_environment_policy",
-          "type": "boolean",
-          "enum_values": [],
-          "description": "Keep variables containing KEY/SECRET/TOKEN before other filters run.",
-          "deprecated": false,
-          "ui": {
-            "control": "toggle"
-          }
-        },
-        "shell_environment_policy.exclude": {
-          "key": "shell_environment_policy.exclude",
-          "key_path": [
-            "shell_environment_policy",
-            "exclude"
-          ],
-          "top_level": "shell_environment_policy",
-          "type": "array<string>",
-          "enum_values": [],
-          "description": "Glob patterns for removing environment variables after the defaults.",
-          "deprecated": false,
-          "ui": {
-            "control": "list"
-          }
-        },
-        "shell_environment_policy.include_only": {
-          "key": "shell_environment_policy.include_only",
-          "key_path": [
-            "shell_environment_policy",
-            "include_only"
-          ],
-          "top_level": "shell_environment_policy",
-          "type": "array<string>",
-          "enum_values": [],
-          "description": "Whitelist of patterns; when set only matching variables are kept.",
-          "deprecated": false,
-          "ui": {
-            "control": "list"
-          }
-        },
-        "shell_environment_policy.set": {
-          "key": "shell_environment_policy.set",
-          "key_path": [
-            "shell_environment_policy",
-            "set"
-          ],
-          "top_level": "shell_environment_policy",
-          "type": "map<string,string>",
-          "enum_values": [],
-          "description": "Explicit environment overrides injected into every subprocess.",
-          "deprecated": false,
-          "ui": {
-            "control": "key-value"
-          }
-        },
-        "shell_environment_policy.experimental_use_profile": {
-          "key": "shell_environment_policy.experimental_use_profile",
-          "key_path": [
-            "shell_environment_policy",
-            "experimental_use_profile"
-          ],
-          "top_level": "shell_environment_policy",
-          "type": "boolean",
-          "enum_values": [],
-          "description": "Use the user shell profile when spawning subprocesses.",
-          "deprecated": false,
-          "ui": {
-            "control": "toggle"
-          }
-        },
-        "project_root_markers": {
-          "key": "project_root_markers",
-          "key_path": [
-            "project_root_markers"
-          ],
-          "top_level": "project_root_markers",
-          "type": "array<string>",
-          "enum_values": [],
-          "description": "List of project root marker filenames; used when searching parent directories for the project root.",
-          "deprecated": false,
-          "ui": {
-            "control": "list"
-          }
-        },
-        "project_doc_max_bytes": {
-          "key": "project_doc_max_bytes",
-          "key_path": [
-            "project_doc_max_bytes"
-          ],
-          "top_level": "project_doc_max_bytes",
-          "type": "number",
-          "enum_values": [],
-          "description": "Maximum bytes read from `AGENTS.md` when building project instructions.",
-          "deprecated": false,
-          "ui": {
-            "control": "number"
-          }
-        },
-        "project_doc_fallback_filenames": {
-          "key": "project_doc_fallback_filenames",
-          "key_path": [
-            "project_doc_fallback_filenames"
-          ],
-          "top_level": "project_doc_fallback_filenames",
-          "type": "array<string>",
-          "enum_values": [],
-          "description": "Additional filenames to try when `AGENTS.md` is missing.",
-          "deprecated": false,
-          "ui": {
-            "control": "list"
-          }
-        },
-        "profile": {
-          "key": "profile",
-          "key_path": [
-            "profile"
-          ],
-          "top_level": "profile",
-          "type": "string",
-          "enum_values": [],
-          "description": "Default profile applied at startup (equivalent to `--profile`).",
-          "deprecated": false,
-          "ui": {
-            "control": "text"
-          }
-        },
-        "profiles.<name>.*": {
-          "key": "profiles.<name>.*",
-          "key_path": [
-            "profiles",
-            "<name>",
-            "*"
-          ],
-          "top_level": "profiles",
-          "type": "various",
-          "enum_values": [],
-          "description": "Profile-scoped overrides for any of the supported configuration keys.",
-          "deprecated": false,
-          "ui": {
-            "control": "text"
-          }
-        },
-        "profiles.<name>.include_apply_patch_tool": {
-          "key": "profiles.<name>.include_apply_patch_tool",
-          "key_path": [
-            "profiles",
-            "<name>",
-            "include_apply_patch_tool"
-          ],
-          "top_level": "profiles",
-          "type": "boolean",
-          "enum_values": [],
-          "description": "Legacy name for enabling freeform apply_patch; prefer `[features].apply_patch_freeform`.",
-          "deprecated": false,
-          "ui": {
-            "control": "toggle"
-          }
-        },
-        "profiles.<name>.web_search": {
-          "key": "profiles.<name>.web_search",
-          "key_path": [
-            "profiles",
-            "<name>",
-            "web_search"
-          ],
-          "top_level": "profiles",
-          "type": "disabled | cached | live",
-          "enum_values": [
-            "disabled",
-            "cached",
-            "live"
-          ],
-          "description": "Profile-scoped web search mode override (default: `\"cached\"`).",
-          "deprecated": false,
-          "ui": {
-            "control": "select"
-          }
-        },
-        "profiles.<name>.personality": {
-          "key": "profiles.<name>.personality",
-          "key_path": [
-            "profiles",
-            "<name>",
-            "personality"
-          ],
-          "top_level": "profiles",
-          "type": "none | friendly | pragmatic",
-          "enum_values": [
-            "none",
-            "friendly",
-            "pragmatic"
-          ],
-          "description": "Profile-scoped communication style override for supported models.",
-          "deprecated": false,
-          "ui": {
-            "control": "select"
-          }
-        },
-        "profiles.<name>.experimental_use_unified_exec_tool": {
-          "key": "profiles.<name>.experimental_use_unified_exec_tool",
-          "key_path": [
-            "profiles",
-            "<name>",
-            "experimental_use_unified_exec_tool"
-          ],
-          "top_level": "profiles",
-          "type": "boolean",
-          "enum_values": [],
-          "description": "Legacy name for enabling unified exec; prefer `[features].unified_exec`.",
-          "deprecated": false,
-          "ui": {
-            "control": "toggle"
-          }
-        },
-        "profiles.<name>.experimental_use_freeform_apply_patch": {
-          "key": "profiles.<name>.experimental_use_freeform_apply_patch",
-          "key_path": [
-            "profiles",
-            "<name>",
-            "experimental_use_freeform_apply_patch"
-          ],
-          "top_level": "profiles",
-          "type": "boolean",
-          "enum_values": [],
-          "description": "Legacy name for enabling freeform apply_patch; prefer `[features].apply_patch_freeform`.",
-          "deprecated": false,
-          "ui": {
-            "control": "toggle"
-          }
-        },
-        "profiles.<name>.oss_provider": {
-          "key": "profiles.<name>.oss_provider",
-          "key_path": [
-            "profiles",
-            "<name>",
-            "oss_provider"
-          ],
-          "top_level": "profiles",
-          "type": "lmstudio | ollama",
-          "enum_values": [
-            "lmstudio",
-            "ollama"
-          ],
-          "description": "Profile-scoped OSS provider for `--oss` sessions.",
-          "deprecated": false,
-          "ui": {
-            "control": "select"
-          }
-        },
-        "history.persistence": {
-          "key": "history.persistence",
-          "key_path": [
-            "history",
-            "persistence"
-          ],
-          "top_level": "history",
-          "type": "save-all | none",
-          "enum_values": [
-            "save-all",
-            "none"
-          ],
-          "description": "Control whether Codex saves session transcripts to history.jsonl.",
-          "deprecated": false,
-          "ui": {
-            "control": "select"
-          }
-        },
-        "tool_output_token_limit": {
-          "key": "tool_output_token_limit",
-          "key_path": [
-            "tool_output_token_limit"
-          ],
-          "top_level": "tool_output_token_limit",
-          "type": "number",
-          "enum_values": [],
-          "description": "Token budget for storing individual tool/function outputs in history.",
-          "deprecated": false,
-          "ui": {
-            "control": "number"
-          }
-        },
-        "history.max_bytes": {
-          "key": "history.max_bytes",
-          "key_path": [
-            "history",
-            "max_bytes"
-          ],
-          "top_level": "history",
-          "type": "number",
-          "enum_values": [],
-          "description": "If set, caps the history file size in bytes by dropping oldest entries.",
-          "deprecated": false,
-          "ui": {
-            "control": "number"
-          }
-        },
-        "file_opener": {
-          "key": "file_opener",
-          "key_path": [
-            "file_opener"
-          ],
-          "top_level": "file_opener",
-          "type": "vscode | vscode-insiders | windsurf | cursor | none",
-          "enum_values": [
-            "vscode",
-            "vscode-insiders",
-            "windsurf",
-            "cursor",
-            "none"
-          ],
-          "description": "URI scheme used to open citations from Codex output (default: `vscode`).",
-          "deprecated": false,
-          "ui": {
-            "control": "select"
-          }
-        },
-        "otel.environment": {
-          "key": "otel.environment",
-          "key_path": [
-            "otel",
-            "environment"
-          ],
-          "top_level": "otel",
-          "type": "string",
-          "enum_values": [],
-          "description": "Environment tag applied to emitted OpenTelemetry events (default: `dev`).",
-          "deprecated": false,
-          "ui": {
-            "control": "text"
-          }
-        },
-        "otel.exporter": {
-          "key": "otel.exporter",
-          "key_path": [
-            "otel",
-            "exporter"
-          ],
-          "top_level": "otel",
-          "type": "none | otlp-http | otlp-grpc",
-          "enum_values": [
-            "none",
-            "otlp-http",
-            "otlp-grpc"
-          ],
-          "description": "Select the OpenTelemetry exporter and provide any endpoint metadata.",
-          "deprecated": false,
-          "ui": {
-            "control": "select"
-          }
-        },
-        "otel.trace_exporter": {
-          "key": "otel.trace_exporter",
-          "key_path": [
-            "otel",
-            "trace_exporter"
-          ],
-          "top_level": "otel",
-          "type": "none | otlp-http | otlp-grpc",
-          "enum_values": [
-            "none",
-            "otlp-http",
-            "otlp-grpc"
-          ],
-          "description": "Select the OpenTelemetry trace exporter and provide any endpoint metadata.",
-          "deprecated": false,
-          "ui": {
-            "control": "select"
-          }
-        },
-        "otel.log_user_prompt": {
-          "key": "otel.log_user_prompt",
-          "key_path": [
-            "otel",
-            "log_user_prompt"
-          ],
-          "top_level": "otel",
-          "type": "boolean",
-          "enum_values": [],
-          "description": "Opt in to exporting raw user prompts with OpenTelemetry logs.",
-          "deprecated": false,
-          "ui": {
-            "control": "toggle"
-          }
-        },
-        "otel.exporter.<id>.endpoint": {
-          "key": "otel.exporter.<id>.endpoint",
-          "key_path": [
-            "otel",
-            "exporter",
-            "<id>",
-            "endpoint"
-          ],
-          "top_level": "otel",
-          "type": "string",
-          "enum_values": [],
-          "description": "Exporter endpoint for OTEL logs.",
-          "deprecated": false,
-          "ui": {
-            "control": "text"
-          }
-        },
-        "otel.exporter.<id>.protocol": {
-          "key": "otel.exporter.<id>.protocol",
-          "key_path": [
-            "otel",
-            "exporter",
-            "<id>",
-            "protocol"
-          ],
-          "top_level": "otel",
-          "type": "binary | json",
-          "enum_values": [
-            "binary",
-            "json"
-          ],
-          "description": "Protocol used by the OTLP/HTTP exporter.",
-          "deprecated": false,
-          "ui": {
-            "control": "select"
-          }
-        },
-        "otel.exporter.<id>.headers": {
-          "key": "otel.exporter.<id>.headers",
-          "key_path": [
-            "otel",
-            "exporter",
-            "<id>",
-            "headers"
-          ],
-          "top_level": "otel",
-          "type": "map<string,string>",
-          "enum_values": [],
-          "description": "Static headers included with OTEL exporter requests.",
-          "deprecated": false,
-          "ui": {
-            "control": "key-value"
-          }
-        },
-        "otel.trace_exporter.<id>.endpoint": {
-          "key": "otel.trace_exporter.<id>.endpoint",
-          "key_path": [
-            "otel",
-            "trace_exporter",
-            "<id>",
-            "endpoint"
-          ],
-          "top_level": "otel",
-          "type": "string",
-          "enum_values": [],
-          "description": "Trace exporter endpoint for OTEL logs.",
-          "deprecated": false,
-          "ui": {
-            "control": "text"
-          }
-        },
-        "otel.trace_exporter.<id>.protocol": {
-          "key": "otel.trace_exporter.<id>.protocol",
-          "key_path": [
-            "otel",
-            "trace_exporter",
-            "<id>",
-            "protocol"
-          ],
-          "top_level": "otel",
-          "type": "binary | json",
-          "enum_values": [
-            "binary",
-            "json"
-          ],
-          "description": "Protocol used by the OTLP/HTTP trace exporter.",
-          "deprecated": false,
-          "ui": {
-            "control": "select"
-          }
-        },
-        "otel.trace_exporter.<id>.headers": {
-          "key": "otel.trace_exporter.<id>.headers",
-          "key_path": [
-            "otel",
-            "trace_exporter",
-            "<id>",
-            "headers"
-          ],
-          "top_level": "otel",
-          "type": "map<string,string>",
-          "enum_values": [],
-          "description": "Static headers included with OTEL trace exporter requests.",
-          "deprecated": false,
-          "ui": {
-            "control": "key-value"
-          }
-        },
-        "otel.exporter.<id>.tls.ca-certificate": {
-          "key": "otel.exporter.<id>.tls.ca-certificate",
-          "key_path": [
-            "otel",
-            "exporter",
-            "<id>",
-            "tls",
-            "ca-certificate"
-          ],
-          "top_level": "otel",
-          "type": "string",
-          "enum_values": [],
-          "description": "CA certificate path for OTEL exporter TLS.",
-          "deprecated": false,
-          "ui": {
-            "control": "text"
-          }
-        },
-        "otel.exporter.<id>.tls.client-certificate": {
-          "key": "otel.exporter.<id>.tls.client-certificate",
-          "key_path": [
-            "otel",
-            "exporter",
-            "<id>",
-            "tls",
-            "client-certificate"
-          ],
-          "top_level": "otel",
-          "type": "string",
-          "enum_values": [],
-          "description": "Client certificate path for OTEL exporter TLS.",
-          "deprecated": false,
-          "ui": {
-            "control": "text"
-          }
-        },
-        "otel.exporter.<id>.tls.client-private-key": {
-          "key": "otel.exporter.<id>.tls.client-private-key",
-          "key_path": [
-            "otel",
-            "exporter",
-            "<id>",
-            "tls",
-            "client-private-key"
-          ],
-          "top_level": "otel",
-          "type": "string",
-          "enum_values": [],
-          "description": "Client private key path for OTEL exporter TLS.",
-          "deprecated": false,
-          "ui": {
-            "control": "text"
-          }
-        },
-        "otel.trace_exporter.<id>.tls.ca-certificate": {
-          "key": "otel.trace_exporter.<id>.tls.ca-certificate",
-          "key_path": [
-            "otel",
-            "trace_exporter",
-            "<id>",
-            "tls",
-            "ca-certificate"
-          ],
-          "top_level": "otel",
-          "type": "string",
-          "enum_values": [],
-          "description": "CA certificate path for OTEL trace exporter TLS.",
-          "deprecated": false,
-          "ui": {
-            "control": "text"
-          }
-        },
-        "otel.trace_exporter.<id>.tls.client-certificate": {
-          "key": "otel.trace_exporter.<id>.tls.client-certificate",
-          "key_path": [
-            "otel",
-            "trace_exporter",
-            "<id>",
-            "tls",
-            "client-certificate"
-          ],
-          "top_level": "otel",
-          "type": "string",
-          "enum_values": [],
-          "description": "Client certificate path for OTEL trace exporter TLS.",
-          "deprecated": false,
-          "ui": {
-            "control": "text"
-          }
-        },
-        "otel.trace_exporter.<id>.tls.client-private-key": {
-          "key": "otel.trace_exporter.<id>.tls.client-private-key",
-          "key_path": [
-            "otel",
-            "trace_exporter",
-            "<id>",
-            "tls",
-            "client-private-key"
-          ],
-          "top_level": "otel",
-          "type": "string",
-          "enum_values": [],
-          "description": "Client private key path for OTEL trace exporter TLS.",
-          "deprecated": false,
-          "ui": {
-            "control": "text"
-          }
-        },
-        "tui": {
-          "key": "tui",
-          "key_path": [
-            "tui"
-          ],
-          "top_level": "tui",
-          "type": "table",
-          "enum_values": [],
-          "description": "TUI-specific options such as enabling inline desktop notifications.",
-          "deprecated": false,
-          "ui": {
-            "control": "section"
-          }
-        },
-        "tui.notifications": {
-          "key": "tui.notifications",
-          "key_path": [
-            "tui",
-            "notifications"
-          ],
-          "top_level": "tui",
-          "type": "boolean | array<string>",
-          "enum_values": [
-            "boolean",
-            "array<string>"
-          ],
-          "description": "Enable TUI notifications; optionally restrict to specific event types.",
-          "deprecated": false,
-          "ui": {
-            "control": "select"
-          }
-        },
-        "tui.notification_method": {
-          "key": "tui.notification_method",
-          "key_path": [
-            "tui",
-            "notification_method"
-          ],
-          "top_level": "tui",
-          "type": "auto | osc9 | bel",
-          "enum_values": [
-            "auto",
-            "osc9",
-            "bel"
-          ],
-          "description": "Notification method for unfocused terminal notifications (default: auto).",
-          "deprecated": false,
-          "ui": {
-            "control": "select"
-          }
-        },
-        "tui.animations": {
-          "key": "tui.animations",
-          "key_path": [
-            "tui",
-            "animations"
-          ],
-          "top_level": "tui",
-          "type": "boolean",
-          "enum_values": [],
-          "description": "Enable terminal animations (welcome screen, shimmer, spinner) (default: true).",
-          "deprecated": false,
-          "ui": {
-            "control": "toggle"
-          }
-        },
-        "tui.alternate_screen": {
-          "key": "tui.alternate_screen",
-          "key_path": [
-            "tui",
-            "alternate_screen"
-          ],
-          "top_level": "tui",
-          "type": "auto | always | never",
-          "enum_values": [
-            "auto",
-            "always",
-            "never"
-          ],
-          "description": "Control alternate screen usage for the TUI (default: auto; auto skips it in Zellij to preserve scrollback).",
-          "deprecated": false,
-          "ui": {
-            "control": "select"
-          }
-        },
-        "tui.show_tooltips": {
-          "key": "tui.show_tooltips",
-          "key_path": [
-            "tui",
-            "show_tooltips"
-          ],
-          "top_level": "tui",
-          "type": "boolean",
-          "enum_values": [],
-          "description": "Show onboarding tooltips in the TUI welcome screen (default: true).",
-          "deprecated": false,
-          "ui": {
-            "control": "toggle"
-          }
-        },
-        "tui.status_line": {
-          "key": "tui.status_line",
-          "key_path": [
-            "tui",
-            "status_line"
-          ],
-          "top_level": "tui",
-          "type": "array<string> | null",
-          "enum_values": [
-            "array<string>",
-            "null"
-          ],
-          "description": "Ordered list of TUI footer status-line item identifiers. `null` disables the status line.",
-          "deprecated": false,
-          "ui": {
-            "control": "select"
-          }
-        },
-        "hide_agent_reasoning": {
-          "key": "hide_agent_reasoning",
-          "key_path": [
-            "hide_agent_reasoning"
-          ],
-          "top_level": "hide_agent_reasoning",
-          "type": "boolean",
-          "enum_values": [],
-          "description": "Suppress reasoning events in both the TUI and `codex exec` output.",
-          "deprecated": false,
-          "ui": {
-            "control": "toggle"
-          }
-        },
-        "show_raw_agent_reasoning": {
-          "key": "show_raw_agent_reasoning",
-          "key_path": [
-            "show_raw_agent_reasoning"
-          ],
-          "top_level": "show_raw_agent_reasoning",
-          "type": "boolean",
-          "enum_values": [],
-          "description": "Surface raw reasoning content when the active model emits it.",
-          "deprecated": false,
-          "ui": {
-            "control": "toggle"
-          }
-        },
-        "disable_paste_burst": {
           "key": "disable_paste_burst",
           "key_path": [
             "disable_paste_burst"
@@ -5036,10 +2904,10 @@
           "description": "Disable burst-paste detection in the TUI.",
           "deprecated": false,
           "ui": {
-            "control": "toggle"
+            "control": "text"
           }
         },
-        "windows_wsl_setup_acknowledged": {
+        {
           "key": "windows_wsl_setup_acknowledged",
           "key_path": [
             "windows_wsl_setup_acknowledged"
@@ -5050,10 +2918,10 @@
           "description": "Track Windows onboarding acknowledgement (Windows only).",
           "deprecated": false,
           "ui": {
-            "control": "toggle"
+            "control": "text"
           }
         },
-        "chatgpt_base_url": {
+        {
           "key": "chatgpt_base_url",
           "key_path": [
             "chatgpt_base_url"
@@ -5067,7 +2935,7 @@
             "control": "text"
           }
         },
-        "cli_auth_credentials_store": {
+        {
           "key": "cli_auth_credentials_store",
           "key_path": [
             "cli_auth_credentials_store"
@@ -5085,7 +2953,7 @@
             "control": "select"
           }
         },
-        "mcp_oauth_credentials_store": {
+        {
           "key": "mcp_oauth_credentials_store",
           "key_path": [
             "mcp_oauth_credentials_store"
@@ -5103,7 +2971,7 @@
             "control": "select"
           }
         },
-        "mcp_oauth_callback_port": {
+        {
           "key": "mcp_oauth_callback_port",
           "key_path": [
             "mcp_oauth_callback_port"
@@ -5117,7 +2985,21 @@
             "control": "text"
           }
         },
-        "experimental_use_unified_exec_tool": {
+        {
+          "key": "mcp_oauth_callback_url",
+          "key_path": [
+            "mcp_oauth_callback_url"
+          ],
+          "top_level": "mcp_oauth_callback_url",
+          "type": "string",
+          "enum_values": [],
+          "description": "Optional redirect URI override for MCP OAuth login (for example, a devbox ingress URL). `mcp_oauth_callback_port` still controls the callback listener port.",
+          "deprecated": false,
+          "ui": {
+            "control": "text"
+          }
+        },
+        {
           "key": "experimental_use_unified_exec_tool",
           "key_path": [
             "experimental_use_unified_exec_tool"
@@ -5128,10 +3010,10 @@
           "description": "Legacy name for enabling unified exec; prefer `[features].unified_exec` or `codex --enable unified_exec`.",
           "deprecated": false,
           "ui": {
-            "control": "toggle"
+            "control": "text"
           }
         },
-        "experimental_use_freeform_apply_patch": {
+        {
           "key": "experimental_use_freeform_apply_patch",
           "key_path": [
             "experimental_use_freeform_apply_patch"
@@ -5142,10 +3024,10 @@
           "description": "Legacy name for enabling freeform apply_patch; prefer `[features].apply_patch_freeform` or `codex --enable apply_patch_freeform`.",
           "deprecated": false,
           "ui": {
-            "control": "toggle"
+            "control": "text"
           }
         },
-        "include_apply_patch_tool": {
+        {
           "key": "include_apply_patch_tool",
           "key_path": [
             "include_apply_patch_tool"
@@ -5156,10 +3038,10 @@
           "description": "Legacy name for enabling freeform apply_patch; prefer `[features].apply_patch_freeform`.",
           "deprecated": false,
           "ui": {
-            "control": "toggle"
+            "control": "text"
           }
         },
-        "tools.web_search": {
+        {
           "key": "tools.web_search",
           "key_path": [
             "tools",
@@ -5169,12 +3051,12 @@
           "type": "boolean",
           "enum_values": [],
           "description": "Deprecated legacy toggle for web search; prefer the top-level `web_search` setting.",
-          "deprecated": true,
+          "deprecated": false,
           "ui": {
-            "control": "toggle"
+            "control": "text"
           }
         },
-        "web_search": {
+        {
           "key": "web_search",
           "key_path": [
             "web_search"
@@ -5192,7 +3074,7 @@
             "control": "select"
           }
         },
-        "projects.<path>.trust_level": {
+        {
           "key": "projects.<path>.trust_level",
           "key_path": [
             "projects",
@@ -5200,18 +3082,15 @@
             "trust_level"
           ],
           "top_level": "projects",
-          "type": "trusted | untrusted",
-          "enum_values": [
-            "trusted",
-            "untrusted"
-          ],
+          "type": "string",
+          "enum_values": [],
           "description": "Mark a project or worktree as trusted or untrusted (`\"trusted\"` | `\"untrusted\"`). Untrusted projects skip project-scoped `.codex/` layers.",
           "deprecated": false,
           "ui": {
-            "control": "select"
+            "control": "text"
           }
         },
-        "notice.hide_full_access_warning": {
+        {
           "key": "notice.hide_full_access_warning",
           "key_path": [
             "notice",
@@ -5223,10 +3102,10 @@
           "description": "Track acknowledgement of the full access warning prompt.",
           "deprecated": false,
           "ui": {
-            "control": "toggle"
+            "control": "text"
           }
         },
-        "notice.hide_world_writable_warning": {
+        {
           "key": "notice.hide_world_writable_warning",
           "key_path": [
             "notice",
@@ -5238,10 +3117,10 @@
           "description": "Track acknowledgement of the Windows world-writable directories warning.",
           "deprecated": false,
           "ui": {
-            "control": "toggle"
+            "control": "text"
           }
         },
-        "notice.hide_rate_limit_model_nudge": {
+        {
           "key": "notice.hide_rate_limit_model_nudge",
           "key_path": [
             "notice",
@@ -5253,10 +3132,10 @@
           "description": "Track opt-out of the rate limit model switch reminder.",
           "deprecated": false,
           "ui": {
-            "control": "toggle"
+            "control": "text"
           }
         },
-        "notice.hide_gpt5_1_migration_prompt": {
+        {
           "key": "notice.hide_gpt5_1_migration_prompt",
           "key_path": [
             "notice",
@@ -5268,10 +3147,10 @@
           "description": "Track acknowledgement of the GPT-5.1 migration prompt.",
           "deprecated": false,
           "ui": {
-            "control": "toggle"
+            "control": "text"
           }
         },
-        "notice.hide_gpt-5.1-codex-max_migration_prompt": {
+        {
           "key": "notice.hide_gpt-5.1-codex-max_migration_prompt",
           "key_path": [
             "notice",
@@ -5284,10 +3163,10 @@
           "description": "Track acknowledgement of the gpt-5.1-codex-max migration prompt.",
           "deprecated": false,
           "ui": {
-            "control": "toggle"
+            "control": "text"
           }
         },
-        "notice.model_migrations": {
+        {
           "key": "notice.model_migrations",
           "key_path": [
             "notice",
@@ -5299,10 +3178,10 @@
           "description": "Track acknowledged model migrations as old->new mappings.",
           "deprecated": false,
           "ui": {
-            "control": "key-value"
+            "control": "text"
           }
         },
-        "forced_login_method": {
+        {
           "key": "forced_login_method",
           "key_path": [
             "forced_login_method"
@@ -5319,7 +3198,7 @@
             "control": "select"
           }
         },
-        "forced_chatgpt_workspace_id": {
+        {
           "key": "forced_chatgpt_workspace_id",
           "key_path": [
             "forced_chatgpt_workspace_id"
@@ -5333,7 +3212,7 @@
             "control": "text"
           }
         }
-      }
+      ]
     },
     {
       "id": "requirements.toml",
@@ -5376,11 +3255,11 @@
           "keys": [
             "rules",
             "rules.prefix_rules",
+            "rules.prefix_rules[].decision",
+            "rules.prefix_rules[].justification",
             "rules.prefix_rules[].pattern",
-            "rules.prefix_rules[].pattern[].token",
             "rules.prefix_rules[].pattern[].any_of",
-            "rules.prefix_rules[].decision",
-            "rules.prefix_rules[].justification"
+            "rules.prefix_rules[].pattern[].token"
           ]
         }
       ],
@@ -5393,7 +3272,7 @@
           "top_level": "allowed_approval_policies",
           "type": "array<string>",
           "enum_values": [],
-          "description": "Allowed values for `approval_policy`.",
+          "description": "Allowed values for `approval_policy` (for example `untrusted`, `on-request`, `never`, and `reject`).",
           "deprecated": false,
           "ui": {
             "control": "list"
@@ -5517,7 +3396,7 @@
           "description": "List of enforced prefix rules. Each rule must include `pattern` and `decision`.",
           "deprecated": false,
           "ui": {
-            "control": "table-list"
+            "control": "list"
           }
         },
         {
@@ -5533,7 +3412,7 @@
           "description": "Command prefix expressed as pattern tokens. Each token sets either `token` or `any_of`.",
           "deprecated": false,
           "ui": {
-            "control": "table-list"
+            "control": "list"
           }
         },
         {
@@ -5605,233 +3484,11 @@
             "control": "text"
           }
         }
-      ],
-      "key_index": {
-        "allowed_approval_policies": {
-          "key": "allowed_approval_policies",
-          "key_path": [
-            "allowed_approval_policies"
-          ],
-          "top_level": "allowed_approval_policies",
-          "type": "array<string>",
-          "enum_values": [],
-          "description": "Allowed values for `approval_policy`.",
-          "deprecated": false,
-          "ui": {
-            "control": "list"
-          }
-        },
-        "allowed_sandbox_modes": {
-          "key": "allowed_sandbox_modes",
-          "key_path": [
-            "allowed_sandbox_modes"
-          ],
-          "top_level": "allowed_sandbox_modes",
-          "type": "array<string>",
-          "enum_values": [],
-          "description": "Allowed values for `sandbox_mode`.",
-          "deprecated": false,
-          "ui": {
-            "control": "list"
-          }
-        },
-        "allowed_web_search_modes": {
-          "key": "allowed_web_search_modes",
-          "key_path": [
-            "allowed_web_search_modes"
-          ],
-          "top_level": "allowed_web_search_modes",
-          "type": "array<string>",
-          "enum_values": [],
-          "description": "Allowed values for `web_search` (`disabled`, `cached`, `live`). `disabled` is always allowed; an empty list effectively allows only `disabled`.",
-          "deprecated": false,
-          "ui": {
-            "control": "list"
-          }
-        },
-        "mcp_servers": {
-          "key": "mcp_servers",
-          "key_path": [
-            "mcp_servers"
-          ],
-          "top_level": "mcp_servers",
-          "type": "table",
-          "enum_values": [],
-          "description": "Allowlist of MCP servers that may be enabled. Both the server name (`<id>`) and its identity must match for the MCP server to be enabled. Any configured MCP server not in the allowlist (or with a mismatched identity) is disabled.",
-          "deprecated": false,
-          "ui": {
-            "control": "section"
-          }
-        },
-        "mcp_servers.<id>.identity": {
-          "key": "mcp_servers.<id>.identity",
-          "key_path": [
-            "mcp_servers",
-            "<id>",
-            "identity"
-          ],
-          "top_level": "mcp_servers",
-          "type": "table",
-          "enum_values": [],
-          "description": "Identity rule for a single MCP server. Set either `command` (stdio) or `url` (streamable HTTP).",
-          "deprecated": false,
-          "ui": {
-            "control": "section"
-          }
-        },
-        "mcp_servers.<id>.identity.command": {
-          "key": "mcp_servers.<id>.identity.command",
-          "key_path": [
-            "mcp_servers",
-            "<id>",
-            "identity",
-            "command"
-          ],
-          "top_level": "mcp_servers",
-          "type": "string",
-          "enum_values": [],
-          "description": "Allow an MCP stdio server when its `mcp_servers.<id>.command` matches this command.",
-          "deprecated": false,
-          "ui": {
-            "control": "text"
-          }
-        },
-        "mcp_servers.<id>.identity.url": {
-          "key": "mcp_servers.<id>.identity.url",
-          "key_path": [
-            "mcp_servers",
-            "<id>",
-            "identity",
-            "url"
-          ],
-          "top_level": "mcp_servers",
-          "type": "string",
-          "enum_values": [],
-          "description": "Allow an MCP streamable HTTP server when its `mcp_servers.<id>.url` matches this URL.",
-          "deprecated": false,
-          "ui": {
-            "control": "text"
-          }
-        },
-        "rules": {
-          "key": "rules",
-          "key_path": [
-            "rules"
-          ],
-          "top_level": "rules",
-          "type": "table",
-          "enum_values": [],
-          "description": "Admin-enforced command rules merged with `.rules` files. Requirements rules must be restrictive.",
-          "deprecated": false,
-          "ui": {
-            "control": "section"
-          }
-        },
-        "rules.prefix_rules": {
-          "key": "rules.prefix_rules",
-          "key_path": [
-            "rules",
-            "prefix_rules"
-          ],
-          "top_level": "rules",
-          "type": "array<table>",
-          "enum_values": [],
-          "description": "List of enforced prefix rules. Each rule must include `pattern` and `decision`.",
-          "deprecated": false,
-          "ui": {
-            "control": "table-list"
-          }
-        },
-        "rules.prefix_rules[].pattern": {
-          "key": "rules.prefix_rules[].pattern",
-          "key_path": [
-            "rules",
-            "prefix_rules[]",
-            "pattern"
-          ],
-          "top_level": "rules",
-          "type": "array<table>",
-          "enum_values": [],
-          "description": "Command prefix expressed as pattern tokens. Each token sets either `token` or `any_of`.",
-          "deprecated": false,
-          "ui": {
-            "control": "table-list"
-          }
-        },
-        "rules.prefix_rules[].pattern[].token": {
-          "key": "rules.prefix_rules[].pattern[].token",
-          "key_path": [
-            "rules",
-            "prefix_rules[]",
-            "pattern[]",
-            "token"
-          ],
-          "top_level": "rules",
-          "type": "string",
-          "enum_values": [],
-          "description": "A single literal token at this position.",
-          "deprecated": false,
-          "ui": {
-            "control": "text"
-          }
-        },
-        "rules.prefix_rules[].pattern[].any_of": {
-          "key": "rules.prefix_rules[].pattern[].any_of",
-          "key_path": [
-            "rules",
-            "prefix_rules[]",
-            "pattern[]",
-            "any_of"
-          ],
-          "top_level": "rules",
-          "type": "array<string>",
-          "enum_values": [],
-          "description": "A list of allowed alternative tokens at this position.",
-          "deprecated": false,
-          "ui": {
-            "control": "list"
-          }
-        },
-        "rules.prefix_rules[].decision": {
-          "key": "rules.prefix_rules[].decision",
-          "key_path": [
-            "rules",
-            "prefix_rules[]",
-            "decision"
-          ],
-          "top_level": "rules",
-          "type": "prompt | forbidden",
-          "enum_values": [
-            "prompt",
-            "forbidden"
-          ],
-          "description": "Required. Requirements rules can only prompt or forbid (not allow).",
-          "deprecated": false,
-          "ui": {
-            "control": "select"
-          }
-        },
-        "rules.prefix_rules[].justification": {
-          "key": "rules.prefix_rules[].justification",
-          "key_path": [
-            "rules",
-            "prefix_rules[]",
-            "justification"
-          ],
-          "top_level": "rules",
-          "type": "string",
-          "enum_values": [],
-          "description": "Optional non-empty rationale surfaced in approval prompts or rejection messages.",
-          "deprecated": false,
-          "ui": {
-            "control": "text"
-          }
-        }
-      }
+      ]
     }
   ],
   "totals": {
     "document_count": 2,
-    "option_count": 165
+    "option_count": 181
   }
 }