nikcli 0.0.6

package/src/config/config.ts

@@ -0,0 +1,1760 @@
+import { Log } from "../util/log"
+import path from "path"
+import { pathToFileURL } from "url"
+import { createRequire } from "module"
+import os from "os"
+import z from "zod"
+import { Filesystem } from "../util/filesystem"
+import { ModelsDev } from "../provider/models"
+import { mergeDeep, pipe, unique } from "remeda"
+import { Global } from "../global"
+import fs from "fs/promises"
+import { lazy } from "../util/lazy"
+import { NamedError } from "@nikcli-ai/util/error"
+import { Flag } from "../flag/flag"
+import { Auth } from "../auth"
+import {
+  type ParseError as JsoncParseError,
+  applyEdits,
+  modify,
+  parse as parseJsonc,
+  printParseErrorCode,
+} from "jsonc-parser"
+import { Instance } from "../project/instance"
+import { LSPServer } from "../lsp/server"
+import { BunProc } from "@/bun"
+import { Installation } from "@/installation"
+import { ConfigMarkdown } from "./markdown"
+import { existsSync } from "fs"
+import { Bus } from "@/bus"
+import { GlobalBus } from "@/bus/global"
+import { Event } from "../server/event"
+
+export namespace Config {
+  const log = Log.create({ service: "config" })
+
+  // PluginSpec: string or [string, options] tuple
+  const _PluginOptions = z.record(z.string(), z.unknown())
+  export const PluginSpec = z.union([z.string(), z.tuple([z.string(), _PluginOptions])])
+  export type PluginOptions = z.infer<typeof _PluginOptions>
+  export type PluginSpec = z.infer<typeof PluginSpec>
+
+  function systemManagedConfigDir(): string {
+    switch (process.platform) {
+      case "darwin":
+        return "/Library/Application Support/nikcli"
+      case "win32":
+        return path.join(process.env.ProgramData || "C:\\ProgramData", "nikcli")
+      default:
+        return "/etc/nikcli"
+    }
+  }
+
+  export function managedConfigDir() {
+    return process.env["NIKCLI_TEST_MANAGED_CONFIG_DIR"] || systemManagedConfigDir()
+  }
+
+  export function pluginSpecifier(plugin: PluginSpec): string {
+    return Array.isArray(plugin) ? plugin[0] : plugin
+  }
+
+  export function pluginOptions(plugin: PluginSpec): PluginOptions | undefined {
+    return Array.isArray(plugin) ? (plugin[1] as PluginOptions) : undefined
+  }
+
+  export async function resolvePluginSpec(plugin: PluginSpec, configFilepath: string): Promise<PluginSpec> {
+    const { isPathPluginSpec, resolvePathPluginTarget } = await import("../plugin/shared")
+    const spec = pluginSpecifier(plugin)
+    if (!isPathPluginSpec(spec)) return plugin
+    if (spec.startsWith("file://")) {
+      const resolved = await resolvePathPluginTarget(spec).catch(() => spec)
+      if (Array.isArray(plugin)) return [resolved, plugin[1]]
+      return resolved
+    }
+    if (path.isAbsolute(spec) || /^[A-Za-z]:[\\/]/.test(spec)) {
+      const base = pathToFileURL(spec).href
+      const resolved = await resolvePathPluginTarget(base).catch(() => base)
+      if (Array.isArray(plugin)) return [resolved, plugin[1]]
+      return resolved
+    }
+    try {
+      const base = import.meta.resolve!(spec, configFilepath)
+      const resolved = await resolvePathPluginTarget(base).catch(() => base)
+      if (Array.isArray(plugin)) return [resolved, plugin[1]]
+      return resolved
+    } catch {
+      try {
+        const require = createRequire(configFilepath)
+        const base = pathToFileURL(require.resolve(spec)).href
+        const resolved = await resolvePathPluginTarget(base).catch(() => base)
+        if (Array.isArray(plugin)) return [resolved, plugin[1]]
+        return resolved
+      } catch {
+        return plugin
+      }
+    }
+  }
+
+  // Custom merge function that concatenates array fields instead of replacing them
+  function mergeConfigConcatArrays(target: Info, source: Info): Info {
+    const merged = mergeDeep(target, source)
+    if (target.plugin && source.plugin) {
+      merged.plugin = Array.from(new Set([...target.plugin, ...source.plugin]))
+    }
+    if (target.instructions && source.instructions) {
+      merged.instructions = Array.from(new Set([...target.instructions, ...source.instructions]))
+    }
+    return merged
+  }
+
+  export const state = Instance.state(async () => {
+    const auth = await Auth.all()
+
+    // Load remote/well-known config first as the base layer (lowest precedence)
+    // This allows organizations to provide default configs that users can override
+    let result: Info = {}
+    for (const [key, value] of Object.entries(auth)) {
+      if (value.type === "wellknown") {
+        process.env[value.key] = value.token
+        log.debug("fetching remote config", { url: `${key}/.well-known/nikcli` })
+        const response = await fetch(`${key}/.well-known/nikcli`)
+        if (!response.ok) {
+          throw new Error(`failed to fetch remote config from ${key}: ${response.status}`)
+        }
+        const wellknown = (await response.json()) as any
+        const remoteConfig = wellknown.config ?? {}
+        // Add $schema to prevent load() from trying to write back to a non-existent file
+        if (!remoteConfig.$schema) remoteConfig.$schema = "https://nikcli.store/config.json"
+        result = mergeConfigConcatArrays(result, await load(JSON.stringify(remoteConfig), `${key}/.well-known/nikcli`))
+        log.debug("loaded remote config from well-known", { url: key })
+      }
+    }
+
+    // Global user config overrides remote config
+    result = mergeConfigConcatArrays(result, await global())
+
+    // Custom config path overrides global
+    if (Flag.NIKCLI_CONFIG) {
+      result = mergeConfigConcatArrays(result, await loadFile(Flag.NIKCLI_CONFIG))
+      log.debug("loaded custom config", { path: Flag.NIKCLI_CONFIG })
+    }
+
+    // Project config has highest precedence (overrides global and remote)
+    if (!Flag.NIKCLI_DISABLE_PROJECT_CONFIG) {
+      for (const file of ["nikcli.jsonc", "nikcli.json", "config.json"]) {
+        const found = await Filesystem.findUp(file, Instance.directory, Instance.worktree)
+        for (const resolved of found.toReversed()) {
+          result = mergeConfigConcatArrays(result, await loadFile(resolved))
+        }
+      }
+    }
+
+    // Inline config content has highest precedence
+    if (Flag.NIKCLI_CONFIG_CONTENT) {
+      result = mergeConfigConcatArrays(result, JSON.parse(Flag.NIKCLI_CONFIG_CONTENT))
+      log.debug("loaded custom config from NIKCLI_CONFIG_CONTENT")
+    }
+
+    result.agent = result.agent || {}
+    result.mode = result.mode || {}
+    result.plugin = result.plugin || []
+
+    const directories = [
+      Global.Path.config,
+      // Only scan project .nikcli/ directories when project discovery is enabled
+      ...(!Flag.NIKCLI_DISABLE_PROJECT_CONFIG
+        ? await Array.fromAsync(
+            Filesystem.up({
+              targets: [".nikcli"],
+              start: Instance.directory,
+              stop: Instance.worktree,
+            }),
+          )
+        : []),
+      // Always scan ~/.nikcli/ (user home directory)
+      ...(await Array.fromAsync(
+        Filesystem.up({
+          targets: [".nikcli"],
+          start: Global.Path.home,
+          stop: Global.Path.home,
+        }),
+      )),
+    ]
+
+    if (Flag.NIKCLI_CONFIG_DIR) {
+      directories.push(Flag.NIKCLI_CONFIG_DIR)
+      log.debug("loading config from NIKCLI_CONFIG_DIR", { path: Flag.NIKCLI_CONFIG_DIR })
+    }
+
+    for (const dir of unique(directories)) {
+      if (dir.endsWith(".nikcli") || dir === Flag.NIKCLI_CONFIG_DIR) {
+        for (const file of ["config.json", "nikcli.jsonc", "nikcli.json"]) {
+          log.debug(`loading config from ${path.join(dir, file)}`)
+          result = mergeConfigConcatArrays(result, await loadFile(path.join(dir, file)))
+          // to satisfy the type checker
+          result.agent ??= {}
+          result.mode ??= {}
+          result.plugin ??= []
+        }
+      }
+
+      const exists = existsSync(path.join(dir, "node_modules"))
+      const installing = installDependencies(dir)
+      if (!exists) await installing
+
+      result.command = mergeDeep(result.command ?? {}, await loadCommand(dir))
+      result.agent = mergeDeep(result.agent, await loadAgent(dir))
+      result.agent = mergeDeep(result.agent, await loadMode(dir))
+      result.plugin.push(...(await loadPlugin(dir)))
+    }
+
+    // Migrate deprecated mode field to agent field
+    for (const [name, mode] of Object.entries(result.mode)) {
+      result.agent = mergeDeep(result.agent ?? {}, {
+        [name]: {
+          ...mode,
+          mode: "primary" as const,
+        },
+      })
+    }
+
+    if (Flag.NIKCLI_PERMISSION) {
+      result.permission = mergeDeep(result.permission ?? {}, JSON.parse(Flag.NIKCLI_PERMISSION))
+    }
+
+    // Backwards compatibility: legacy top-level `tools` config
+    if (result.tools) {
+      const perms: Record<string, Config.PermissionAction> = {}
+      for (const [tool, enabled] of Object.entries(result.tools)) {
+        const action: Config.PermissionAction = enabled ? "allow" : "deny"
+        if (tool === "write" || tool === "edit" || tool === "patch" || tool === "multiedit") {
+          perms.edit = action
+          continue
+        }
+        perms[tool] = action
+      }
+      result.permission = mergeDeep(perms, result.permission ?? {})
+    }
+
+    if (!result.username) result.username = os.userInfo().username
+
+    // Handle migration from autoshare to share field
+    if (result.autoshare === true && !result.share) {
+      result.share = "auto"
+    }
+
+    if (!result.keybinds) result.keybinds = Info.shape.keybinds.parse({})
+
+    // Apply flag overrides for compaction settings
+    if (Flag.NIKCLI_DISABLE_AUTOCOMPACT) {
+      result.compaction = { ...result.compaction, auto: false }
+    }
+    if (Flag.NIKCLI_DISABLE_PRUNE) {
+      result.compaction = { ...result.compaction, prune: false }
+    }
+
+    result.plugin = deduplicatePlugins(result.plugin ?? [])
+
+    return {
+      config: result,
+      directories,
+    }
+  })
+
+  export async function installDependencies(dir: string) {
+    const pkg = path.join(dir, "package.json")
+
+    if (!(await Bun.file(pkg).exists())) {
+      await Bun.write(pkg, "{}")
+    }
+
+    const gitignore = path.join(dir, ".gitignore")
+    const hasGitIgnore = await Bun.file(gitignore).exists()
+    if (!hasGitIgnore) await Bun.write(gitignore, ["node_modules", "package.json", "bun.lock", ".gitignore"].join("\n"))
+
+    await BunProc.run(
+      ["add", "@nikcli-ai/plugin@" + (Installation.isLocal() ? "latest" : Installation.VERSION), "--exact"],
+      {
+        cwd: dir,
+      },
+    ).catch(() => {})
+
+    // Install any additional dependencies defined in the package.json
+    // This allows local plugins and custom tools to use external packages
+    await BunProc.run(["install"], { cwd: dir }).catch(() => {})
+  }
+
+  function rel(item: string, patterns: string[]) {
+    for (const pattern of patterns) {
+      const index = item.indexOf(pattern)
+      if (index === -1) continue
+      return item.slice(index + pattern.length)
+    }
+  }
+
+  function trim(file: string) {
+    const ext = path.extname(file)
+    return ext.length ? file.slice(0, -ext.length) : file
+  }
+
+  const COMMAND_GLOB = new Bun.Glob("{command,commands}/**/*.md")
+  async function loadCommand(dir: string) {
+    const result: Record<string, Command> = {}
+    for await (const item of COMMAND_GLOB.scan({
+      absolute: true,
+      followSymlinks: true,
+      dot: true,
+      cwd: dir,
+    })) {
+      const md = await ConfigMarkdown.parse(item).catch(async (err) => {
+        const message = ConfigMarkdown.FrontmatterError.isInstance(err)
+          ? err.data.message
+          : `Failed to parse command ${item}`
+        const { Session } = await import("@/session")
+        Bus.publish(Session.Event.Error, { error: new NamedError.Unknown({ message }).toObject() })
+        log.error("failed to load command", { command: item, err })
+        return undefined
+      })
+      if (!md) continue
+
+      const patterns = ["/.nikcli/command/", "/.nikcli/commands/", "/command/", "/commands/"]
+      const file = rel(item, patterns) ?? path.basename(item)
+      const name = trim(file)
+
+      const config = {
+        name,
+        ...md.data,
+        template: md.content.trim(),
+      }
+      const parsed = Command.safeParse(config)
+      if (parsed.success) {
+        result[config.name] = parsed.data
+        continue
+      }
+      throw new InvalidError({ path: item, issues: parsed.error.issues }, { cause: parsed.error })
+    }
+    return result
+  }
+
+  const AGENT_GLOB = new Bun.Glob("{agent,agents}/**/*.md")
+  async function loadAgent(dir: string) {
+    const result: Record<string, Agent> = {}
+
+    for await (const item of AGENT_GLOB.scan({
+      absolute: true,
+      followSymlinks: true,
+      dot: true,
+      cwd: dir,
+    })) {
+      const md = await ConfigMarkdown.parse(item).catch(async (err) => {
+        const message = ConfigMarkdown.FrontmatterError.isInstance(err)
+          ? err.data.message
+          : `Failed to parse agent ${item}`
+        const { Session } = await import("@/session")
+        Bus.publish(Session.Event.Error, { error: new NamedError.Unknown({ message }).toObject() })
+        log.error("failed to load agent", { agent: item, err })
+        return undefined
+      })
+      if (!md) continue
+
+      const patterns = ["/.nikcli/agent/", "/.nikcli/agents/", "/agent/", "/agents/"]
+      const file = rel(item, patterns) ?? path.basename(item)
+      const agentName = trim(file)
+
+      const config = {
+        name: agentName,
+        ...md.data,
+        prompt: md.content.trim(),
+      }
+      const parsed = Agent.safeParse(config)
+      if (parsed.success) {
+        result[config.name] = parsed.data
+        continue
+      }
+      throw new InvalidError({ path: item, issues: parsed.error.issues }, { cause: parsed.error })
+    }
+    return result
+  }
+
+  const MODE_GLOB = new Bun.Glob("{mode,modes}/*.md")
+  async function loadMode(dir: string) {
+    const result: Record<string, Agent> = {}
+    for await (const item of MODE_GLOB.scan({
+      absolute: true,
+      followSymlinks: true,
+      dot: true,
+      cwd: dir,
+    })) {
+      const md = await ConfigMarkdown.parse(item).catch(async (err) => {
+        const message = ConfigMarkdown.FrontmatterError.isInstance(err)
+          ? err.data.message
+          : `Failed to parse mode ${item}`
+        const { Session } = await import("@/session")
+        Bus.publish(Session.Event.Error, { error: new NamedError.Unknown({ message }).toObject() })
+        log.error("failed to load mode", { mode: item, err })
+        return undefined
+      })
+      if (!md) continue
+
+      const config = {
+        name: path.basename(item, ".md"),
+        ...md.data,
+        prompt: md.content.trim(),
+      }
+      const parsed = Agent.safeParse(config)
+      if (parsed.success) {
+        result[config.name] = {
+          ...parsed.data,
+          mode: "primary" as const,
+        }
+        continue
+      }
+    }
+    return result
+  }
+
+  const PLUGIN_GLOB = new Bun.Glob("{plugin,plugins}/*.{ts,js}")
+  async function loadPlugin(dir: string) {
+    const plugins: string[] = []
+
+    for await (const item of PLUGIN_GLOB.scan({
+      absolute: true,
+      followSymlinks: true,
+      dot: true,
+      cwd: dir,
+    })) {
+      plugins.push(pathToFileURL(item).href)
+    }
+    return plugins
+  }
+
+  /**
+   * Extracts a canonical plugin name from a plugin specifier.
+   * - For file:// URLs: extracts filename without extension
+   * - For npm packages: extracts package name without version
+   *
+   * @example
+   * getPluginName("file:///path/to/plugin/foo.js") // "foo"
+   * getPluginName("oh-my-nikcli@2.4.3") // "oh-my-nikcli"
+   * getPluginName("@scope/pkg@1.0.0") // "@scope/pkg"
+   */
+  export function getPluginName(plugin: string): string {
+    if (plugin.startsWith("file://")) {
+      return path.parse(new URL(plugin).pathname).name
+    }
+    const lastAt = plugin.lastIndexOf("@")
+    if (lastAt > 0) {
+      return plugin.substring(0, lastAt)
+    }
+    return plugin
+  }
+
+  /**
+   * Deduplicates plugins by name, with later entries (higher priority) winning.
+   * Priority order (highest to lowest):
+   * 1. Local plugin/ directory
+   * 2. Local nikcli.json
+   * 3. Global plugin/ directory
+   * 4. Global nikcli.json
+   *
+   * Since plugins are added in low-to-high priority order,
+   * we reverse, deduplicate (keeping first occurrence), then restore order.
+   */
+  export function deduplicatePlugins(plugins: string[]): string[] {
+    // seenNames: canonical plugin names for duplicate detection
+    // e.g., "oh-my-nikcli", "@scope/pkg"
+    const seenNames = new Set<string>()
+
+    // uniqueSpecifiers: full plugin specifiers to return
+    // e.g., "oh-my-nikcli@2.4.3", "file:///path/to/plugin.js"
+    const uniqueSpecifiers: string[] = []
+
+    for (const specifier of plugins.toReversed()) {
+      const name = getPluginName(specifier)
+      if (!seenNames.has(name)) {
+        seenNames.add(name)
+        uniqueSpecifiers.push(specifier)
+      }
+    }
+
+    return uniqueSpecifiers.toReversed()
+  }
+
+  export const McpLocal = z
+    .object({
+      type: z.literal("local").describe("Type of MCP server connection"),
+      command: z.string().array().describe("Command and arguments to run the MCP server"),
+      environment: z
+        .record(z.string(), z.string())
+        .optional()
+        .describe("Environment variables to set when running the MCP server"),
+      enabled: z.boolean().optional().describe("Enable or disable the MCP server on startup"),
+      timeout: z
+        .number()
+        .int()
+        .positive()
+        .optional()
+        .describe("Timeout in ms for MCP server requests. Defaults to 5000 (5 seconds) if not specified."),
+    })
+    .strict()
+    .meta({
+      ref: "McpLocalConfig",
+    })
+
+  export const McpOAuth = z
+    .object({
+      clientId: z
+        .string()
+        .optional()
+        .describe("OAuth client ID. If not provided, dynamic client registration (RFC 7591) will be attempted."),
+      clientSecret: z.string().optional().describe("OAuth client secret (if required by the authorization server)"),
+      scope: z.string().optional().describe("OAuth scopes to request during authorization"),
+    })
+    .strict()
+    .meta({
+      ref: "McpOAuthConfig",
+    })
+  export type McpOAuth = z.infer<typeof McpOAuth>
+
+  export const McpRemote = z
+    .object({
+      type: z.literal("remote").describe("Type of MCP server connection"),
+      url: z.string().describe("URL of the remote MCP server"),
+      enabled: z.boolean().optional().describe("Enable or disable the MCP server on startup"),
+      headers: z.record(z.string(), z.string()).optional().describe("Headers to send with the request"),
+      oauth: z
+        .union([McpOAuth, z.literal(false)])
+        .optional()
+        .describe(
+          "OAuth authentication configuration for the MCP server. Set to false to disable OAuth auto-detection.",
+        ),
+      timeout: z
+        .number()
+        .int()
+        .positive()
+        .optional()
+        .describe("Timeout in ms for MCP server requests. Defaults to 5000 (5 seconds) if not specified."),
+    })
+    .strict()
+    .meta({
+      ref: "McpRemoteConfig",
+    })
+
+  export const Mcp = z.discriminatedUnion("type", [McpLocal, McpRemote])
+  export type Mcp = z.infer<typeof Mcp>
+
+  export const ConnectorFigma = z
+    .object({
+      type: z.literal("figma"),
+      token: z.string().optional().describe("Figma personal access token"),
+      enabled: z.boolean().optional(),
+    })
+    .strict()
+    .meta({ ref: "ConnectorFigma" })
+  export type ConnectorFigma = z.infer<typeof ConnectorFigma>
+
+  export const ConnectorSlack = z
+    .object({
+      type: z.literal("slack"),
+      botToken: z.string().optional().describe("Slack bot token"),
+      teamId: z.string().optional().describe("Slack team ID"),
+      enabled: z.boolean().optional(),
+    })
+    .strict()
+    .meta({ ref: "ConnectorSlack" })
+  export type ConnectorSlack = z.infer<typeof ConnectorSlack>
+
+  export const ConnectorGithub = z
+    .object({
+      type: z.literal("github"),
+      token: z.string().optional().describe("GitHub personal access token"),
+      oauthClientId: z.string().optional().describe("GitHub OAuth client ID for mobile device flow"),
+      clientId: z.string().optional().describe("Alias for GitHub OAuth client ID"),
+      enabled: z.boolean().optional(),
+    })
+    .strict()
+    .meta({ ref: "ConnectorGithub" })
+  export type ConnectorGithub = z.infer<typeof ConnectorGithub>
+
+  export const ConnectorLovable = z
+    .object({
+      type: z.literal("lovable"),
+      token: z.string().optional().describe("Lovable API key"),
+      apiKey: z.string().optional().describe("Legacy Lovable API key"),
+      enabled: z.boolean().optional(),
+    })
+    .strict()
+    .meta({ ref: "ConnectorLovable" })
+  export type ConnectorLovable = z.infer<typeof ConnectorLovable>
+
+  export const ConnectorDiscord = z
+    .object({
+      type: z.literal("discord"),
+      botToken: z.string().optional().describe("Discord bot token"),
+      enabled: z.boolean().optional(),
+    })
+    .strict()
+    .meta({ ref: "ConnectorDiscord" })
+  export type ConnectorDiscord = z.infer<typeof ConnectorDiscord>
+
+  export const ConnectorTeams = z
+    .object({
+      type: z.literal("teams"),
+      botToken: z.string().optional().describe("Microsoft Teams bot token"),
+      enabled: z.boolean().optional(),
+    })
+    .strict()
+    .meta({ ref: "ConnectorTeams" })
+  export type ConnectorTeams = z.infer<typeof ConnectorTeams>
+
+  export const ConnectorGChat = z
+    .object({
+      type: z.literal("gchat"),
+      botToken: z.string().optional().describe("Google Chat bot token"),
+      enabled: z.boolean().optional(),
+    })
+    .strict()
+    .meta({ ref: "ConnectorGChat" })
+  export type ConnectorGChat = z.infer<typeof ConnectorGChat>
+
+  export const ConnectorLinear = z
+    .object({
+      type: z.literal("linear"),
+      botToken: z.string().optional().describe("Linear bot token"),
+      enabled: z.boolean().optional(),
+    })
+    .strict()
+    .meta({ ref: "ConnectorLinear" })
+  export type ConnectorLinear = z.infer<typeof ConnectorLinear>
+
+  export const Connector = z.discriminatedUnion("type", [
+    ConnectorFigma,
+    ConnectorSlack,
+    ConnectorGithub,
+    ConnectorLovable,
+    ConnectorDiscord,
+    ConnectorTeams,
+    ConnectorGChat,
+    ConnectorLinear,
+  ])
+  export type Connector = z.infer<typeof Connector>
+
+  export const PermissionAction = z.enum(["ask", "allow", "deny"]).meta({
+    ref: "PermissionActionConfig",
+  })
+  export type PermissionAction = z.infer<typeof PermissionAction>
+
+  export const PermissionObject = z.record(z.string(), PermissionAction).meta({
+    ref: "PermissionObjectConfig",
+  })
+  export type PermissionObject = z.infer<typeof PermissionObject>
+
+  export const PermissionRule = z.union([PermissionAction, PermissionObject]).meta({
+    ref: "PermissionRuleConfig",
+  })
+  export type PermissionRule = z.infer<typeof PermissionRule>
+
+  // Capture original key order before zod reorders, then rebuild in original order
+  const permissionPreprocess = (val: unknown) => {
+    if (typeof val === "object" && val !== null && !Array.isArray(val)) {
+      return { __originalKeys: Object.keys(val), ...val }
+    }
+    return val
+  }
+
+  const permissionTransform = (x: unknown): Record<string, PermissionRule> => {
+    if (typeof x === "string") return { "*": x as PermissionAction }
+    const obj = x as { __originalKeys?: string[] } & Record<string, unknown>
+    const { __originalKeys, ...rest } = obj
+    if (!__originalKeys) return rest as Record<string, PermissionRule>
+    const result: Record<string, PermissionRule> = {}
+    for (const key of __originalKeys) {
+      if (key in rest) result[key] = rest[key] as PermissionRule
+    }
+    return result
+  }
+
+  export const Permission = z
+    .preprocess(
+      permissionPreprocess,
+      z
+        .object({
+          __originalKeys: z.string().array().optional(),
+          read: PermissionRule.optional(),
+          edit: PermissionRule.optional(),
+          glob: PermissionRule.optional(),
+          grep: PermissionRule.optional(),
+          list: PermissionRule.optional(),
+          tree: PermissionRule.optional(),
+          bash: PermissionRule.optional(),
+          task: PermissionRule.optional(),
+          subagents: PermissionRule.optional(),
+          docs_add: PermissionRule.optional(),
+          docs_search: PermissionRule.optional(),
+          docs_load: PermissionRule.optional(),
+          docs_unload: PermissionRule.optional(),
+          docs_context: PermissionRule.optional(),
+          docs_request: PermissionRule.optional(),
+          docs_gap_report: PermissionRule.optional(),
+          smart_docs: PermissionRule.optional(),
+          context_collect: PermissionRule.optional(),
+          context_search: PermissionRule.optional(),
+          context_related: PermissionRule.optional(),
+          context_diagnostics: PermissionRule.optional(),
+          memory_search: PermissionRule.optional(),
+          rag_index: PermissionRule.optional(),
+          rag_search: PermissionRule.optional(),
+          rag_status: PermissionRule.optional(),
+          rag_reset: PermissionRule.optional(),
+          generate_image: PermissionRule.optional(),
+          external_directory: PermissionRule.optional(),
+          todowrite: PermissionAction.optional(),
+          todoread: PermissionAction.optional(),
+          question: PermissionAction.optional(),
+          webfetch: PermissionAction.optional(),
+          websearch: PermissionAction.optional(),
+          codesearch: PermissionAction.optional(),
+          speak: PermissionRule.optional(),
+          lsp: PermissionRule.optional(),
+          doom_loop: PermissionAction.optional(),
+        })
+        .catchall(PermissionRule)
+        .or(PermissionAction),
+    )
+    .transform(permissionTransform)
+    .meta({
+      ref: "PermissionConfig",
+    })
+  export type Permission = z.infer<typeof Permission>
+
+  export const Command = z.object({
+    template: z.string(),
+    description: z.string().optional(),
+    agent: z.string().optional(),
+    model: z.string().optional(),
+    subtask: z.boolean().optional(),
+  })
+  export type Command = z.infer<typeof Command>
+
+  export const Agent = z
+    .object({
+      model: z.string().optional(),
+      variant: z
+        .string()
+        .optional()
+        .describe("Default model variant for this agent (applies only when using the agent's configured model)."),
+      temperature: z.number().optional(),
+      top_p: z.number().optional(),
+      prompt: z.string().optional(),
+      tools: z.record(z.string(), z.boolean()).optional().describe("@deprecated Use 'permission' field instead"),
+      disable: z.boolean().optional(),
+      description: z.string().optional().describe("Description of when to use the agent"),
+      mode: z.enum(["subagent", "primary", "all"]).optional(),
+      hidden: z
+        .boolean()
+        .optional()
+        .describe("Hide this subagent from the @ autocomplete menu (default: false, only applies to mode: subagent)"),
+      options: z.record(z.string(), z.any()).optional(),
+      color: z
+        .string()
+        .regex(/^#[0-9a-fA-F]{6}$/, "Invalid hex color format")
+        .optional()
+        .describe("Hex color code for the agent (e.g., #FF5733)"),
+      steps: z
+        .number()
+        .int()
+        .positive()
+        .optional()
+        .describe("Maximum number of agentic iterations before forcing text-only response"),
+      maxSteps: z.number().int().positive().optional().describe("@deprecated Use 'steps' field instead."),
+      permission: Permission.optional(),
+    })
+    .catchall(z.any())
+    .transform((agent, ctx) => {
+      const knownKeys = new Set([
+        "name",
+        "model",
+        "variant",
+        "prompt",
+        "description",
+        "temperature",
+        "top_p",
+        "mode",
+        "hidden",
+        "color",
+        "steps",
+        "maxSteps",
+        "options",
+        "permission",
+        "disable",
+        "tools",
+      ])
+
+      // Extract unknown properties into options
+      const options: Record<string, unknown> = { ...agent.options }
+      for (const [key, value] of Object.entries(agent)) {
+        if (!knownKeys.has(key)) options[key] = value
+      }
+
+      // Convert legacy tools config to permissions
+      const permission: Permission = {}
+      for (const [tool, enabled] of Object.entries(agent.tools ?? {})) {
+        const action = enabled ? "allow" : "deny"
+        // write, edit, patch, multiedit all map to edit permission
+        if (tool === "write" || tool === "edit" || tool === "patch" || tool === "multiedit") {
+          permission.edit = action
+        } else {
+          permission[tool] = action
+        }
+      }
+      Object.assign(permission, agent.permission)
+
+      // Convert legacy maxSteps to steps
+      const steps = agent.steps ?? agent.maxSteps
+
+      return { ...agent, options, permission, steps } as typeof agent & {
+        options?: Record<string, unknown>
+        permission?: Permission
+        steps?: number
+      }
+    })
+    .meta({
+      ref: "AgentConfig",
+    })
+  export type Agent = z.infer<typeof Agent>
+
+  export const Keybinds = z
+    .object({
+      leader: z.string().optional().default("ctrl+x").describe("Leader key for keybind combinations"),
+      app_exit: z.string().optional().default("ctrl+c,ctrl+d,<leader>q").describe("Exit the application"),
+      editor_open: z.string().optional().default("<leader>e").describe("Open external editor"),
+      theme_list: z.string().optional().default("<leader>t").describe("List available themes"),
+      sidebar_toggle: z.string().optional().default("<leader>b").describe("Toggle sidebar"),
+      scrollbar_toggle: z.string().optional().default("none").describe("Toggle session scrollbar"),
+      username_toggle: z.string().optional().default("none").describe("Toggle username visibility"),
+      status_view: z.string().optional().default("<leader>s").describe("View status"),
+      session_export: z.string().optional().default("<leader>x").describe("Export session to editor"),
+      session_new: z.string().optional().default("<leader>n").describe("Create a new session"),
+      session_list: z.string().optional().default("<leader>l").describe("List all sessions"),
+      session_timeline: z.string().optional().default("<leader>g").describe("Show session timeline"),
+      session_fork: z.string().optional().default("none").describe("Fork session from message"),
+      session_rename: z.string().optional().default("ctrl+r").describe("Rename session"),
+      session_delete: z.string().optional().default("ctrl+d").describe("Delete session"),
+      stash_delete: z.string().optional().default("ctrl+d").describe("Delete stash entry"),
+      model_provider_list: z.string().optional().default("ctrl+a").describe("Open provider list from model dialog"),
+      model_favorite_toggle: z.string().optional().default("ctrl+f").describe("Toggle model favorite status"),
+      session_share: z.string().optional().default("none").describe("Share current session"),
+      session_unshare: z.string().optional().default("none").describe("Unshare current session"),
+      session_interrupt: z.string().optional().default("escape").describe("Interrupt current session"),
+      subtask_background: z
+        .string()
+        .optional()
+        .default("ctrl+b")
+        .describe("Background current subtask and return to parent session"),
+      subtask_picker: z.string().optional().default("down").describe("Open background subtask picker"),
+      session_compact: z.string().optional().default("<leader>c").describe("Compact the session"),
+      messages_page_up: z.string().optional().default("pageup,ctrl+alt+b").describe("Scroll messages up by one page"),
+      messages_page_down: z
+        .string()
+        .optional()
+        .default("pagedown,ctrl+alt+f")
+        .describe("Scroll messages down by one page"),
+      messages_line_up: z.string().optional().default("ctrl+alt+y").describe("Scroll messages up by one line"),
+      messages_line_down: z.string().optional().default("ctrl+alt+e").describe("Scroll messages down by one line"),
+      messages_half_page_up: z.string().optional().default("ctrl+alt+u").describe("Scroll messages up by half page"),
+      messages_half_page_down: z
+        .string()
+        .optional()
+        .default("ctrl+alt+d")
+        .describe("Scroll messages down by half page"),
+      messages_first: z.string().optional().default("ctrl+g,home").describe("Navigate to first message"),
+      messages_last: z.string().optional().default("ctrl+alt+g,end").describe("Navigate to last message"),
+      messages_next: z.string().optional().default("none").describe("Navigate to next message"),
+      messages_previous: z.string().optional().default("none").describe("Navigate to previous message"),
+      messages_last_user: z.string().optional().default("none").describe("Navigate to last user message"),
+      messages_copy: z.string().optional().default("<leader>y").describe("Copy message"),
+      messages_undo: z.string().optional().default("<leader>u").describe("Undo message"),
+      messages_redo: z.string().optional().default("<leader>r").describe("Redo message"),
+      messages_toggle_conceal: z
+        .string()
+        .optional()
+        .default("<leader>h")
+        .describe("Toggle code block concealment in messages"),
+      tool_details: z.string().optional().default("none").describe("Toggle tool details visibility"),
+      model_list: z.string().optional().default("<leader>m").describe("List available models"),
+      model_cycle_recent: z.string().optional().default("f2").describe("Next recently used model"),
+      model_cycle_recent_reverse: z.string().optional().default("shift+f2").describe("Previous recently used model"),
+      model_cycle_favorite: z.string().optional().default("none").describe("Next favorite model"),
+      model_cycle_favorite_reverse: z.string().optional().default("none").describe("Previous favorite model"),
+      command_list: z.string().optional().default("ctrl+p").describe("List available commands"),
+      agent_list: z.string().optional().default("<leader>a").describe("List agents"),
+      agent_cycle: z.string().optional().default("tab").describe("Next agent"),
+      agent_cycle_reverse: z.string().optional().default("shift+tab").describe("Previous agent"),
+      variant_cycle: z.string().optional().default("ctrl+t").describe("Cycle model variants"),
+      input_clear: z.string().optional().default("ctrl+c").describe("Clear input field"),
+      input_paste: z.string().optional().default("ctrl+v").describe("Paste from clipboard"),
+      input_submit: z.string().optional().default("return").describe("Submit input"),
+      input_newline: z
+        .string()
+        .optional()
+        .default("shift+return,ctrl+return,alt+return,ctrl+j")
+        .describe("Insert newline in input"),
+      input_move_left: z.string().optional().default("left,ctrl+b").describe("Move cursor left in input"),
+      input_move_right: z.string().optional().default("right,ctrl+f").describe("Move cursor right in input"),
+      input_move_up: z.string().optional().default("up").describe("Move cursor up in input"),
+      input_move_down: z.string().optional().default("down").describe("Move cursor down in input"),
+      input_select_left: z.string().optional().default("shift+left").describe("Select left in input"),
+      input_select_right: z.string().optional().default("shift+right").describe("Select right in input"),
+      input_select_up: z.string().optional().default("shift+up").describe("Select up in input"),
+      input_select_down: z.string().optional().default("shift+down").describe("Select down in input"),
+      input_line_home: z.string().optional().default("ctrl+a").describe("Move to start of line in input"),
+      input_line_end: z.string().optional().default("ctrl+e").describe("Move to end of line in input"),
+      input_select_line_home: z
+        .string()
+        .optional()
+        .default("ctrl+shift+a")
+        .describe("Select to start of line in input"),
+      input_select_line_end: z.string().optional().default("ctrl+shift+e").describe("Select to end of line in input"),
+      input_visual_line_home: z.string().optional().default("alt+a").describe("Move to start of visual line in input"),
+      input_visual_line_end: z.string().optional().default("alt+e").describe("Move to end of visual line in input"),
+      input_select_visual_line_home: z
+        .string()
+        .optional()
+        .default("alt+shift+a")
+        .describe("Select to start of visual line in input"),
+      input_select_visual_line_end: z
+        .string()
+        .optional()
+        .default("alt+shift+e")
+        .describe("Select to end of visual line in input"),
+      input_buffer_home: z.string().optional().default("home").describe("Move to start of buffer in input"),
+      input_buffer_end: z.string().optional().default("end").describe("Move to end of buffer in input"),
+      input_select_buffer_home: z
+        .string()
+        .optional()
+        .default("shift+home")
+        .describe("Select to start of buffer in input"),
+      input_select_buffer_end: z.string().optional().default("shift+end").describe("Select to end of buffer in input"),
+      input_delete_line: z.string().optional().default("ctrl+shift+d").describe("Delete line in input"),
+      input_delete_to_line_end: z.string().optional().default("ctrl+k").describe("Delete to end of line in input"),
+      input_delete_to_line_start: z.string().optional().default("ctrl+u").describe("Delete to start of line in input"),
+      input_backspace: z.string().optional().default("backspace,shift+backspace").describe("Backspace in input"),
+      input_delete: z.string().optional().default("ctrl+d,delete,shift+delete").describe("Delete character in input"),
+      input_undo: z.string().optional().default("ctrl+-,super+z").describe("Undo in input"),
+      input_redo: z.string().optional().default("ctrl+.,super+shift+z").describe("Redo in input"),
+      input_word_forward: z
+        .string()
+        .optional()
+        .default("alt+f,alt+right,ctrl+right")
+        .describe("Move word forward in input"),
+      input_word_backward: z
+        .string()
+        .optional()
+        .default("alt+b,alt+left,ctrl+left")
+        .describe("Move word backward in input"),
+      input_select_word_forward: z
+        .string()
+        .optional()
+        .default("alt+shift+f,alt+shift+right")
+        .describe("Select word forward in input"),
+      input_select_word_backward: z
+        .string()
+        .optional()
+        .default("alt+shift+b,alt+shift+left")
+        .describe("Select word backward in input"),
+      input_delete_word_forward: z
+        .string()
+        .optional()
+        .default("alt+d,alt+delete,ctrl+delete")
+        .describe("Delete word forward in input"),
+      input_delete_word_backward: z
+        .string()
+        .optional()
+        .default("ctrl+w,ctrl+backspace,alt+backspace")
+        .describe("Delete word backward in input"),
+      history_previous: z.string().optional().default("up").describe("Previous history item"),
+      history_next: z.string().optional().default("down").describe("Next history item"),
+      session_child_cycle: z.string().optional().default("<leader>right").describe("Next child session"),
+      session_child_cycle_reverse: z.string().optional().default("<leader>left").describe("Previous child session"),
+      // NOTE: for subtasks we prefer `subtask_background` (ctrl+b) which also
+      // adds the child back to the background list. Keep this bound to ctrl+b
+      // so "Parent" in subagent sessions matches the behavior users expect.
+      session_parent: z.string().optional().default("ctrl+b").describe("Go to parent session"),
+      session_child_close: z.string().optional().default("<leader>c").describe("Close subagent session"),
+      terminal_suspend: z.string().optional().default("ctrl+z").describe("Suspend terminal"),
+      terminal_title_toggle: z.string().optional().default("none").describe("Toggle terminal title"),
+      tips_toggle: z.string().optional().default("<leader>h").describe("Toggle tips on home screen"),
+      voice_record: z.string().optional().default("ctrl+alt+v").describe("Toggle voice recording (push to talk)"),
+    })
+    .strict()
+    .meta({
+      ref: "KeybindsConfig",
+    })
+
+  export const TUI = z.object({
+    scroll_speed: z.number().min(0.001).optional().describe("TUI scroll speed"),
+    scroll_acceleration: z
+      .object({
+        enabled: z.boolean().describe("Enable scroll acceleration"),
+      })
+      .optional()
+      .describe("Scroll acceleration settings"),
+    diff_style: z
+      .enum(["auto", "stacked"])
+      .optional()
+      .describe("Control diff rendering style: 'auto' adapts to terminal width, 'stacked' always shows single column"),
+  })
+
+  export const AdsItem = z
+    .object({
+      id: z.string().describe("Unique ad identifier"),
+      text: z.string().describe("Ad message text"),
+      url: z.string().url().optional().describe("Optional URL to show with the ad"),
+      enabled: z.boolean().optional().describe("Enable this ad"),
+    })
+    .strict()
+    .meta({
+      ref: "AdsItemConfig",
+    })
+  export type AdsItem = z.infer<typeof AdsItem>
+
+  export const Ads = z
+    .object({
+      enabled: z.boolean().optional().describe("Enable ads in the TUI"),
+      ratio: z.number().min(0).max(1).optional().describe("Chance to show an ad instead of a tip (0-1)"),
+      items: z.array(AdsItem).optional().describe("User-defined ads"),
+    })
+    .strict()
+    .meta({
+      ref: "AdsConfig",
+    })
+  export type Ads = z.infer<typeof Ads>
+
+  export const Server = z
+    .object({
+      port: z.number().int().positive().optional().describe("Port to listen on"),
+      hostname: z.string().optional().describe("Hostname to listen on"),
+      mdns: z.boolean().optional().describe("Enable mDNS service discovery"),
+      cors: z.array(z.string()).optional().describe("Additional domains to allow for CORS"),
+    })
+    .strict()
+    .meta({
+      ref: "ServerConfig",
+    })
+
+  export const Remote = z
+    .object({
+      enabled: z.boolean().optional().describe("Enable Remote Control automatically for all TUI sessions"),
+      enableTunnel: z.boolean().optional().describe("Enable public tunnel by default for Remote Control"),
+      provider: z
+        .enum(["localtunnel", "cloudflared", "ngrok", "remotosh", "none"])
+        .optional()
+        .describe("Preferred tunnel provider for Remote Control"),
+      askOnExistingSession: z
+        .boolean()
+        .optional()
+        .describe("Prompt to continue existing remote session or start a new one"),
+    })
+    .strict()
+    .meta({
+      ref: "RemoteConfig",
+    })
+  export type Remote = z.infer<typeof Remote>
+
+  export const Layout = z.enum(["auto", "stretch"]).meta({
+    ref: "LayoutConfig",
+  })
+  export type Layout = z.infer<typeof Layout>
+
+  export const Rag = z
+    .object({
+      model: z.string().optional().describe("Embedding model for RAG (e.g., nvidia/llama-embed-nemotron-8b)"),
+      provider: z.string().optional().describe("Provider for RAG embeddings (defaults to nvidia)"),
+    })
+    .strict()
+    .meta({
+      ref: "RagConfig",
+    })
+  export type Rag = z.infer<typeof Rag>
+
+  export const Image = z
+    .object({
+      model: z
+        .string()
+        .optional()
+        .describe("Image generation model (e.g., openai/gpt-5-image, google/nano-banana-pro-2.5)"),
+      provider: z.string().optional().describe("Provider for image generation (e.g., openrouter, openai, vercel)"),
+    })
+    .strict()
+    .meta({
+      ref: "ImageConfig",
+    })
+  export type Image = z.infer<typeof Image>
+
+  export const Speak = z
+    .object({
+      provider: z.string().optional().describe("TTS provider (e.g., elevenlabs, openrouter)"),
+      model: z.string().optional().describe("TTS voice ID (e.g., ElevenLabs voice ID, OpenRouter voice name)"),
+      modelId: z.string().optional().describe("TTS model ID (e.g., eleven_v3, openai/gpt-audio-mini)"),
+      outputFormat: z.string().optional().describe("TTS output format (e.g., mp3_44100_128, mp3, wav)"),
+    })
+    .strict()
+    .meta({
+      ref: "SpeakConfig",
+    })
+  export type Speak = z.infer<typeof Speak>
+
+  export const Provider = ModelsDev.Provider.partial()
+    .extend({
+      whitelist: z.array(z.string()).optional(),
+      blacklist: z.array(z.string()).optional(),
+      models: z
+        .record(
+          z.string(),
+          ModelsDev.Model.partial().extend({
+            variants: z
+              .record(
+                z.string(),
+                z
+                  .object({
+                    disabled: z.boolean().optional().describe("Disable this variant for the model"),
+                  })
+                  .catchall(z.any()),
+              )
+              .optional()
+              .describe("Variant-specific configuration"),
+          }),
+        )
+        .optional(),
+      options: z
+        .object({
+          apiKey: z.string().optional(),
+          baseURL: z.string().optional(),
+          enterpriseUrl: z.string().optional().describe("GitHub Enterprise URL for copilot authentication"),
+          setCacheKey: z.boolean().optional().describe("Enable promptCacheKey for this provider (default false)"),
+          timeout: z
+            .union([
+              z
+                .number()
+                .int()
+                .positive()
+                .describe(
+                  "Timeout in milliseconds for requests to this provider. Default is 300000 (5 minutes). Set to false to disable timeout.",
+                ),
+              z.literal(false).describe("Disable timeout for this provider entirely."),
+            ])
+            .optional()
+            .describe(
+              "Timeout in milliseconds for requests to this provider. Default is 300000 (5 minutes). Set to false to disable timeout.",
+            ),
+        })
+        .catchall(z.any())
+        .optional(),
+    })
+    .strict()
+    .meta({
+      ref: "ProviderConfig",
+    })
+  export type Provider = z.infer<typeof Provider>
+
+  export const Info = z
+    .object({
+      $schema: z.string().optional().describe("JSON schema reference for configuration validation"),
+      theme: z.string().optional().describe("Theme name to use for the interface"),
+      keybinds: Keybinds.optional().describe("Custom keybind configurations"),
+      logLevel: Log.Level.optional().describe("Log level"),
+      tui: TUI.optional().describe("TUI specific settings"),
+      ads: Ads.optional().describe("User-defined ads shown in the TUI tips area"),
+      server: Server.optional().describe("Server configuration for nikcli serve and web commands"),
+      remote: Remote.optional().describe("Remote Control defaults and behavior"),
+      command: z
+        .record(z.string(), Command)
+        .optional()
+        .describe("Command configuration, see https://nikcli.store/docs/commands"),
+      watcher: z
+        .object({
+          ignore: z.array(z.string()).optional(),
+        })
+        .optional(),
+      plugin: z.string().array().optional(),
+      snapshot: z.boolean().optional(),
+      share: z
+        .enum(["manual", "auto", "disabled"])
+        .optional()
+        .describe(
+          "Control sharing behavior:'manual' allows manual sharing via commands, 'auto' enables automatic sharing, 'disabled' disables all sharing",
+        ),
+      autoshare: z
+        .boolean()
+        .optional()
+        .describe("@deprecated Use 'share' field instead. Share newly created sessions automatically"),
+      autoupdate: z
+        .union([z.boolean(), z.literal("notify")])
+        .optional()
+        .describe(
+          "Automatically update to the latest version. Set to true to auto-update, false to disable, or 'notify' to show update notifications",
+        ),
+      disabled_providers: z.array(z.string()).optional().describe("Disable providers that are loaded automatically"),
+      enabled_providers: z
+        .array(z.string())
+        .optional()
+        .describe("When set, ONLY these providers will be enabled. All other providers will be ignored"),
+      model: z.string().describe("Model to use in the format of provider/model, eg anthropic/claude-2").optional(),
+      small_model: z
+        .string()
+        .describe("Small model to use for tasks like title generation in the format of provider/model")
+        .optional(),
+      default_agent: z
+        .string()
+        .optional()
+        .describe(
+          "Default agent to use when none is specified. Must be a primary agent. Falls back to 'build' if not set or if the specified agent is invalid.",
+        ),
+      username: z
+        .string()
+        .optional()
+        .describe("Custom username to display in conversations instead of system username"),
+      mode: z
+        .object({
+          build: Agent.optional(),
+          plan: Agent.optional(),
+        })
+        .catchall(Agent)
+        .optional()
+        .describe("@deprecated Use `agent` field instead."),
+      agent: z
+        .object({
+          // primary
+          plan: Agent.optional(),
+          build: Agent.optional(),
+          // subagent
+          general: Agent.optional(),
+          explore: Agent.optional(),
+          // specialized
+          title: Agent.optional(),
+          summary: Agent.optional(),
+          compaction: Agent.optional(),
+        })
+        .catchall(Agent)
+        .optional()
+        .describe("Agent configuration, see https://nikcli.store/docs/agents"),
+      provider: z
+        .record(z.string(), Provider)
+        .optional()
+        .describe("Custom provider configurations and model overrides"),
+      mcp: z
+        .record(
+          z.string(),
+          z.union([
+            Mcp,
+            z
+              .object({
+                enabled: z.boolean(),
+              })
+              .strict(),
+          ]),
+        )
+        .optional()
+        .describe("MCP (Model Context Protocol) server configurations"),
+      connectors: z
+        .record(
+          z.string(),
+          z.union([
+            Connector,
+            z
+              .object({
+                enabled: z.boolean(),
+              })
+              .strict(),
+          ]),
+        )
+        .optional()
+        .describe("External service connectors (Figma, Slack, GitHub, Lovable)"),
+      formatter: z
+        .union([
+          z.literal(false),
+          z.record(
+            z.string(),
+            z.object({
+              disabled: z.boolean().optional(),
+              command: z.array(z.string()).optional(),
+              environment: z.record(z.string(), z.string()).optional(),
+              extensions: z.array(z.string()).optional(),
+            }),
+          ),
+        ])
+        .optional(),
+      lsp: z
+        .union([
+          z.literal(false),
+          z.record(
+            z.string(),
+            z.union([
+              z.object({
+                disabled: z.literal(true),
+              }),
+              z.object({
+                command: z.array(z.string()),
+                extensions: z.array(z.string()).optional(),
+                disabled: z.boolean().optional(),
+                env: z.record(z.string(), z.string()).optional(),
+                initialization: z.record(z.string(), z.any()).optional(),
+              }),
+            ]),
+          ),
+        ])
+        .optional()
+        .refine(
+          (data) => {
+            if (!data) return true
+            if (typeof data === "boolean") return true
+            const serverIds = new Set(Object.values(LSPServer).map((s) => s.id))
+
+            return Object.entries(data).every(([id, config]) => {
+              if (config.disabled) return true
+              if (serverIds.has(id)) return true
+              return Boolean(config.extensions)
+            })
+          },
+          {
+            error: "For custom LSP servers, 'extensions' array is required.",
+          },
+        ),
+      instructions: z.array(z.string()).optional().describe("Additional instruction files or patterns to include"),
+      layout: Layout.optional().describe("@deprecated Always uses stretch layout."),
+      permission: Permission.optional(),
+      tools: z.record(z.string(), z.boolean()).optional(),
+      enterprise: z
+        .object({
+          url: z.string().optional().describe("Enterprise URL"),
+        })
+        .optional(),
+      compaction: z
+        .object({
+          auto: z.boolean().optional().describe("Enable automatic compaction when context is full (default: true)"),
+          prune: z.boolean().optional().describe("Enable pruning of old tool outputs (default: true)"),
+          reserved: z
+            .number()
+            .int()
+            .min(0)
+            .optional()
+            .describe("Token buffer for compaction. Leaves enough window to avoid overflow during compaction."),
+        })
+        .optional(),
+      experimental: z
+        .object({
+          hook: z
+            .object({
+              file_edited: z
+                .record(
+                  z.string(),
+                  z
+                    .object({
+                      command: z.string().array(),
+                      environment: z.record(z.string(), z.string()).optional(),
+                    })
+                    .array(),
+                )
+                .optional(),
+              session_completed: z
+                .object({
+                  command: z.string().array(),
+                  environment: z.record(z.string(), z.string()).optional(),
+                })
+                .array()
+                .optional(),
+            })
+            .optional(),
+          chatMaxRetries: z.number().optional().describe("Number of retries for chat completions on failure"),
+          disable_paste_summary: z.boolean().optional(),
+          batch_tool: z.boolean().optional().describe("Enable the batch tool"),
+          openTelemetry: z
+            .boolean()
+            .optional()
+            .describe("Enable OpenTelemetry spans for AI SDK calls (using the 'experimental_telemetry' flag)"),
+          primary_tools: z
+            .array(z.string())
+            .optional()
+            .describe("Tools that should only be available to primary agents."),
+          continue_loop_on_deny: z.boolean().optional().describe("Continue the agent loop when a tool call is denied"),
+          mcp_timeout: z
+            .number()
+            .int()
+            .positive()
+            .optional()
+            .describe("Timeout in milliseconds for model context protocol (MCP) requests"),
+        })
+        .optional(),
+      rag: Rag.optional().describe("RAG embedding configuration"),
+      image: Image.optional().describe("Image generation configuration"),
+      speak: Speak.optional().describe("Text-to-speech configuration"),
+      notifications: z
+        .object({
+          todo: z
+            .object({
+              enabled: z.boolean().optional().describe("Enable todo notifications"),
+              macos: z.boolean().optional().describe("Enable macOS native notifications"),
+              slack: z
+                .object({
+                  enabled: z.boolean().optional(),
+                  connector: z.string().optional().describe("Name of the Slack connector to use"),
+                  channel: z.string().optional().describe("Slack channel ID or name"),
+                })
+                .optional(),
+              discord: z
+                .object({
+                  enabled: z.boolean().optional(),
+                  webhook: z.string().optional().describe("Discord webhook URL"),
+                })
+                .optional(),
+            })
+            .optional(),
+          icon: z
+            .object({
+              url: z.string().optional().describe("Icon image URL or file path for macOS notifications"),
+              alt: z.string().optional().describe("Alt text (unused for macOS)"),
+            })
+            .optional(),
+          notify: z
+            .object({
+              enabled: z.boolean().optional().describe("Enable native notifications"),
+              macos: z.boolean().optional().describe("Enable macOS native notifications"),
+              slack: z
+                .object({
+                  enabled: z.boolean().optional(),
+                  connector: z.string().optional().describe("Name of the Slack connector to use"),
+                  channel: z.string().optional().describe("Slack channel ID or name"),
+                })
+                .optional(),
+              discord: z
+                .object({
+                  enabled: z.boolean().optional(),
+                  webhook: z.string().optional().describe("Discord webhook URL"),
+                })
+                .optional(),
+              events: z
+                .object({
+                  sessionIdle: z.boolean().optional().describe("Notify when a session becomes idle"),
+                  sessionError: z.boolean().optional().describe("Notify when a session errors"),
+                  permissionAsked: z.boolean().optional().describe("Notify when permissions are requested"),
+                  questionAsked: z.boolean().optional().describe("Notify when questions are asked"),
+                })
+                .optional(),
+              idleMinMs: z
+                .number()
+                .int()
+                .positive()
+                .optional()
+                .describe("Minimum busy duration before idle notifications"),
+              rateLimit: z
+                .object({
+                  windowMs: z.number().int().positive().optional().describe("Rate limit window in ms"),
+                  maxPerWindow: z.number().int().positive().optional().describe("Max notifications per window"),
+                })
+                .optional(),
+              retry: z
+                .object({
+                  attempts: z.number().int().positive().optional(),
+                  delay: z.number().int().positive().optional().describe("Initial retry delay in ms"),
+                  factor: z.number().positive().optional().describe("Backoff multiplier"),
+                  maxDelay: z.number().int().positive().optional().describe("Max retry delay in ms"),
+                  timeoutMs: z.number().int().positive().optional().describe("Timeout per attempt in ms"),
+                })
+                .optional(),
+              breaker: z
+                .object({
+                  failures: z.number().int().positive().optional().describe("Failures before circuit opens"),
+                  cooldownMs: z.number().int().positive().optional().describe("Circuit breaker cooldown in ms"),
+                })
+                .optional(),
+              quietHours: z
+                .object({
+                  enabled: z.boolean().optional().describe("Enable quiet hours"),
+                  start: z.string().optional().describe("Quiet hours start (HH:MM)"),
+                  end: z.string().optional().describe("Quiet hours end (HH:MM)"),
+                  suppress: z
+                    .array(z.enum(["macos", "slack", "discord"]))
+                    .optional()
+                    .describe("Channels suppressed during quiet hours"),
+                })
+                .optional(),
+            })
+            .optional(),
+        })
+        .optional()
+        .describe("Notification settings for various events"),
+    })
+    .strict()
+    .meta({
+      ref: "Config",
+    })
+
+  export type Info = z.output<typeof Info>
+
+  export const global = lazy(async () => {
+    let result: Info = pipe(
+      {},
+      mergeDeep(await loadFile(path.join(Global.Path.config, "config.json"))),
+      mergeDeep(await loadFile(path.join(Global.Path.config, "nikcli.json"))),
+      mergeDeep(await loadFile(path.join(Global.Path.config, "nikcli.jsonc"))),
+    )
+
+    await import(path.join(Global.Path.config, "config"), {
+      with: {
+        type: "toml",
+      },
+    })
+      .then(async (mod) => {
+        const { provider, model, ...rest } = mod.default
+        if (provider && model) result.model = `${provider}/${model}`
+        result["$schema"] = "https://nikcli.store/config.json"
+        result = mergeDeep(result, rest)
+        await Bun.write(path.join(Global.Path.config, "config.json"), JSON.stringify(result, null, 2))
+        await fs.unlink(path.join(Global.Path.config, "config"))
+      })
+      .catch(() => {})
+
+    return result
+  })
+
+  async function loadFile(filepath: string): Promise<Info> {
+    log.info("loading", { path: filepath })
+    let text = await Bun.file(filepath)
+      .text()
+      .catch((err) => {
+        if (err.code === "ENOENT") return
+        throw new JsonError({ path: filepath }, { cause: err })
+      })
+    if (!text) return {}
+    return load(text, filepath)
+  }
+
+  async function load(text: string, configFilepath: string) {
+    const original = text
+    text = text.replace(/\{env:([^}]+)\}/g, (_, varName) => {
+      return process.env[varName] || ""
+    })
+
+    const fileMatches = text.match(/\{file:[^}]+\}/g)
+    if (fileMatches) {
+      const configDir = path.dirname(configFilepath)
+      const lines = text.split("\n")
+
+      for (const match of fileMatches) {
+        const lineIndex = lines.findIndex((line) => line.includes(match))
+        if (lineIndex !== -1 && lines[lineIndex].trim().startsWith("//")) {
+          continue // Skip if line is commented
+        }
+        let filePath = match.replace(/^\{file:/, "").replace(/\}$/, "")
+        if (filePath.startsWith("~/")) {
+          filePath = path.join(os.homedir(), filePath.slice(2))
+        }
+        const resolvedPath = path.isAbsolute(filePath) ? filePath : path.resolve(configDir, filePath)
+        const fileContent = (
+          await Bun.file(resolvedPath)
+            .text()
+            .catch((error) => {
+              const errMsg = `bad file reference: "${match}"`
+              if (error.code === "ENOENT") {
+                throw new InvalidError(
+                  {
+                    path: configFilepath,
+                    message: errMsg + ` ${resolvedPath} does not exist`,
+                  },
+                  { cause: error },
+                )
+              }
+              throw new InvalidError({ path: configFilepath, message: errMsg }, { cause: error })
+            })
+        ).trim()
+        // escape newlines/quotes, strip outer quotes
+        text = text.replace(match, JSON.stringify(fileContent).slice(1, -1))
+      }
+    }
+
+    const errors: JsoncParseError[] = []
+    const data = parseJsonc(text, errors, { allowTrailingComma: true })
+    if (errors.length) {
+      const lines = text.split("\n")
+      const errorDetails = errors
+        .map((e) => {
+          const beforeOffset = text.substring(0, e.offset).split("\n")
+          const line = beforeOffset.length
+          const column = beforeOffset[beforeOffset.length - 1].length + 1
+          const problemLine = lines[line - 1]
+
+          const error = `${printParseErrorCode(e.error)} at line ${line}, column ${column}`
+          if (!problemLine) return error
+
+          return `${error}\n   Line ${line}: ${problemLine}\n${"".padStart(column + 9)}^`
+        })
+        .join("\n")
+
+      throw new JsonError({
+        path: configFilepath,
+        message: `\n--- JSONC Input ---\n${text}\n--- Errors ---\n${errorDetails}\n--- End ---`,
+      })
+    }
+
+    const parsed = Info.safeParse(data)
+    if (parsed.success) {
+      if (!parsed.data.$schema) {
+        parsed.data.$schema = "https://nikcli.store/config.json"
+        // Write the $schema to the original text to preserve variables like {env:VAR}
+        const updated = original.replace(/^\s*\{/, '{\n  "$schema": "https://nikcli.store/config.json",')
+        await Bun.write(configFilepath, updated).catch(() => {})
+      }
+      const data = parsed.data
+      if (data.plugin) {
+        for (let i = 0; i < data.plugin.length; i++) {
+          const plugin = data.plugin[i]
+          try {
+            data.plugin[i] = import.meta.resolve!(plugin, configFilepath)
+          } catch (err) {}
+        }
+      }
+      return data
+    }
+
+    throw new InvalidError({
+      path: configFilepath,
+      issues: parsed.error.issues,
+    })
+  }
+  export const JsonError = NamedError.create(
+    "ConfigJsonError",
+    z.object({
+      path: z.string(),
+      message: z.string().optional(),
+    }),
+  )
+
+  export const ConfigDirectoryTypoError = NamedError.create(
+    "ConfigDirectoryTypoError",
+    z.object({
+      path: z.string(),
+      dir: z.string(),
+      suggestion: z.string(),
+    }),
+  )
+
+  export const InvalidError = NamedError.create(
+    "ConfigInvalidError",
+    z.object({
+      path: z.string(),
+      issues: z.custom<z.core.$ZodIssue[]>().optional(),
+      message: z.string().optional(),
+    }),
+  )
+
+  export async function get() {
+    return state().then((x) => x.config)
+  }
+
+  export async function getGlobal() {
+    return global()
+  }
+
+  export async function update(config: Info) {
+    const filepath = path.join(Instance.directory, "config.json")
+    const existing = await loadFile(filepath)
+    await Bun.write(filepath, JSON.stringify(mergeDeep(existing, config), null, 2))
+    await Instance.dispose()
+  }
+
+  function globalConfigFile() {
+    const candidates = ["nikcli.jsonc", "nikcli.json", "config.json"].map((file) => path.join(Global.Path.config, file))
+    for (const file of candidates) {
+      if (existsSync(file)) return file
+    }
+    return candidates[0]
+  }
+
+  function isRecord(value: unknown): value is Record<string, unknown> {
+    return !!value && typeof value === "object" && !Array.isArray(value)
+  }
+
+  function patchJsonc(input: string, patch: unknown, path: string[] = []): string {
+    if (!isRecord(patch)) {
+      const edits = modify(input, path, patch, {
+        formattingOptions: {
+          insertSpaces: true,
+          tabSize: 2,
+        },
+      })
+      return applyEdits(input, edits)
+    }
+
+    return Object.entries(patch).reduce((result, [key, value]) => {
+      if (value === undefined) return result
+      return patchJsonc(result, value, [...path, key])
+    }, input)
+  }
+
+  function parseConfig(text: string, filepath: string): Info {
+    const errors: JsoncParseError[] = []
+    const data = parseJsonc(text, errors, { allowTrailingComma: true })
+    if (errors.length) {
+      const lines = text.split("\n")
+      const errorDetails = errors
+        .map((e) => {
+          const beforeOffset = text.substring(0, e.offset).split("\n")
+          const line = beforeOffset.length
+          const column = beforeOffset[beforeOffset.length - 1].length + 1
+          const problemLine = lines[line - 1]
+
+          const error = `${printParseErrorCode(e.error)} at line ${line}, column ${column}`
+          if (!problemLine) return error
+
+          return `${error}\n   Line ${line}: ${problemLine}\n${"".padStart(column + 9)}^`
+        })
+        .join("\n")
+
+      throw new JsonError({
+        path: filepath,
+        message: `\n--- JSONC Input ---\n${text}\n--- Errors ---\n${errorDetails}\n--- End ---`,
+      })
+    }
+
+    const parsed = Info.safeParse(data)
+    if (parsed.success) return parsed.data
+
+    throw new InvalidError({
+      path: filepath,
+      issues: parsed.error.issues,
+    })
+  }
+
+  export async function updateGlobal(config: Info) {
+    const filepath = globalConfigFile()
+    const before = await Bun.file(filepath)
+      .text()
+      .catch((err) => {
+        if (err.code === "ENOENT") return "{}"
+        throw new JsonError({ path: filepath }, { cause: err })
+      })
+
+    if (!filepath.endsWith(".jsonc")) {
+      const existing = parseConfig(before, filepath)
+      await Bun.write(filepath, JSON.stringify(mergeDeep(existing, config), null, 2))
+    } else {
+      const next = patchJsonc(before, config)
+      parseConfig(next, filepath)
+      await Bun.write(filepath, next)
+    }
+
+    global.reset()
+    await Instance.disposeAll()
+    GlobalBus.emit("event", {
+      directory: "global",
+      payload: {
+        type: Event.Disposed.type,
+        properties: {},
+      },
+    })
+  }
+
+  export async function directories() {
+    return state().then((x) => x.directories)
+  }
+}