| { |
| "$schema": "http://json-schema.org/draft-07/schema#", |
| "definitions": { |
| "AllowDenyRequirement": { |
| "enum": [ |
| "allow", |
| "deny" |
| ], |
| "type": "string" |
| }, |
| "ApplicationNetworkRequirements": { |
| "properties": { |
| "domains": { |
| "additionalProperties": { |
| "$ref": "#/definitions/NetworkDomainPermission" |
| }, |
| "type": "object" |
| }, |
| "enabled": { |
| "description": "When enabled, only explicitly allowed exact domains may be contacted.", |
| "type": "boolean" |
| } |
| }, |
| "required": [ |
| "domains", |
| "enabled" |
| ], |
| "type": "object" |
| }, |
| "ApplicationRequirements": { |
| "properties": { |
| "network": { |
| "anyOf": [ |
| { |
| "$ref": "#/definitions/ApplicationNetworkRequirements" |
| }, |
| { |
| "type": "null" |
| } |
| ] |
| } |
| }, |
| "type": "object" |
| }, |
| "ApprovalsReviewer": { |
| "description": "Configures who approval requests are routed to for review. Examples include sandbox escapes, blocked network access, MCP approval prompts, and ARC escalations. Defaults to `user`. `auto_review` uses a carefully prompted subagent to gather relevant context and apply a risk-based decision framework before approving or denying the request. The legacy value `guardian_subagent` is accepted for compatibility.", |
| "enum": [ |
| "user", |
| "auto_review", |
| "guardian_subagent" |
| ], |
| "type": "string" |
| }, |
| "AskForApproval": { |
| "oneOf": [ |
| { |
| "enum": [ |
| "untrusted", |
| "on-request", |
| "never" |
| ], |
| "type": "string" |
| }, |
| { |
| "additionalProperties": false, |
| "properties": { |
| "granular": { |
| "properties": { |
| "mcp_elicitations": { |
| "type": "boolean" |
| }, |
| "request_permissions": { |
| "default": false, |
| "type": "boolean" |
| }, |
| "rules": { |
| "type": "boolean" |
| }, |
| "sandbox_approval": { |
| "type": "boolean" |
| }, |
| "skill_approval": { |
| "default": false, |
| "type": "boolean" |
| } |
| }, |
| "required": [ |
| "mcp_elicitations", |
| "rules", |
| "sandbox_approval" |
| ], |
| "type": "object" |
| } |
| }, |
| "required": [ |
| "granular" |
| ], |
| "title": "GranularAskForApproval", |
| "type": "object" |
| } |
| ] |
| }, |
| "AutoReviewRequirements": { |
| "properties": { |
| "ignoreRules": { |
| "items": { |
| "type": "string" |
| }, |
| "type": [ |
| "array", |
| "null" |
| ] |
| }, |
| "requiredOnModels": { |
| "items": { |
| "type": "string" |
| }, |
| "type": [ |
| "array", |
| "null" |
| ] |
| } |
| }, |
| "type": "object" |
| }, |
| "BrowserUseAccessApprovalLifetime": { |
| "enum": [ |
| "turn", |
| "thread" |
| ], |
| "type": "string" |
| }, |
| "BrowserUseOriginPolicy": { |
| "properties": { |
| "access": { |
| "anyOf": [ |
| { |
| "$ref": "#/definitions/AllowDenyRequirement" |
| }, |
| { |
| "type": "null" |
| } |
| ] |
| }, |
| "accessApprovalLifetime": { |
| "anyOf": [ |
| { |
| "$ref": "#/definitions/BrowserUseAccessApprovalLifetime" |
| }, |
| { |
| "type": "null" |
| } |
| ] |
| }, |
| "autoReview": { |
| "anyOf": [ |
| { |
| "$ref": "#/definitions/AllowDenyRequirement" |
| }, |
| { |
| "type": "null" |
| } |
| ] |
| }, |
| "downloads": { |
| "anyOf": [ |
| { |
| "$ref": "#/definitions/AllowDenyRequirement" |
| }, |
| { |
| "type": "null" |
| } |
| ] |
| }, |
| "fullCdpAccess": { |
| "anyOf": [ |
| { |
| "$ref": "#/definitions/AllowDenyRequirement" |
| }, |
| { |
| "type": "null" |
| } |
| ] |
| }, |
| "persistentApproval": { |
| "type": [ |
| "boolean", |
| "null" |
| ] |
| }, |
| "uploads": { |
| "anyOf": [ |
| { |
| "$ref": "#/definitions/AllowDenyRequirement" |
| }, |
| { |
| "type": "null" |
| } |
| ] |
| } |
| }, |
| "type": "object" |
| }, |
| "BrowserUseRequirements": { |
| "properties": { |
| "allowGlobalPersistentApproval": { |
| "type": [ |
| "boolean", |
| "null" |
| ] |
| }, |
| "allowHistoryAccess": { |
| "type": [ |
| "boolean", |
| "null" |
| ] |
| }, |
| "allowWebmcp": { |
| "type": [ |
| "boolean", |
| "null" |
| ] |
| }, |
| "defaultOriginPolicy": { |
| "anyOf": [ |
| { |
| "$ref": "#/definitions/BrowserUseOriginPolicy" |
| }, |
| { |
| "type": "null" |
| } |
| ] |
| }, |
| "disableAutoReview": { |
| "type": [ |
| "boolean", |
| "null" |
| ] |
| }, |
| "origins": { |
| "additionalProperties": { |
| "$ref": "#/definitions/BrowserUseOriginPolicy" |
| }, |
| "type": [ |
| "object", |
| "null" |
| ] |
| } |
| }, |
| "type": "object" |
| }, |
| "CliAuthCredentialsStoreMode": { |
| "enum": [ |
| "file", |
| "keyring", |
| "auto", |
| "ephemeral" |
| ], |
| "type": "string" |
| }, |
| "ComputerUseMacosRequirements": { |
| "properties": { |
| "bundleIds": { |
| "additionalProperties": { |
| "$ref": "#/definitions/AllowDenyRequirement" |
| }, |
| "type": [ |
| "object", |
| "null" |
| ] |
| } |
| }, |
| "type": "object" |
| }, |
| "ComputerUseRequirements": { |
| "properties": { |
| "allowLockedComputerUse": { |
| "type": [ |
| "boolean", |
| "null" |
| ] |
| }, |
| "allowPersistentApproval": { |
| "type": [ |
| "boolean", |
| "null" |
| ] |
| }, |
| "defaultAppAccess": { |
| "anyOf": [ |
| { |
| "$ref": "#/definitions/AllowDenyRequirement" |
| }, |
| { |
| "type": "null" |
| } |
| ] |
| }, |
| "macos": { |
| "anyOf": [ |
| { |
| "$ref": "#/definitions/ComputerUseMacosRequirements" |
| }, |
| { |
| "type": "null" |
| } |
| ] |
| }, |
| "windows": { |
| "anyOf": [ |
| { |
| "$ref": "#/definitions/ComputerUseWindowsRequirements" |
| }, |
| { |
| "type": "null" |
| } |
| ] |
| } |
| }, |
| "type": "object" |
| }, |
| "ComputerUseWindowsExeRequirement": { |
| "properties": { |
| "access": { |
| "$ref": "#/definitions/AllowDenyRequirement" |
| }, |
| "binaryName": { |
| "type": [ |
| "string", |
| "null" |
| ] |
| }, |
| "productName": { |
| "type": "string" |
| }, |
| "publisherName": { |
| "type": "string" |
| } |
| }, |
| "required": [ |
| "access", |
| "productName", |
| "publisherName" |
| ], |
| "type": "object" |
| }, |
| "ComputerUseWindowsRequirements": { |
| "properties": { |
| "aumids": { |
| "additionalProperties": { |
| "$ref": "#/definitions/AllowDenyRequirement" |
| }, |
| "type": [ |
| "object", |
| "null" |
| ] |
| }, |
| "exes": { |
| "items": { |
| "$ref": "#/definitions/ComputerUseWindowsExeRequirement" |
| }, |
| "type": [ |
| "array", |
| "null" |
| ] |
| } |
| }, |
| "type": "object" |
| }, |
| "ConfigRequirements": { |
| "properties": { |
| "additionalDeveloperInstructions": { |
| "type": [ |
| "string", |
| "null" |
| ] |
| }, |
| "allowAppshots": { |
| "type": [ |
| "boolean", |
| "null" |
| ] |
| }, |
| "allowBrowserAndComputerUse": { |
| "type": [ |
| "boolean", |
| "null" |
| ] |
| }, |
| "allowLoginShell": { |
| "type": [ |
| "boolean", |
| "null" |
| ] |
| }, |
| "allowManagedHooksOnly": { |
| "type": [ |
| "boolean", |
| "null" |
| ] |
| }, |
| "allowRemoteControl": { |
| "type": [ |
| "boolean", |
| "null" |
| ] |
| }, |
| "allowedApprovalPolicies": { |
| "items": { |
| "$ref": "#/definitions/AskForApproval" |
| }, |
| "type": [ |
| "array", |
| "null" |
| ] |
| }, |
| "allowedLoginMethods": { |
| "description": "Effective login methods after managed, forced-login, and workspace restrictions. An empty list permits no login method. Older servers may omit this field.", |
| "items": { |
| "$ref": "#/definitions/ForcedLoginMethod" |
| }, |
| "type": [ |
| "array", |
| "null" |
| ] |
| }, |
| "allowedPermissionProfiles": { |
| "additionalProperties": { |
| "type": "boolean" |
| }, |
| "type": [ |
| "object", |
| "null" |
| ] |
| }, |
| "allowedSandboxModes": { |
| "items": { |
| "$ref": "#/definitions/SandboxMode" |
| }, |
| "type": [ |
| "array", |
| "null" |
| ] |
| }, |
| "allowedWebSearchModes": { |
| "items": { |
| "$ref": "#/definitions/WebSearchMode" |
| }, |
| "type": [ |
| "array", |
| "null" |
| ] |
| }, |
| "allowedWindowsSandboxImplementations": { |
| "items": { |
| "$ref": "#/definitions/WindowsSandboxImplementation" |
| }, |
| "type": [ |
| "array", |
| "null" |
| ] |
| }, |
| "autoReview": { |
| "anyOf": [ |
| { |
| "$ref": "#/definitions/AutoReviewRequirements" |
| }, |
| { |
| "type": "null" |
| } |
| ] |
| }, |
| "browserUse": { |
| "anyOf": [ |
| { |
| "$ref": "#/definitions/BrowserUseRequirements" |
| }, |
| { |
| "type": "null" |
| } |
| ] |
| }, |
| "chatgptBaseUrl": { |
| "type": [ |
| "string", |
| "null" |
| ] |
| }, |
| "checkForUpdateOnStartup": { |
| "type": [ |
| "boolean", |
| "null" |
| ] |
| }, |
| "cliAuthCredentialsStore": { |
| "anyOf": [ |
| { |
| "$ref": "#/definitions/CliAuthCredentialsStoreMode" |
| }, |
| { |
| "type": "null" |
| } |
| ] |
| }, |
| "computerUse": { |
| "anyOf": [ |
| { |
| "$ref": "#/definitions/ComputerUseRequirements" |
| }, |
| { |
| "type": "null" |
| } |
| ] |
| }, |
| "defaultPermissions": { |
| "type": [ |
| "string", |
| "null" |
| ] |
| }, |
| "enforceResidency": { |
| "anyOf": [ |
| { |
| "$ref": "#/definitions/ResidencyRequirement" |
| }, |
| { |
| "type": "null" |
| } |
| ] |
| }, |
| "featureRequirements": { |
| "additionalProperties": { |
| "type": "boolean" |
| }, |
| "type": [ |
| "object", |
| "null" |
| ] |
| }, |
| "feedback": { |
| "anyOf": [ |
| { |
| "$ref": "#/definitions/FeedbackRequirements" |
| }, |
| { |
| "type": "null" |
| } |
| ] |
| }, |
| "inAppBrowser": { |
| "anyOf": [ |
| { |
| "$ref": "#/definitions/InAppBrowserRequirements" |
| }, |
| { |
| "type": "null" |
| } |
| ] |
| }, |
| "logDir": { |
| "type": [ |
| "string", |
| "null" |
| ] |
| }, |
| "modelCatalogJson": { |
| "type": [ |
| "string", |
| "null" |
| ] |
| }, |
| "modelProvider": { |
| "description": "Exact provider selection required by managed policy.", |
| "type": [ |
| "string", |
| "null" |
| ] |
| }, |
| "modelProviders": { |
| "additionalProperties": true, |
| "description": "Complete required provider definitions, using config.toml field names.", |
| "type": [ |
| "object", |
| "null" |
| ] |
| }, |
| "models": { |
| "anyOf": [ |
| { |
| "$ref": "#/definitions/ModelsRequirements" |
| }, |
| { |
| "type": "null" |
| } |
| ] |
| }, |
| "sqliteHome": { |
| "type": [ |
| "string", |
| "null" |
| ] |
| }, |
| "windowsSandboxPrivateDesktop": { |
| "type": [ |
| "boolean", |
| "null" |
| ] |
| } |
| }, |
| "type": "object" |
| }, |
| "ConfiguredHookHandler": { |
| "oneOf": [ |
| { |
| "properties": { |
| "additionalContextLimit": { |
| "description": "Approximate token threshold for spilling this hook's `additionalContext` to disk. `null` uses 2,500 tokens; `0` disables spilling for this hook. The threshold is evaluated against the original context; a spilled preview also includes recovery metadata.", |
| "format": "uint", |
| "minimum": 0.0, |
| "type": [ |
| "integer", |
| "null" |
| ] |
| }, |
| "async": { |
| "type": "boolean" |
| }, |
| "command": { |
| "type": "string" |
| }, |
| "commandWindows": { |
| "type": [ |
| "string", |
| "null" |
| ] |
| }, |
| "statusMessage": { |
| "type": [ |
| "string", |
| "null" |
| ] |
| }, |
| "timeoutSec": { |
| "format": "uint64", |
| "minimum": 0.0, |
| "type": [ |
| "integer", |
| "null" |
| ] |
| }, |
| "type": { |
| "enum": [ |
| "command" |
| ], |
| "title": "CommandConfiguredHookHandlerType", |
| "type": "string" |
| } |
| }, |
| "required": [ |
| "async", |
| "command", |
| "type" |
| ], |
| "title": "CommandConfiguredHookHandler", |
| "type": "object" |
| }, |
| { |
| "properties": { |
| "input": { |
| "additionalProperties": true, |
| "type": "object" |
| }, |
| "server": { |
| "type": "string" |
| }, |
| "statusMessage": { |
| "type": [ |
| "string", |
| "null" |
| ] |
| }, |
| "timeoutSec": { |
| "format": "uint64", |
| "minimum": 0.0, |
| "type": [ |
| "integer", |
| "null" |
| ] |
| }, |
| "tool": { |
| "type": "string" |
| }, |
| "type": { |
| "enum": [ |
| "mcp_tool" |
| ], |
| "title": "McpToolConfiguredHookHandlerType", |
| "type": "string" |
| } |
| }, |
| "required": [ |
| "input", |
| "server", |
| "tool", |
| "type" |
| ], |
| "title": "McpToolConfiguredHookHandler", |
| "type": "object" |
| }, |
| { |
| "properties": { |
| "type": { |
| "enum": [ |
| "prompt" |
| ], |
| "title": "PromptConfiguredHookHandlerType", |
| "type": "string" |
| } |
| }, |
| "required": [ |
| "type" |
| ], |
| "title": "PromptConfiguredHookHandler", |
| "type": "object" |
| }, |
| { |
| "properties": { |
| "type": { |
| "enum": [ |
| "agent" |
| ], |
| "title": "AgentConfiguredHookHandlerType", |
| "type": "string" |
| } |
| }, |
| "required": [ |
| "type" |
| ], |
| "title": "AgentConfiguredHookHandler", |
| "type": "object" |
| } |
| ] |
| }, |
| "ConfiguredHookMatcherGroup": { |
| "properties": { |
| "hooks": { |
| "items": { |
| "$ref": "#/definitions/ConfiguredHookHandler" |
| }, |
| "type": "array" |
| }, |
| "matcher": { |
| "type": [ |
| "string", |
| "null" |
| ] |
| } |
| }, |
| "required": [ |
| "hooks" |
| ], |
| "type": "object" |
| }, |
| "FeedbackRequirements": { |
| "properties": { |
| "enabled": { |
| "type": [ |
| "boolean", |
| "null" |
| ] |
| } |
| }, |
| "type": "object" |
| }, |
| "ForcedLoginMethod": { |
| "enum": [ |
| "chatgpt", |
| "api" |
| ], |
| "type": "string" |
| }, |
| "InAppBrowserRequirements": { |
| "properties": { |
| "allowExternalBrowserSettingsImport": { |
| "type": [ |
| "boolean", |
| "null" |
| ] |
| } |
| }, |
| "type": "object" |
| }, |
| "ManagedHooksRequirements": { |
| "properties": { |
| "Interrupt": { |
| "default": [], |
| "items": { |
| "$ref": "#/definitions/ConfiguredHookMatcherGroup" |
| }, |
| "type": "array" |
| }, |
| "PermissionRequest": { |
| "items": { |
| "$ref": "#/definitions/ConfiguredHookMatcherGroup" |
| }, |
| "type": "array" |
| }, |
| "PostCompact": { |
| "items": { |
| "$ref": "#/definitions/ConfiguredHookMatcherGroup" |
| }, |
| "type": "array" |
| }, |
| "PostToolUse": { |
| "items": { |
| "$ref": "#/definitions/ConfiguredHookMatcherGroup" |
| }, |
| "type": "array" |
| }, |
| "PreCompact": { |
| "items": { |
| "$ref": "#/definitions/ConfiguredHookMatcherGroup" |
| }, |
| "type": "array" |
| }, |
| "PreToolUse": { |
| "items": { |
| "$ref": "#/definitions/ConfiguredHookMatcherGroup" |
| }, |
| "type": "array" |
| }, |
| "SessionEnd": { |
| "default": [], |
| "items": { |
| "$ref": "#/definitions/ConfiguredHookMatcherGroup" |
| }, |
| "type": "array" |
| }, |
| "SessionStart": { |
| "items": { |
| "$ref": "#/definitions/ConfiguredHookMatcherGroup" |
| }, |
| "type": "array" |
| }, |
| "Stop": { |
| "items": { |
| "$ref": "#/definitions/ConfiguredHookMatcherGroup" |
| }, |
| "type": "array" |
| }, |
| "SubagentStart": { |
| "items": { |
| "$ref": "#/definitions/ConfiguredHookMatcherGroup" |
| }, |
| "type": "array" |
| }, |
| "SubagentStop": { |
| "items": { |
| "$ref": "#/definitions/ConfiguredHookMatcherGroup" |
| }, |
| "type": "array" |
| }, |
| "UserPromptSubmit": { |
| "items": { |
| "$ref": "#/definitions/ConfiguredHookMatcherGroup" |
| }, |
| "type": "array" |
| }, |
| "managedDir": { |
| "type": [ |
| "string", |
| "null" |
| ] |
| }, |
| "windowsManagedDir": { |
| "type": [ |
| "string", |
| "null" |
| ] |
| } |
| }, |
| "required": [ |
| "PermissionRequest", |
| "PostCompact", |
| "PostToolUse", |
| "PreCompact", |
| "PreToolUse", |
| "SessionStart", |
| "Stop", |
| "SubagentStart", |
| "SubagentStop", |
| "UserPromptSubmit" |
| ], |
| "type": "object" |
| }, |
| "ModelsRequirements": { |
| "properties": { |
| "newThread": { |
| "anyOf": [ |
| { |
| "$ref": "#/definitions/NewThreadModelDefaults" |
| }, |
| { |
| "type": "null" |
| } |
| ] |
| } |
| }, |
| "type": "object" |
| }, |
| "NetworkDomainPermission": { |
| "enum": [ |
| "allow", |
| "deny" |
| ], |
| "type": "string" |
| }, |
| "NetworkRequirements": { |
| "properties": { |
| "allowLocalBinding": { |
| "type": [ |
| "boolean", |
| "null" |
| ] |
| }, |
| "allowUnixSockets": { |
| "description": "Legacy compatibility view derived from `unix_sockets`.", |
| "items": { |
| "type": "string" |
| }, |
| "type": [ |
| "array", |
| "null" |
| ] |
| }, |
| "allowUpstreamProxy": { |
| "type": [ |
| "boolean", |
| "null" |
| ] |
| }, |
| "allowedDomains": { |
| "description": "Legacy compatibility view derived from `domains`.", |
| "items": { |
| "type": "string" |
| }, |
| "type": [ |
| "array", |
| "null" |
| ] |
| }, |
| "dangerouslyAllowAllUnixSockets": { |
| "type": [ |
| "boolean", |
| "null" |
| ] |
| }, |
| "dangerouslyAllowNonLoopbackProxy": { |
| "type": [ |
| "boolean", |
| "null" |
| ] |
| }, |
| "deniedDomains": { |
| "description": "Legacy compatibility view derived from `domains`.", |
| "items": { |
| "type": "string" |
| }, |
| "type": [ |
| "array", |
| "null" |
| ] |
| }, |
| "domains": { |
| "additionalProperties": { |
| "$ref": "#/definitions/NetworkDomainPermission" |
| }, |
| "description": "Canonical network permission map for `experimental_network`.", |
| "type": [ |
| "object", |
| "null" |
| ] |
| }, |
| "enabled": { |
| "type": [ |
| "boolean", |
| "null" |
| ] |
| }, |
| "httpPort": { |
| "format": "uint16", |
| "minimum": 0.0, |
| "type": [ |
| "integer", |
| "null" |
| ] |
| }, |
| "managedAllowedDomainsOnly": { |
| "description": "When true, only managed allowlist entries are respected while managed network enforcement is active.", |
| "type": [ |
| "boolean", |
| "null" |
| ] |
| }, |
| "socksPort": { |
| "format": "uint16", |
| "minimum": 0.0, |
| "type": [ |
| "integer", |
| "null" |
| ] |
| }, |
| "unixSockets": { |
| "additionalProperties": { |
| "$ref": "#/definitions/NetworkUnixSocketPermission" |
| }, |
| "description": "Canonical unix socket permission map for `experimental_network`.", |
| "type": [ |
| "object", |
| "null" |
| ] |
| } |
| }, |
| "type": "object" |
| }, |
| "NetworkUnixSocketPermission": { |
| "enum": [ |
| "allow", |
| "deny" |
| ], |
| "type": "string" |
| }, |
| "NewThreadModelDefaults": { |
| "properties": { |
| "model": { |
| "type": [ |
| "string", |
| "null" |
| ] |
| }, |
| "modelReasoningEffort": { |
| "anyOf": [ |
| { |
| "$ref": "#/definitions/ReasoningEffort" |
| }, |
| { |
| "type": "null" |
| } |
| ] |
| }, |
| "serviceTier": { |
| "type": [ |
| "string", |
| "null" |
| ] |
| } |
| }, |
| "type": "object" |
| }, |
| "ReasoningEffort": { |
| "description": "A non-empty reasoning effort value advertised by the model.", |
| "minLength": 1, |
| "type": "string" |
| }, |
| "ResidencyRequirement": { |
| "enum": [ |
| "us" |
| ], |
| "type": "string" |
| }, |
| "SandboxMode": { |
| "enum": [ |
| "read-only", |
| "workspace-write", |
| "danger-full-access" |
| ], |
| "type": "string" |
| }, |
| "WebSearchMode": { |
| "enum": [ |
| "disabled", |
| "cached", |
| "indexed", |
| "live" |
| ], |
| "type": "string" |
| }, |
| "WindowsSandboxImplementation": { |
| "enum": [ |
| "elevated", |
| "unelevated", |
| "mxc" |
| ], |
| "type": "string" |
| } |
| }, |
| "properties": { |
| "requirements": { |
| "anyOf": [ |
| { |
| "$ref": "#/definitions/ConfigRequirements" |
| }, |
| { |
| "type": "null" |
| } |
| ], |
| "description": "Null if no requirements are configured (e.g. no requirements.toml/MDM entries)." |
| } |
| }, |
| "title": "ConfigRequirementsReadResponse", |
| "type": "object" |
| } |
