{
  "$defs": {
    "RawAuth": {
      "additionalProperties": false,
      "description": "``auth:`` \u2014 credential-capture behavior (OAuth container or API-key prompt).",
      "properties": {
        "host_dir": {
          "description": "Single-segment dir under mounts_dir() (e.g. ``_codex-config``)",
          "title": "Host Dir",
          "type": "string"
        },
        "container_mount": {
          "description": "Mount point inside the container",
          "title": "Container Mount",
          "type": "string"
        },
        "command": {
          "anyOf": [
            {
              "items": {
                "type": "string"
              },
              "type": "array"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "description": "Container command for OAuth mode; derived from auth_key when absent",
          "title": "Command"
        },
        "auth_key": {
          "anyOf": [
            {
              "$ref": "#/$defs/RawAuthKey"
            },
            {
              "type": "null"
            }
          ],
          "default": null
        },
        "banner_hint": {
          "default": "",
          "title": "Banner Hint",
          "type": "string"
        },
        "extra_run_args": {
          "items": {
            "type": "string"
          },
          "title": "Extra Run Args",
          "type": "array"
        },
        "modes": {
          "items": {
            "enum": [
              "oauth",
              "api_key"
            ],
            "type": "string"
          },
          "title": "Modes",
          "type": "array"
        },
        "device_auth": {
          "default": false,
          "description": "OAuth flow has a headless device-code variant, offered in the auth prompt",
          "title": "Device Auth",
          "type": "boolean"
        },
        "api_key_hint": {
          "default": "",
          "title": "Api Key Hint",
          "type": "string"
        },
        "post_capture_state": {
          "additionalProperties": {
            "additionalProperties": true,
            "type": "object"
          },
          "description": "JSON state files to merge into the auth mount post-capture",
          "title": "Post Capture State",
          "type": "object"
        }
      },
      "required": [
        "host_dir",
        "container_mount"
      ],
      "title": "RawAuth",
      "type": "object"
    },
    "RawAuthKey": {
      "additionalProperties": false,
      "description": "``auth.auth_key:`` \u2014 printf-template-driven API-key prompt for tools.",
      "properties": {
        "label": {
          "anyOf": [
            {
              "type": "string"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "title": "Label"
        },
        "key_url": {
          "title": "Key Url",
          "type": "string"
        },
        "env_var": {
          "title": "Env Var",
          "type": "string"
        },
        "config_path": {
          "title": "Config Path",
          "type": "string"
        },
        "printf_template": {
          "title": "Printf Template",
          "type": "string"
        },
        "tool_name": {
          "anyOf": [
            {
              "type": "string"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "title": "Tool Name"
        }
      },
      "required": [
        "key_url",
        "env_var",
        "config_path",
        "printf_template"
      ],
      "title": "RawAuthKey",
      "type": "object"
    },
    "RawAutoApprove": {
      "additionalProperties": false,
      "description": "``auto_approve:`` \u2014 env vars and flags injected when ``TEROK_UNRESTRICTED=1``.",
      "properties": {
        "env": {
          "additionalProperties": {
            "type": "string"
          },
          "title": "Env",
          "type": "object"
        },
        "flags": {
          "items": {
            "type": "string"
          },
          "title": "Flags",
          "type": "array"
        }
      },
      "title": "RawAutoApprove",
      "type": "object"
    },
    "RawCapabilities": {
      "additionalProperties": false,
      "description": "``capabilities:`` \u2014 agent-specific feature toggles.",
      "properties": {
        "add_dir": {
          "default": false,
          "title": "Add Dir",
          "type": "boolean"
        },
        "log_format": {
          "default": "plain",
          "enum": [
            "plain",
            "claude-stream-json"
          ],
          "title": "Log Format",
          "type": "string"
        }
      },
      "title": "RawCapabilities",
      "type": "object"
    },
    "RawGitIdentity": {
      "additionalProperties": false,
      "description": "``git_identity:`` \u2014 author/committer override per agent.",
      "properties": {
        "name": {
          "anyOf": [
            {
              "type": "string"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "description": "Git author/committer name",
          "title": "Name"
        },
        "email": {
          "anyOf": [
            {
              "type": "string"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "description": "Git author/committer email",
          "title": "Email"
        }
      },
      "title": "RawGitIdentity",
      "type": "object"
    },
    "RawHeadless": {
      "additionalProperties": false,
      "description": "``headless:`` \u2014 flags and subcommand for non-interactive prompt invocation.",
      "properties": {
        "subcommand": {
          "anyOf": [
            {
              "type": "string"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "description": "Subcommand for headless mode (e.g. ``exec`` for codex)",
          "title": "Subcommand"
        },
        "prompt_flag": {
          "default": "-p",
          "description": "Flag for the prompt; ``\"\"`` for positional",
          "title": "Prompt Flag",
          "type": "string"
        },
        "model_flag": {
          "anyOf": [
            {
              "type": "string"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "description": "Flag for model override",
          "title": "Model Flag"
        },
        "max_turns_flag": {
          "anyOf": [
            {
              "type": "string"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "description": "Flag for maximum turns",
          "title": "Max Turns Flag"
        },
        "verbose_flag": {
          "anyOf": [
            {
              "type": "string"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "description": "Flag for verbose output",
          "title": "Verbose Flag"
        },
        "output_format_flags": {
          "description": "Flags for structured output",
          "items": {
            "type": "string"
          },
          "title": "Output Format Flags",
          "type": "array"
        }
      },
      "title": "RawHeadless",
      "type": "object"
    },
    "RawHelp": {
      "additionalProperties": false,
      "description": "``help:`` \u2014 one-line entry shown in the in-container help banner.",
      "properties": {
        "label": {
          "default": "",
          "title": "Label",
          "type": "string"
        },
        "section": {
          "default": "agent",
          "enum": [
            "agent",
            "dev_tool"
          ],
          "title": "Section",
          "type": "string"
        }
      },
      "title": "RawHelp",
      "type": "object"
    },
    "RawInstall": {
      "additionalProperties": false,
      "description": "``install:`` \u2014 Dockerfile fragments emitted into the L1 image.",
      "properties": {
        "depends_on": {
          "items": {
            "type": "string"
          },
          "title": "Depends On",
          "type": "array"
        },
        "run_as_root": {
          "default": "",
          "title": "Run As Root",
          "type": "string"
        },
        "run_as_dev": {
          "default": "",
          "title": "Run As Dev",
          "type": "string"
        }
      },
      "title": "RawInstall",
      "type": "object"
    },
    "RawLauncher": {
      "additionalProperties": false,
      "description": "``wrapper.launcher:`` \u2014 the per-task launcher script and when it runs.",
      "properties": {
        "script": {
          "title": "Script",
          "type": "string"
        },
        "mode": {
          "enum": [
            "on_provider_select",
            "always"
          ],
          "title": "Mode",
          "type": "string"
        }
      },
      "required": [
        "script",
        "mode"
      ],
      "title": "RawLauncher",
      "type": "object"
    },
    "RawMountSpec": {
      "additionalProperties": false,
      "description": "One entry in the ``mounts:`` list \u2014 explicit shared-config mount.",
      "properties": {
        "host_dir": {
          "title": "Host Dir",
          "type": "string"
        },
        "container_path": {
          "title": "Container Path",
          "type": "string"
        },
        "label": {
          "anyOf": [
            {
              "type": "string"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "title": "Label"
        }
      },
      "required": [
        "host_dir",
        "container_path"
      ],
      "title": "RawMountSpec",
      "type": "object"
    },
    "RawProviderBinding": {
      "additionalProperties": false,
      "description": "``provider:`` \u2014 how an agent routes to (delivers) a provider.\n\nThe *delivery* concern lifted out of the agent ``vault:`` block: which\nprovider this agent uses (``default``) plus the per-agent env-var /\nconfig-patch plumbing.  The *endpoint* concern (upstream, wire auth) lives\nin the named [`RawProvider`][terok_executor.roster.schema.RawProvider].",
      "properties": {
        "default": {
          "anyOf": [
            {
              "type": "string"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "description": "Provider name this agent routes to (None for harnesses)",
          "title": "Default"
        },
        "token_env": {
          "additionalProperties": {
            "type": "string"
          },
          "title": "Token Env",
          "type": "object"
        },
        "base_url_env": {
          "default": "",
          "title": "Base Url Env",
          "type": "string"
        },
        "socket_env": {
          "default": "",
          "title": "Socket Env",
          "type": "string"
        },
        "credential_file": {
          "default": "",
          "title": "Credential File",
          "type": "string"
        },
        "credential_file_writable": {
          "default": false,
          "description": "Mount the credential file writable instead of under a read-only shadow. Set when the tool stores credentials and settings in the same file it must rewrite on startup (e.g. glab's config.yml) \u2014 the shadow would block the write, and the file persists in the shared mount instead of being contained.",
          "title": "Credential File Writable",
          "type": "boolean"
        },
        "credential_type": {
          "default": "api_key",
          "enum": [
            "api_key",
            "oauth",
            "oauth_token",
            "pat"
          ],
          "title": "Credential Type",
          "type": "string"
        },
        "config_patch": {
          "anyOf": [
            {
              "additionalProperties": true,
              "type": "object"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "title": "Config Patch"
        }
      },
      "title": "RawProviderBinding",
      "type": "object"
    },
    "RawSession": {
      "additionalProperties": false,
      "description": "``session:`` \u2014 session resume / continue capability flags.",
      "properties": {
        "supports_resume": {
          "default": false,
          "title": "Supports Resume",
          "type": "boolean"
        },
        "resume_flag": {
          "anyOf": [
            {
              "type": "string"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "title": "Resume Flag"
        },
        "continue_flag": {
          "anyOf": [
            {
              "type": "string"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "title": "Continue Flag"
        },
        "session_file": {
          "anyOf": [
            {
              "type": "string"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "title": "Session File"
        },
        "supports_hook": {
          "default": false,
          "title": "Supports Hook",
          "type": "boolean"
        }
      },
      "title": "RawSession",
      "type": "object"
    },
    "RawSidecar": {
      "additionalProperties": false,
      "description": "``sidecar:`` \u2014 separate L1 image + env-mapped credentials for tool runners.",
      "properties": {
        "tool_name": {
          "anyOf": [
            {
              "type": "string"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "title": "Tool Name"
        },
        "env_map": {
          "additionalProperties": {
            "type": "string"
          },
          "title": "Env Map",
          "type": "object"
        }
      },
      "title": "RawSidecar",
      "type": "object"
    },
    "RawWrapper": {
      "additionalProperties": false,
      "description": "``wrapper:`` \u2014 in-container shell-wrapper behavior.",
      "properties": {
        "refuse_subcommands": {
          "items": {
            "type": "string"
          },
          "title": "Refuse Subcommands",
          "type": "array"
        },
        "launcher": {
          "anyOf": [
            {
              "$ref": "#/$defs/RawLauncher"
            },
            {
              "type": "null"
            }
          ],
          "default": null
        }
      },
      "title": "RawWrapper",
      "type": "object"
    }
  },
  "additionalProperties": false,
  "description": "Full schema for one agent YAML file.\n\nThe file's stem (e.g. ``claude.yaml`` \u2192 ``\"claude\"``) supplies the\nroster name; the YAML never repeats it inside.  ``roster_version``\nis stripped before validation by the loader's compat check, so it\nis intentionally absent here.",
  "properties": {
    "kind": {
      "default": "native",
      "enum": [
        "native",
        "harness",
        "frontend",
        "tool",
        "infra"
      ],
      "title": "Kind",
      "type": "string"
    },
    "label": {
      "anyOf": [
        {
          "type": "string"
        },
        {
          "type": "null"
        }
      ],
      "default": null,
      "description": "Human-readable display name",
      "title": "Label"
    },
    "binary": {
      "anyOf": [
        {
          "type": "string"
        },
        {
          "type": "null"
        }
      ],
      "default": null,
      "description": "CLI binary name (defaults to roster name)",
      "title": "Binary"
    },
    "git_identity": {
      "anyOf": [
        {
          "$ref": "#/$defs/RawGitIdentity"
        },
        {
          "type": "null"
        }
      ],
      "default": null
    },
    "headless": {
      "anyOf": [
        {
          "$ref": "#/$defs/RawHeadless"
        },
        {
          "type": "null"
        }
      ],
      "default": null
    },
    "auto_approve": {
      "anyOf": [
        {
          "$ref": "#/$defs/RawAutoApprove"
        },
        {
          "type": "null"
        }
      ],
      "default": null
    },
    "session": {
      "anyOf": [
        {
          "$ref": "#/$defs/RawSession"
        },
        {
          "type": "null"
        }
      ],
      "default": null
    },
    "capabilities": {
      "anyOf": [
        {
          "$ref": "#/$defs/RawCapabilities"
        },
        {
          "type": "null"
        }
      ],
      "default": null
    },
    "wrapper": {
      "anyOf": [
        {
          "$ref": "#/$defs/RawWrapper"
        },
        {
          "type": "null"
        }
      ],
      "default": null
    },
    "auth": {
      "anyOf": [
        {
          "$ref": "#/$defs/RawAuth"
        },
        {
          "type": "null"
        }
      ],
      "default": null
    },
    "protocol": {
      "anyOf": [
        {
          "type": "string"
        },
        {
          "type": "null"
        }
      ],
      "default": null,
      "description": "Wire protocol the agent speaks (anthropic-messages / openai-chat / \u2026)",
      "title": "Protocol"
    },
    "provider": {
      "anyOf": [
        {
          "$ref": "#/$defs/RawProviderBinding"
        },
        {
          "type": "null"
        }
      ],
      "default": null
    },
    "sidecar": {
      "anyOf": [
        {
          "$ref": "#/$defs/RawSidecar"
        },
        {
          "type": "null"
        }
      ],
      "default": null
    },
    "install": {
      "anyOf": [
        {
          "$ref": "#/$defs/RawInstall"
        },
        {
          "type": "null"
        }
      ],
      "default": null
    },
    "help": {
      "anyOf": [
        {
          "$ref": "#/$defs/RawHelp"
        },
        {
          "type": "null"
        }
      ],
      "default": null
    },
    "mounts": {
      "items": {
        "$ref": "#/$defs/RawMountSpec"
      },
      "title": "Mounts",
      "type": "array"
    },
    "web_ingress": {
      "default": false,
      "description": "Whether this entry publishes a host HTTP port",
      "title": "Web Ingress",
      "type": "boolean"
    }
  },
  "title": "terok-executor agent YAML",
  "type": "object",
  "$schema": "https://json-schema.org/draft/2020-12/schema"
}