mcp_servers.<id>.http_headers: static headers for MCP HTTP servers. mcp_servers.

sandbox_workspace_write.writable_roots: extra writable roots in workspace-write mode.

sandbox_workspace_write.network_access: network access inside workspace-write mode.

sandbox_workspace_write.exclude_tmpdir_env_var: remove $TMPDIR from writable roots.

sandbox_workspace_write.exclude_slash_tmp: remove /tmp from writable roots.

profile: default named profile at startup.

profiles.<name>.*: profile-scoped overrides.

profiles.<name>.service_tier: per-profile tier.

profiles.<name>.plan_mode_reasoning_effort: per-profile plan reasoning.

profiles.<name>.web_search: per-profile search mode.

profiles.<name>.personality: per-profile personality.

profiles.<name>.model_catalog_json: per-profile model catalog.

profiles.<name>.model_instructions_file: per-profile instruction file.

profiles.<name>.experimental_use_unified_exec_tool: legacy unified-exec alias per profile.

profiles.<name>.oss_provider: per-profile OSS provider.

profiles.<name>.tools_view_image: per-profile image tool toggle.

profiles.<name>.analytics.enabled: per-profile analytics.

profiles.<name>.windows.sandbox: per-profile Windows sandbox.

plan_mode_reasoning_effort: dedicated reasoning setting for Plan mode.