diff --git a/charts/workspace/scripts/env.reference.yaml b/charts/workspace/scripts/env.reference.yaml
index 13e324e..ea2e7da 100644
--- a/charts/workspace/scripts/env.reference.yaml
+++ b/charts/workspace/scripts/env.reference.yaml
@@ -116,6 +116,20 @@ envs:
           Use only in ephemeral or local environments, never in shared or
           production deployments.
 
+      password_file:
+        type: string
+        default: /run/secrets/workspace/auth_password
+        since: 0.1.3
+        description: Path to a file containing the plaintext password.
+        reference: /editor/authentication
+        longDescription: |
+          **Password lookup precedence:**
+
+          1. `WS_AUTH_PASSWORD_HASHED_FILE` *(hashed file)*.
+          2. `WS_AUTH_PASSWORD_HASHED` *(hashed env var)*.
+          3. `WS_AUTH_PASSWORD_FILE` *(this variable)*.
+          4. `WS_AUTH_PASSWORD` *(plaintext env var)*.
+
       password_hashed:
         type: string
         default: null
@@ -127,6 +141,20 @@ envs:
         longDescription: |
           Takes precedence over plaintext password when both are set.
 
+      password_hashed_file:
+        type: string
+        default: /run/secrets/workspace/auth_password_hashed
+        since: 0.1.3
+        description: Path to a file containing the Argon2 hashed password.
+        reference: /editor/authentication
+        longDescription: |
+          **Password lookup precedence:**
+
+          1. `WS_AUTH_PASSWORD_HASHED_FILE` *(this variable)*.
+          2. `WS_AUTH_PASSWORD_HASHED` *(hashed env var)*.
+          3. `WS_AUTH_PASSWORD_FILE` *(plaintext file)*.
+          4. `WS_AUTH_PASSWORD` *(plaintext env var)*.
+
   ca:
     name: Enterprise CA
     properties:
@@ -157,6 +185,57 @@ envs:
 
           **Use only in fully trusted network environments.**
 
+  claude:
+    properties:
+      statusline_disable:
+        type: boolean
+        default: false
+        since: 0.1.3
+        reference: /editor/claude
+        description: Disables the Claude Code statusline.
+
+      statusline_hide_context_bar:
+        type: boolean
+        default: false
+        since: 0.1.3
+        reference: /editor/claude
+        description: Hides the context usage bar in the Claude statusline.
+
+      statusline_hide_git:
+        type: boolean
+        default: false
+        since: 0.1.3
+        reference: /editor/claude
+        description: Hides git branch and status in the Claude statusline.
+
+      statusline_hide_lines_changed:
+        type: boolean
+        default: false
+        since: 0.1.3
+        reference: /editor/claude
+        description: Hides lines added/removed in the Claude statusline.
+
+      statusline_hide_model:
+        type: boolean
+        default: false
+        since: 0.1.3
+        reference: /editor/claude
+        description: Hides the model name in the Claude statusline.
+
+      statusline_script:
+        type: string
+        default: /etc/claude-code/statusline.zsh
+        since: 0.1.3
+        reference: /editor/claude
+        description: Path to the statusline script.
+
+      statusline_shell:
+        type: string
+        default: zsh
+        since: 0.1.3
+        reference: /editor/claude
+        description: Shell used to execute the statusline script.
+
   docker:
     properties:
       enable_client:
@@ -250,6 +329,25 @@ envs:
           Alternative to `WS_EDITOR_SETTINGS_OVERRIDE` for larger configurations.
         example: /workspace/.settings.json
 
+      trusted_domains:
+        type: string
+        default: null
+        since: 0.1.3
+        example: >-
+          https://github.com,https://stackoverflow.com
+        description: >-
+          Comma-separated list of trusted domains that bypass link
+          confirmation prompts.
+        longDescription: |
+          When a link matching one of these domains is clicked in the editor,
+          it opens directly in the browser without prompting for user
+          confirmation.
+
+          Accepts a **comma-delimited** list of domain URL patterns.
+
+          The editor ships with `https://open-vsx.org` trusted by default
+          (via `product.json`); entries from this variable are added on top.
+
   features:
     properties:
       additional_features: