@fitlab-ai/agent-infra 0.9.1 → 0.9.2

package/dist/lib/agent-clients/adapters/claude-code.js

@@ -0,0 +1,62 @@
+import { defineAgentClientAdapter } from '../adapter.js';
+import { hostJoin } from '../../sandbox/engines/wsl2-paths.js';
+const claudeCodeAdapter = defineAgentClientAdapter({
+    id: 'claude-code',
+    displayName: 'Claude Code',
+    invocation: '/${skillName}',
+    capabilities: {
+        instructions: { level: 'compatible' },
+        skills: { level: 'compatible' },
+        commands: { level: 'integrated' },
+        hooks: { level: 'integrated' },
+        subagents: { level: 'experimental' },
+        orchestration: { level: 'experimental' },
+        sandbox: { level: 'integrated' },
+        verification: { level: 'compatible' }
+    },
+    project: {
+        ownedPathPrefixes: ['.claude/'],
+        managed: ['.claude/commands/', '.claude/agents/'],
+        merged: ['.claude/settings.json'],
+        ejected: [],
+        seedCommands: [{
+                templates: {
+                    en: '.claude/commands/update-agent-infra.en.md',
+                    'zh-CN': '.claude/commands/update-agent-infra.zh-CN.md'
+                },
+                target: '.claude/commands/update-agent-infra.md'
+            }]
+    },
+    sandbox: {
+        createTool: ({ home, project }) => ({
+            id: 'claude-code',
+            name: 'Claude Code',
+            install: { type: 'npm', cmd: '@anthropic-ai/claude-code@latest' },
+            sandboxBase: hostJoin(home, '.agent-infra', 'sandboxes', 'claude-code'),
+            containerMount: '/home/devuser/.claude',
+            versionCmd: 'claude --version',
+            setupHint: 'Authenticates via host credentials live-mounted at ~/.claude/.credentials.json',
+            envVars: { CLAUDE_CONFIG_DIR: '/home/devuser/.claude' },
+            hostPreSeedDirs: [
+                { hostDir: hostJoin(home, '.claude', 'plugins'), sandboxSubdir: 'plugins' }
+            ],
+            pathRewriteFiles: [
+                'plugins/installed_plugins.json',
+                'plugins/known_marketplaces.json'
+            ],
+            hostLiveMounts: [
+                {
+                    hostPath: hostJoin(home, '.agent-infra', 'credentials', project, 'claude-code', '.credentials.json'),
+                    containerSubpath: '.credentials.json'
+                }
+            ]
+        }),
+        aliases: [
+            { name: 'claude-yolo', command: 'claude --dangerously-skip-permissions; tput ed' },
+            { name: 'cy', command: 'claude --dangerously-skip-permissions; tput ed' }
+        ],
+        hooks: []
+    }
+});
+export { claudeCodeAdapter };
+//# sourceMappingURL=claude-code.js.map

package/dist/lib/agent-clients/adapters/codex-sandbox.js

@@ -0,0 +1,210 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import * as toml from 'smol-toml';
+function isJsonObjectRecord(value) {
+    return value !== null && typeof value === 'object' && !Array.isArray(value);
+}
+function resolveHostCatalogPath(value, hostHomeDir) {
+    if (typeof value !== 'string' || value === '') {
+        return null;
+    }
+    let resolved;
+    if (value === '~' || value.startsWith('~/') || value.startsWith('~\\')) {
+        resolved = path.join(hostHomeDir, value.slice(1).replace(/^[/\\]+/, ''));
+    }
+    else if (path.isAbsolute(value)) {
+        resolved = value;
+    }
+    else {
+        resolved = path.join(hostHomeDir, '.codex', value);
+    }
+    try {
+        if (!fs.statSync(resolved).isFile()) {
+            return null;
+        }
+        fs.accessSync(resolved, fs.constants.R_OK);
+        return resolved;
+    }
+    catch {
+        return null;
+    }
+}
+const CODEX_DISABLED_FEATURE_FLAGS = ['apps', 'enable_mcp_apps'];
+function removeCodexMcpServers(sandboxParsed) {
+    if (!Object.hasOwn(sandboxParsed, 'mcp_servers')) {
+        return false;
+    }
+    delete sandboxParsed.mcp_servers;
+    return true;
+}
+function inheritDisabledCodexFeatureFlags(sandboxParsed, hostParsed) {
+    if (!isJsonObjectRecord(hostParsed.features)) {
+        return false;
+    }
+    if (Object.hasOwn(sandboxParsed, 'features') && !isJsonObjectRecord(sandboxParsed.features)) {
+        return false;
+    }
+    let sandboxFeatures = sandboxParsed.features;
+    let changed = false;
+    for (const key of CODEX_DISABLED_FEATURE_FLAGS) {
+        if (hostParsed.features[key] !== false) {
+            continue;
+        }
+        if (!sandboxFeatures) {
+            sandboxFeatures = {};
+            sandboxParsed.features = sandboxFeatures;
+        }
+        if (sandboxFeatures[key] !== false) {
+            sandboxFeatures[key] = false;
+            changed = true;
+        }
+    }
+    return changed;
+}
+function ensureCodexModelInheritance(toolDir, hostHomeDir, containerCodexDir = '/home/devuser/.codex') {
+    if (!hostHomeDir) {
+        return;
+    }
+    const hostConfigPath = path.join(hostHomeDir, '.codex', 'config.toml');
+    if (!fs.existsSync(hostConfigPath)) {
+        return;
+    }
+    let hostParsed;
+    try {
+        hostParsed = toml.parse(fs.readFileSync(hostConfigPath, 'utf8'));
+    }
+    catch {
+        return;
+    }
+    const sandboxConfigPath = path.join(toolDir, 'config.toml');
+    // This rewrites sandbox-side TOML and drops comments; the host config stays untouched.
+    let sandboxParsed = {};
+    if (fs.existsSync(sandboxConfigPath)) {
+        try {
+            sandboxParsed = toml.parse(fs.readFileSync(sandboxConfigPath, 'utf8'));
+        }
+        catch {
+            return;
+        }
+    }
+    let changed = removeCodexMcpServers(sandboxParsed);
+    changed = inheritDisabledCodexFeatureFlags(sandboxParsed, hostParsed) || changed;
+    const inheritSpecs = [
+        ['model', 'string'],
+        ['model_reasoning_effort', 'string'],
+        ['model_auto_compact_token_limit', 'number']
+    ];
+    for (const [key, type] of inheritSpecs) {
+        if (Object.hasOwn(sandboxParsed, key)) {
+            continue;
+        }
+        const value = hostParsed[key];
+        if (type === 'string' && (typeof value !== 'string' || value === '')) {
+            continue;
+        }
+        if (type === 'number' && (typeof value !== 'number' || !Number.isFinite(value) || value <= 0)) {
+            continue;
+        }
+        sandboxParsed[key] = value;
+        changed = true;
+    }
+    if (!Object.hasOwn(sandboxParsed, 'model_catalog_json')) {
+        const hostCatalogPath = resolveHostCatalogPath(hostParsed['model_catalog_json'], hostHomeDir);
+        if (hostCatalogPath) {
+            try {
+                const basename = path.basename(hostCatalogPath);
+                const destDir = path.join(toolDir, 'model-catalogs');
+                fs.mkdirSync(destDir, { recursive: true });
+                fs.copyFileSync(hostCatalogPath, path.join(destDir, basename));
+                sandboxParsed['model_catalog_json'] = path.posix.join(containerCodexDir, 'model-catalogs', basename);
+                changed = true;
+            }
+            catch {
+                // Copy failed (e.g. permissions): skip catalog, keep scalar inheritance intact.
+            }
+        }
+    }
+    if (changed) {
+        fs.writeFileSync(sandboxConfigPath, `${toml.stringify(sandboxParsed)}\n`, 'utf8');
+    }
+}
+function ensureCodexWorkspaceTrust(toolDir) {
+    const configPath = path.join(toolDir, 'config.toml');
+    let content = '';
+    if (fs.existsSync(configPath)) {
+        content = fs.readFileSync(configPath, 'utf8');
+    }
+    if (!content.includes('[projects."/workspace"]')) {
+        const entry = '\n[projects."/workspace"]\ntrust_level = "trusted"\n';
+        fs.writeFileSync(configPath, content + entry, 'utf8');
+    }
+}
+const codexBeforeContainerCreateHook = {
+    id: 'codex-before-container-create',
+    phase: 'before-container-create',
+    async run(context) {
+        const create = context.create;
+        const entry = create?.resolvedTools.find(({ tool }) => tool.id === 'codex');
+        if (!create || !entry) {
+            return {
+                status: 'fatal',
+                message: 'Codex sandbox hook requires its resolved tool state.'
+            };
+        }
+        ensureCodexModelInheritance(entry.dir, create.hostHome, entry.tool.containerMount);
+        ensureCodexWorkspaceTrust(entry.dir);
+        return { status: 'ready' };
+    }
+};
+const codexRecoveryChecks = [
+    {
+        id: 'command-available',
+        probe: {
+            script: 'command -v "$1"',
+            args: ['codex']
+        },
+        finding: {
+            repairKind: 'hard-failure',
+            message: 'Codex is not available on PATH inside the sandbox.'
+        }
+    },
+    {
+        id: 'state-writable',
+        probe: {
+            script: 'probe="$1/.agent-infra-codex-state-$$"; trap \'rm -f -- "$probe"\' EXIT; : > "$probe"',
+            args: ['/home/devuser/.codex']
+        },
+        finding: {
+            repairKind: 'permissions',
+            message: 'Codex state directory is not writable by devuser.',
+            path: '/home/devuser/.codex'
+        }
+    },
+    {
+        id: 'prompts-link',
+        when: {
+            script: 'test -d "$1"',
+            args: ['/workspace/.codex/commands']
+        },
+        probe: {
+            script: 'test "$(readlink -- "$1")" = "$2"',
+            args: ['/home/devuser/.codex/prompts', '/workspace/.codex/commands']
+        },
+        finding: {
+            repairKind: 'builtin-link',
+            message: 'Codex prompts link does not point to the workspace commands directory.',
+            path: '/home/devuser/.codex/prompts'
+        },
+        repair: {
+            user: 'devuser',
+            command: 'ln',
+            args: [
+                '-sfn',
+                '/workspace/.codex/commands',
+                '/home/devuser/.codex/prompts'
+            ]
+        }
+    }
+];
+export { codexBeforeContainerCreateHook, codexRecoveryChecks, ensureCodexModelInheritance, ensureCodexWorkspaceTrust };
+//# sourceMappingURL=codex-sandbox.js.map

package/dist/lib/agent-clients/adapters/codex.js

@@ -0,0 +1,54 @@
+import { defineAgentClientAdapter } from '../adapter.js';
+import { hostJoin } from '../../sandbox/engines/wsl2-paths.js';
+import { codexBeforeContainerCreateHook, codexRecoveryChecks } from './codex-sandbox.js';
+const codexAdapter = defineAgentClientAdapter({
+    id: 'codex',
+    displayName: 'Codex',
+    invocation: '$${skillName}',
+    capabilities: {
+        instructions: { level: 'compatible' },
+        skills: { level: 'compatible' },
+        commands: { level: 'integrated' },
+        hooks: { level: 'integrated' },
+        subagents: { level: 'experimental' },
+        orchestration: { level: 'unsupported' },
+        sandbox: { level: 'integrated' },
+        verification: { level: 'compatible' }
+    },
+    project: {
+        ownedPathPrefixes: ['.codex/'],
+        managed: ['.codex/hooks.json', '.codex/agents/'],
+        merged: [],
+        ejected: [],
+        seedCommands: []
+    },
+    sandbox: {
+        createTool: ({ home }) => ({
+            id: 'codex',
+            name: 'Codex',
+            install: { type: 'npm', cmd: '@openai/codex' },
+            sandboxBase: hostJoin(home, '.agent-infra', 'sandboxes', 'codex'),
+            containerMount: '/home/devuser/.codex',
+            versionCmd: 'codex --version',
+            setupHint: 'Run codex once inside the container and choose Device Code login if needed.',
+            tmpfs: { size: '512m', seed: ['config.toml', 'model-catalogs'] },
+            hostLiveMounts: [
+                {
+                    hostPath: hostJoin(home, '.codex', 'auth.json'),
+                    containerSubpath: 'auth.json'
+                }
+            ],
+            postSetupCmds: [
+                'test -d /workspace/.codex/commands && ln -sfn /workspace/.codex/commands /home/devuser/.codex/prompts || true'
+            ]
+        }),
+        aliases: [
+            { name: 'codex-yolo', command: 'codex --yolo; tput ed' },
+            { name: 'xy', command: 'codex --yolo; tput ed' }
+        ],
+        hooks: [codexBeforeContainerCreateHook],
+        recoveryChecks: codexRecoveryChecks
+    }
+});
+export { codexAdapter };
+//# sourceMappingURL=codex.js.map

package/dist/lib/agent-clients/adapters/gemini-cli.js

@@ -0,0 +1,64 @@
+import { defineAgentClientAdapter } from '../adapter.js';
+import { hostJoin } from '../../sandbox/engines/wsl2-paths.js';
+const geminiCliAdapter = defineAgentClientAdapter({
+    id: 'gemini-cli',
+    displayName: 'Gemini CLI',
+    invocation: '/${projectName}:${skillName}',
+    capabilities: {
+        instructions: { level: 'compatible' },
+        skills: { level: 'compatible' },
+        commands: { level: 'integrated' },
+        hooks: { level: 'compatible' },
+        subagents: { level: 'unsupported' },
+        orchestration: { level: 'unsupported' },
+        sandbox: { level: 'integrated' },
+        verification: { level: 'compatible' }
+    },
+    project: {
+        ownedPathPrefixes: ['.gemini/'],
+        managed: ['.gemini/commands/'],
+        merged: ['.gemini/settings.json'],
+        ejected: [],
+        seedCommands: [{
+                templates: {
+                    en: '.gemini/commands/_project_/update-agent-infra.en.toml',
+                    'zh-CN': '.gemini/commands/_project_/update-agent-infra.zh-CN.toml'
+                },
+                target: '.gemini/commands/${projectName}/update-agent-infra.toml'
+            }]
+    },
+    sandbox: {
+        createTool: ({ home }) => ({
+            id: 'gemini-cli',
+            name: 'Gemini CLI',
+            install: { type: 'npm', cmd: '@google/gemini-cli' },
+            sandboxBase: hostJoin(home, '.agent-infra', 'sandboxes', 'gemini-cli'),
+            containerMount: '/home/devuser/.gemini',
+            versionCmd: 'gemini --version',
+            setupHint: 'Run gemini inside the container to finish authentication.',
+            hostLiveMounts: [
+                {
+                    hostPath: hostJoin(home, '.gemini', 'oauth_creds.json'),
+                    containerSubpath: 'oauth_creds.json'
+                }
+            ],
+            hostPreSeedFiles: [
+                {
+                    hostPath: hostJoin(home, '.gemini', 'settings.json'),
+                    sandboxName: 'settings.json'
+                },
+                {
+                    hostPath: hostJoin(home, '.gemini', 'google_accounts.json'),
+                    sandboxName: 'google_accounts.json'
+                }
+            ]
+        }),
+        aliases: [
+            { name: 'gemini-yolo', command: 'gemini --yolo; tput ed' },
+            { name: 'gy', command: 'gemini --yolo; tput ed' }
+        ],
+        hooks: []
+    }
+});
+export { geminiCliAdapter };
+//# sourceMappingURL=gemini-cli.js.map

package/dist/lib/agent-clients/adapters/index.js

@@ -0,0 +1,20 @@
+import { AGENT_CLIENT_IDS } from '../types.js';
+import { claudeCodeAdapter } from './claude-code.js';
+import { codexAdapter } from './codex.js';
+import { geminiCliAdapter } from './gemini-cli.js';
+import { opencodeAdapter } from './opencode.js';
+const adaptersById = new Map([
+    claudeCodeAdapter,
+    codexAdapter,
+    geminiCliAdapter,
+    opencodeAdapter
+].map((adapter) => [adapter.id, adapter]));
+const BUILTIN_AGENT_CLIENT_ADAPTERS = Object.freeze(AGENT_CLIENT_IDS.map((id) => {
+    const adapter = adaptersById.get(id);
+    if (!adapter) {
+        throw new Error(`Missing built-in Agent Client adapter '${id}'`);
+    }
+    return adapter;
+}));
+export { BUILTIN_AGENT_CLIENT_ADAPTERS };
+//# sourceMappingURL=index.js.map

package/dist/lib/agent-clients/adapters/opencode.js

@@ -0,0 +1,64 @@
+import { defineAgentClientAdapter } from '../adapter.js';
+import { hostJoin } from '../../sandbox/engines/wsl2-paths.js';
+const YOLO_PERMISSION = '{"*":"allow","read":"allow","bash":"allow","edit":"allow","webfetch":"allow","external_directory":"allow","doom_loop":"allow"}';
+const opencodeAdapter = defineAgentClientAdapter({
+    id: 'opencode',
+    displayName: 'OpenCode',
+    invocation: '/${skillName}',
+    capabilities: {
+        instructions: { level: 'compatible' },
+        skills: { level: 'compatible' },
+        commands: { level: 'integrated' },
+        hooks: { level: 'compatible' },
+        subagents: { level: 'unsupported' },
+        orchestration: { level: 'unsupported' },
+        sandbox: { level: 'integrated' },
+        verification: { level: 'compatible' }
+    },
+    project: {
+        ownedPathPrefixes: ['.opencode/'],
+        managed: ['.opencode/commands/'],
+        merged: [],
+        ejected: [],
+        seedCommands: [{
+                templates: {
+                    en: '.opencode/commands/update-agent-infra.en.md',
+                    'zh-CN': '.opencode/commands/update-agent-infra.zh-CN.md'
+                },
+                target: '.opencode/commands/update-agent-infra.md'
+            }]
+    },
+    sandbox: {
+        createTool: ({ home }) => ({
+            id: 'opencode',
+            name: 'OpenCode',
+            install: { type: 'npm', cmd: 'opencode-ai' },
+            sandboxBase: hostJoin(home, '.agent-infra', 'sandboxes', 'opencode'),
+            containerMount: '/home/devuser/.local/share/opencode',
+            versionCmd: 'opencode --version',
+            setupHint: 'Configure OpenCode credentials inside the container before first use.',
+            envVars: {
+                OPENCODE_CONFIG: '/home/devuser/.local/share/opencode/opencode.json'
+            },
+            hostLiveMounts: [
+                {
+                    hostPath: hostJoin(home, '.local', 'share', 'opencode', 'auth.json'),
+                    containerSubpath: 'auth.json'
+                }
+            ]
+        }),
+        aliases: [
+            {
+                name: 'opencode-yolo',
+                command: `OPENCODE_PERMISSION='${YOLO_PERMISSION}' opencode; tput ed`
+            },
+            {
+                name: 'oy',
+                command: `OPENCODE_PERMISSION='${YOLO_PERMISSION}' opencode; tput ed`
+            }
+        ],
+        hooks: []
+    }
+});
+export { opencodeAdapter };
+//# sourceMappingURL=opencode.js.map

package/dist/lib/agent-clients/config.js

@@ -0,0 +1,177 @@
+import { AGENT_CLIENT_IDS, isAgentClientId } from './types.js';
+class AgentClientConfigError extends Error {
+    code;
+    path;
+    diagnostics;
+    constructor(diagnostic) {
+        super(`${diagnostic.code} at ${diagnostic.path}`);
+        this.name = 'AgentClientConfigError';
+        this.code = diagnostic.code;
+        this.path = diagnostic.path;
+        this.diagnostics = [diagnostic];
+    }
+}
+function hasOwn(value, key) {
+    return Object.prototype.hasOwnProperty.call(value, key);
+}
+function isRecord(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+function fail(code, path) {
+    throw new AgentClientConfigError({ code, path });
+}
+function parseCanonical(value) {
+    if (!Array.isArray(value))
+        fail('INVALID_AGENT_CLIENTS', 'agentClients');
+    const entries = new Map();
+    for (const [index, candidate] of value.entries()) {
+        const path = `agentClients[${index}]`;
+        if (!isRecord(candidate))
+            fail('INVALID_AGENT_CLIENTS', path);
+        const keys = Object.keys(candidate);
+        if (keys.length !== 3
+            || !hasOwn(candidate, 'id')
+            || !hasOwn(candidate, 'enabled')
+            || !hasOwn(candidate, 'installInSandbox')) {
+            fail('INVALID_AGENT_CLIENTS', path);
+        }
+        if (!isAgentClientId(candidate.id)) {
+            fail('UNKNOWN_AGENT_CLIENT', `${path}.id`);
+        }
+        if (entries.has(candidate.id)) {
+            fail('DUPLICATE_AGENT_CLIENT', `${path}.id`);
+        }
+        if (typeof candidate.enabled !== 'boolean'
+            || typeof candidate.installInSandbox !== 'boolean') {
+            fail('INVALID_AGENT_CLIENTS', path);
+        }
+        entries.set(candidate.id, {
+            enabled: candidate.enabled,
+            installInSandbox: candidate.installInSandbox
+        });
+    }
+    for (const id of AGENT_CLIENT_IDS) {
+        if (!entries.has(id))
+            fail('MISSING_AGENT_CLIENT', 'agentClients');
+    }
+    return Object.fromEntries(AGENT_CLIENT_IDS.map((id) => [id, entries.get(id)]));
+}
+function serializeAgentClients(state) {
+    return AGENT_CLIENT_IDS.map((id) => ({
+        id,
+        enabled: state[id].enabled,
+        installInSandbox: state[id].installInSandbox
+    }));
+}
+function projectLegacyTuis(value, diagnostics) {
+    if (!Array.isArray(value)) {
+        return Object.fromEntries(AGENT_CLIENT_IDS.map((id) => [id, true]));
+    }
+    const enabled = new Set();
+    for (const [index, candidate] of value.entries()) {
+        if (isAgentClientId(candidate)) {
+            enabled.add(candidate);
+        }
+        else {
+            diagnostics.push({
+                code: 'LEGACY_VALUE_IGNORED',
+                path: `tuis[${index}]`
+            });
+        }
+    }
+    return Object.fromEntries(AGENT_CLIENT_IDS.map((id) => [id, enabled.has(id)]));
+}
+function projectLegacySandbox(value, diagnostics) {
+    if (!Array.isArray(value) || value.length === 0) {
+        return {
+            installed: Object.fromEntries(AGENT_CLIENT_IDS.map((id) => [id, true])),
+            clientSignals: new Set(),
+            remainingTools: Array.isArray(value) ? [] : undefined
+        };
+    }
+    const installed = new Set();
+    const remainingTools = [];
+    for (const [index, candidate] of value.entries()) {
+        if (isAgentClientId(candidate)) {
+            installed.add(candidate);
+        }
+        else if (typeof candidate === 'string') {
+            remainingTools.push(candidate);
+        }
+        else {
+            diagnostics.push({
+                code: 'LEGACY_VALUE_IGNORED',
+                path: `sandbox.tools[${index}]`
+            });
+        }
+    }
+    return {
+        installed: Object.fromEntries(AGENT_CLIENT_IDS.map((id) => [id, installed.has(id)])),
+        clientSignals: installed,
+        remainingTools
+    };
+}
+function stateFromLegacy(enabled, installed) {
+    return Object.fromEntries(AGENT_CLIENT_IDS.map((id) => [
+        id,
+        {
+            enabled: enabled[id],
+            installInSandbox: installed[id]
+        }
+    ]));
+}
+function sameCanonicalOrder(value) {
+    return Array.isArray(value)
+        && value.every((entry, index) => isRecord(entry) && entry.id === AGENT_CLIENT_IDS[index]);
+}
+function normalizeAgentClients(input) {
+    const diagnostics = [];
+    const hasCanonical = hasOwn(input, 'agentClients');
+    const hasLegacyTuis = hasOwn(input, 'tuis');
+    const sandbox = isRecord(input.sandbox) ? input.sandbox : undefined;
+    const hasLegacySandboxTools = sandbox !== undefined && hasOwn(sandbox, 'tools');
+    const tuiProjection = projectLegacyTuis(input.tuis, diagnostics);
+    const sandboxProjection = projectLegacySandbox(sandbox?.tools, diagnostics);
+    if (!hasCanonical) {
+        const state = stateFromLegacy(tuiProjection, sandboxProjection.installed);
+        return {
+            source: 'legacy',
+            state,
+            canonical: serializeAgentClients(state),
+            remainingSandboxTools: sandboxProjection.remainingTools,
+            removeLegacyTuis: hasLegacyTuis,
+            changed: true,
+            diagnostics
+        };
+    }
+    const state = parseCanonical(input.agentClients);
+    if (hasLegacyTuis) {
+        for (const id of AGENT_CLIENT_IDS) {
+            if (state[id].enabled !== tuiProjection[id]) {
+                fail('LEGACY_CONFLICT', 'tuis');
+            }
+        }
+    }
+    if (hasLegacySandboxTools) {
+        for (const id of sandboxProjection.clientSignals) {
+            if (!state[id].installInSandbox) {
+                fail('LEGACY_CONFLICT', 'sandbox.tools');
+            }
+        }
+    }
+    return {
+        source: 'canonical',
+        state,
+        canonical: serializeAgentClients(state),
+        remainingSandboxTools: hasLegacySandboxTools
+            ? sandboxProjection.remainingTools
+            : undefined,
+        removeLegacyTuis: hasLegacyTuis,
+        changed: hasLegacyTuis
+            || sandboxProjection.clientSignals.size > 0
+            || !sameCanonicalOrder(input.agentClients),
+        diagnostics
+    };
+}
+export { AgentClientConfigError, normalizeAgentClients, serializeAgentClients };
+//# sourceMappingURL=config.js.map