@fitlab-ai/agent-infra 0.9.2 → 0.9.4

package/dist/lib/agent-clients/adapters/antigravity-cli.js

@@ -0,0 +1,64 @@
+import { defineAgentClientAdapter } from '../adapter.js';
+import { hostJoin } from '../../sandbox/engines/wsl2-paths.js';
+const antigravityCliAdapter = defineAgentClientAdapter({
+    id: 'antigravity-cli',
+    displayName: 'Antigravity CLI',
+    invocation: '/${skillName}',
+    capabilities: {
+        instructions: { level: 'compatible' },
+        skills: { level: 'integrated' },
+        commands: { level: 'integrated' },
+        hooks: { level: 'compatible' },
+        subagents: { level: 'unsupported' },
+        orchestration: { level: 'unsupported' },
+        sandbox: { level: 'integrated' },
+        verification: { level: 'compatible' }
+    },
+    modelSelection: {
+        kind: 'interactive-only',
+        command: '/model',
+        guidance: 'Use the host model picker for the complete model and reasoning-effort catalog.'
+    },
+    delegationEvidence: {
+        actualModel: 'unavailable',
+        actualReasoningEffort: 'unavailable'
+    },
+    project: {
+        ownedPathPrefixes: [],
+        managed: [],
+        merged: [],
+        ejected: [],
+        seedCommands: []
+    },
+    sandbox: {
+        createTool: ({ home }) => ({
+            id: 'antigravity-cli',
+            name: 'Antigravity CLI',
+            install: {
+                type: 'shell',
+                cmd: 'curl -fsSL https://antigravity.google/cli/install.sh | bash -s -- --dir /home/devuser/.npm-global/bin'
+            },
+            sandboxBase: hostJoin(home, '.agent-infra', 'sandboxes', 'antigravity-cli'),
+            containerMount: '/home/devuser/.gemini',
+            versionCmd: 'agy --version',
+            setupHint: 'Run agy inside the container to finish authentication.',
+            hostPreSeedFiles: [
+                {
+                    hostPath: hostJoin(home, '.gemini', 'antigravity-cli', 'keybindings.json'),
+                    sandboxName: 'antigravity-cli/keybindings.json'
+                },
+                {
+                    hostPath: hostJoin(home, '.gemini', 'config', 'mcp_config.json'),
+                    sandboxName: 'config/mcp_config.json'
+                }
+            ]
+        }),
+        aliases: [
+            { name: 'antigravity-yolo', command: 'agy --dangerously-skip-permissions; tput ed' },
+            { name: 'agy-yolo', command: 'agy --dangerously-skip-permissions; tput ed' }
+        ],
+        hooks: []
+    }
+});
+export { antigravityCliAdapter };
+//# sourceMappingURL=antigravity-cli.js.map

package/dist/lib/{sandbox/credentials.js → agent-clients/adapters/claude-code-credentials.js}

@@ -2,15 +2,10 @@ import { execFileSync } from 'node:child_process';
 import { randomBytes } from 'node:crypto';
 import fs from 'node:fs';
 import path from 'node:path';
-import { hostJoin } from './engines/wsl2-paths.js';
+import { hostJoin } from '../../sandbox/engines/wsl2-paths.js';
+import { redactCommandError } from '../../sandbox/redaction.js';
 const LOCKED_PATTERN = /errSecInteractionNotAllowed|User interaction is not allowed/i;
 const NOT_FOUND_PATTERN = /errSecItemNotFound|specified item could not be found/i;
-const REDACTION_PATTERNS = [
-    { pattern: /\{[^{}]*"claudeAiOauth"[\s\S]*?\}\s*\}/g, replacement: '[REDACTED credentials blob]' },
-    { pattern: /sk-ant-[A-Za-z0-9_-]{20,}/g, replacement: '[REDACTED claude token]' },
-    { pattern: /gh[psoru]_[A-Za-z0-9]{30,}/g, replacement: '[REDACTED github token]' },
-    { pattern: /Bearer\s+[A-Za-z0-9._~+/=-]{20,}/gi, replacement: 'Bearer [REDACTED]' }
-];
 function isRecord(value) {
     return typeof value === 'object' && value !== null && !Array.isArray(value);
 }
@@ -20,13 +15,8 @@ function hasNonEmptyString(value) {
 function errorMessage(error) {
     return error instanceof Error ? error.message : 'unknown error';
 }
-export function redactCommandError(text) {
-    if (!text || typeof text !== 'string') {
-        return '';
-    }
-    return REDACTION_PATTERNS.reduce((result, { pattern, replacement }) => result.replace(pattern, replacement), text);
-}
 export const redactSecurityOutput = redactCommandError;
+export { redactCommandError };
 function extractStderrSafely(error) {
     const stderr = typeof error === 'object' && error !== null && 'stderr' in error
         ? error.stderr
@@ -492,4 +482,4 @@ export function prepareClaudeCredentials(home, project, resolvedTools, extractFn
     writeFn(home, project, blob);
     return { status: 'OK' };
 }
-//# sourceMappingURL=credentials.js.map
+//# sourceMappingURL=claude-code-credentials.js.map

package/dist/lib/agent-clients/adapters/claude-code-refresh.js

@@ -0,0 +1,85 @@
+import { homedir } from 'node:os';
+import { parseArgs } from 'node:util';
+import { buildLockedGuidance, discoverProjects, formatCredentialWarnings, formatRemaining, reconcileClaudeCredentials, redactCommandError, validateClaudeCredentialsEnvOverride } from './claude-code-credentials.js';
+import { runProbe } from '../../sandbox/shell.js';
+const USAGE = 'Usage: ai sandbox refresh';
+export function probeClaudeStatus(spawnFn = runProbe) {
+    const result = spawnFn('claude', ['/status'], {
+        encoding: 'utf8',
+        stdio: ['ignore', 'pipe', 'pipe'],
+        timeout: 30_000
+    });
+    return {
+        ok: result.status === 0,
+        stderr: result.stderr?.toString() ?? '',
+        error: result.error?.message ?? null
+    };
+}
+export async function runClaudeCodeRefresh(args, deps = {}) {
+    const { spawnFn = runProbe, execFn, readFn, existsFn, writeFn, writeHostFn, discoverFn = discoverProjects, writeStdout = (chunk) => process.stdout.write(chunk), writeStderr = (chunk) => process.stderr.write(chunk) } = deps;
+    if (args[0] === '--help' || args[0] === '-h' || args[0] === 'help') {
+        writeStdout(`${USAGE}\n`);
+        return 0;
+    }
+    const { positionals } = parseArgs({ args, allowPositionals: true, strict: true });
+    if (positionals.length > 0) {
+        throw new Error(USAGE);
+    }
+    validateClaudeCredentialsEnvOverride();
+    const home = homedir();
+    if (!home) {
+        throw new Error('sandbox: home directory is required');
+    }
+    const projects = discoverFn(home);
+    if (projects.length === 0) {
+        writeStdout('No project credentials to refresh.\n');
+        return 0;
+    }
+    const reconcileOptions = { execFn, readFn, existsFn, writeFn, writeHostFn, projects };
+    let result = reconcileClaudeCredentials(home, reconcileOptions);
+    if (result.status === 'STALE_ACCESS' && result.authoritative === null) {
+        writeStdout('Host credentials appear stale; probing claude /status to trigger refresh...\n');
+        const probe = probeClaudeStatus(spawnFn);
+        if (!probe.ok) {
+            writeStderr(`Probe failed: ${redactCommandError(probe.stderr || probe.error || 'unknown error')}\n`);
+            writeStderr('Run "claude /login" on the host to renew credentials.\n');
+            return 1;
+        }
+        writeStdout('Probe succeeded; re-inspecting host credentials.\n');
+        result = reconcileClaudeCredentials(home, reconcileOptions);
+    }
+    if (result.status === 'MISSING') {
+        writeStderr('No Claude Code credentials found on host.\n');
+        writeStderr('Run "claude /login" on the host to authenticate.\n');
+        return 1;
+    }
+    if (result.status === 'KEYCHAIN_LOCKED') {
+        writeStderr(`${buildLockedGuidance()}\n`);
+        return 1;
+    }
+    if (result.status === 'KEYCHAIN_ERROR') {
+        writeStderr(`Host keychain error: ${redactCommandError(result.detail || 'unknown error')}\n`);
+        writeStderr(`${buildLockedGuidance()}\n`);
+        return 1;
+    }
+    if (result.status === 'KEYCHAIN_WRITE_FAILED') {
+        writeStderr(`[host] keychain write failed: ${formatCredentialWarnings(result.warnings) || 'unknown error'}\n`);
+        return 1;
+    }
+    if (result.status !== 'OK') {
+        writeStderr('Host credentials still invalid after probe; run "claude /login".\n');
+        return 1;
+    }
+    if (result.authoritative && result.authoritative !== 'host' && result.hostWritten) {
+        writeStdout(`[host] reconciled from ${result.authoritative}\n`);
+    }
+    for (const project of projects) {
+        const action = result.filesWritten.includes(project) ? 'updated' : 'unchanged';
+        writeStdout(`[${project}] ${action}; expires in ${formatRemaining(result.expiresAt)}\n`);
+    }
+    for (const failure of result.fileErrors) {
+        writeStderr(`[${failure.project}] sync failed: ${failure.error}\n`);
+    }
+    return result.fileErrors.length > 0 ? 1 : 0;
+}
+//# sourceMappingURL=claude-code-refresh.js.map

package/dist/lib/agent-clients/adapters/claude-code-sandbox.js

@@ -0,0 +1,247 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import { formatCredentialWarnings, formatRemaining, hasClaudeProviderAuth, inspectClaudeKeychainStatus, prepareClaudeCredentials, reconcileClaudeCredentials, redactCommandError, validateClaudeCredentialsEnvOverride } from './claude-code-credentials.js';
+function readHostJsonSafe(filePath) {
+    if (!filePath || !fs.existsSync(filePath))
+        return null;
+    try {
+        const parsed = JSON.parse(fs.readFileSync(filePath, 'utf8'));
+        return parsed && typeof parsed === 'object' && !Array.isArray(parsed)
+            ? parsed
+            : null;
+    }
+    catch {
+        return null;
+    }
+}
+const CLAUDE_SETTINGS_INHERIT_TOP_LEVEL_KEYS = [
+    'model',
+    'fallbackModel',
+    'availableModels',
+    'modelOverrides',
+    'enforceAvailableModels',
+    'advisorModel',
+    'apiKeyHelper',
+    'effortLevel'
+];
+function isJsonObjectRecord(value) {
+    return value !== null && typeof value === 'object' && !Array.isArray(value);
+}
+function mergeMissingStringEnvFields(target, source) {
+    if (!isJsonObjectRecord(source.env))
+        return false;
+    if (Object.hasOwn(target, 'env') && !isJsonObjectRecord(target.env))
+        return false;
+    let targetEnv = target.env;
+    let changed = false;
+    for (const [key, value] of Object.entries(source.env)) {
+        if (typeof value !== 'string' || value === '')
+            continue;
+        if (!targetEnv) {
+            targetEnv = {};
+            target.env = targetEnv;
+        }
+        if (!Object.hasOwn(targetEnv, key)) {
+            targetEnv[key] = value;
+            changed = true;
+        }
+    }
+    return changed;
+}
+function mergeMissingTopLevelSettings(target, source) {
+    let changed = false;
+    for (const key of CLAUDE_SETTINGS_INHERIT_TOP_LEVEL_KEYS) {
+        if (!Object.hasOwn(source, key) || Object.hasOwn(target, key))
+            continue;
+        const value = source[key];
+        if (value === null || value === undefined || value === '')
+            continue;
+        target[key] = value;
+        changed = true;
+    }
+    return changed;
+}
+function requireCreateContext(context, hookId) {
+    if (!context)
+        throw new Error(`${hookId} requires create context`);
+    return context;
+}
+function requireEnterContext(context, hookId) {
+    if (!context)
+        throw new Error(`${hookId} requires enter context`);
+    return context;
+}
+export function ensureClaudeOnboarding(toolDir, hostHomeDir) {
+    const claudeJsonPath = path.join(toolDir, '.claude.json');
+    let data = {};
+    if (fs.existsSync(claudeJsonPath)) {
+        try {
+            data = JSON.parse(fs.readFileSync(claudeJsonPath, 'utf8'));
+        }
+        catch {
+            // Malformed JSON is replaced with a valid managed sandbox baseline.
+        }
+    }
+    let changed = false;
+    if (!data.hasCompletedOnboarding) {
+        data.hasCompletedOnboarding = true;
+        changed = true;
+    }
+    if (!data.projects) {
+        data.projects = {};
+        changed = true;
+    }
+    if (!data.projects['/workspace']) {
+        data.projects['/workspace'] = {};
+        changed = true;
+    }
+    if (!data.projects['/workspace'].hasTrustDialogAccepted) {
+        data.projects['/workspace'].hasTrustDialogAccepted = true;
+        changed = true;
+    }
+    if (hostHomeDir) {
+        const hostClaudeJson = readHostJsonSafe(path.join(hostHomeDir, '.claude.json'));
+        if (hostClaudeJson
+            && typeof hostClaudeJson.model === 'string'
+            && hostClaudeJson.model !== ''
+            && !Object.hasOwn(data, 'model')) {
+            data.model = hostClaudeJson.model;
+            changed = true;
+        }
+        if (hostClaudeJson) {
+            for (const key of Object.keys(hostClaudeJson)) {
+                if (/^unpin.*LaunchEffort$/.test(key)
+                    && hostClaudeJson[key] === true
+                    && !Object.hasOwn(data, key)) {
+                    data[key] = true;
+                    changed = true;
+                }
+            }
+        }
+    }
+    if (changed)
+        fs.writeFileSync(claudeJsonPath, JSON.stringify(data, null, 4), 'utf8');
+}
+export function ensureClaudeSettings(toolDir, hostHomeDir) {
+    const settingsPath = path.join(toolDir, 'settings.json');
+    let data = {};
+    if (fs.existsSync(settingsPath)) {
+        try {
+            data = JSON.parse(fs.readFileSync(settingsPath, 'utf8'));
+        }
+        catch {
+            // Malformed JSON is replaced with a valid managed sandbox baseline.
+        }
+    }
+    let changed = false;
+    if (data.skipDangerousModePermissionPrompt !== true) {
+        data.skipDangerousModePermissionPrompt = true;
+        changed = true;
+    }
+    if (hostHomeDir) {
+        const hostSettings = readHostJsonSafe(path.join(hostHomeDir, '.claude', 'settings.json'));
+        if (hostSettings) {
+            changed = mergeMissingStringEnvFields(data, hostSettings) || changed;
+            changed = mergeMissingTopLevelSettings(data, hostSettings) || changed;
+        }
+    }
+    if (changed)
+        fs.writeFileSync(settingsPath, JSON.stringify(data, null, 4), 'utf8');
+}
+export function formatCredentialSyncStatus(result, isTTY = process.stderr.isTTY, providerAuthAvailable = false) {
+    if (providerAuthAvailable && (result.status === 'STALE_ACCESS' || result.status === 'MISSING'))
+        return null;
+    if (result.status === 'STALE_ACCESS') {
+        return 'Warning: Claude Code credentials on host appear stale. Run "ai sandbox refresh" or "claude /login" to renew.\n';
+    }
+    if (result.status === 'MISSING') {
+        return 'Warning: Claude Code credentials missing on host. Run "claude /login" to authenticate.\n';
+    }
+    if (result.status === 'KEYCHAIN_WRITE_FAILED') {
+        return `Warning: A sandbox refresh produced newer credentials but host Keychain write failed (${formatCredentialWarnings(result.warnings)}). Run "ai sandbox refresh" again or "claude /status" on the host to retry.\n`;
+    }
+    if (result.status === 'KEYCHAIN_LOCKED' || result.status === 'KEYCHAIN_ERROR') {
+        return 'Warning: Host keychain is unavailable; Claude credential sync skipped. Run "ai sandbox refresh" for details.\n';
+    }
+    if (result.status === 'OK' && result.authoritative !== 'host') {
+        const message = `Synced Claude Code credentials from sandbox refresh back to host (expires in ${formatRemaining(result.expiresAt)})`;
+        return isTTY ? `\x1b[2m${message}\x1b[0m\n` : `${message}\n`;
+    }
+    if (result.status === 'OK' && result.filesWritten.length > 0) {
+        const message = `Synced Claude Code credentials from host Keychain (expires in ${formatRemaining(result.expiresAt)})`;
+        return isTTY ? `\x1b[2m${message}\x1b[0m\n` : `${message}\n`;
+    }
+    return null;
+}
+const claudeCodeCredentialPreflightHook = {
+    id: 'claude-code-credential-preflight',
+    phase: 'prepare',
+    run: async ({ create }) => {
+        const { hostHome, hostEnv, project, resolvedTools } = requireCreateContext(create, 'claude-code-credential-preflight');
+        try {
+            validateClaudeCredentialsEnvOverride(hostEnv);
+            const outcome = prepareClaudeCredentials(hostHome, project, [...resolvedTools], undefined, undefined, (home) => inspectClaudeKeychainStatus(home, undefined, { envFn: () => ({ ...hostEnv }) }));
+            if (outcome.status === 'SKIPPED') {
+                return {
+                    status: 'warning',
+                    message: 'Claude Code credentials not found on host - creating this sandbox WITHOUT Claude Code credentials.\n'
+                        + '  Claude Code is still installed in the image but will not be authenticated.\n'
+                        + '  To enable it: run "claude" once on the host to complete login, then re-run "ai sandbox create".'
+                };
+            }
+            return { status: 'ready' };
+        }
+        catch (error) {
+            return {
+                status: 'fatal',
+                message: redactCommandError(error instanceof Error ? error.message : 'unknown credential error')
+            };
+        }
+    }
+};
+const claudeCodeBeforeContainerCreateHook = {
+    id: 'claude-code-before-container-create',
+    phase: 'before-container-create',
+    run: async ({ create }) => {
+        const { hostHome, resolvedTools } = requireCreateContext(create, 'claude-code-before-container-create');
+        const claudeCodeEntry = resolvedTools.find(({ tool }) => tool.id === 'claude-code');
+        if (claudeCodeEntry) {
+            ensureClaudeOnboarding(claudeCodeEntry.dir, hostHome);
+            ensureClaudeSettings(claudeCodeEntry.dir, hostHome);
+        }
+        return { status: 'ready' };
+    }
+};
+const claudeCodeBeforeEnterHook = {
+    id: 'claude-code-before-enter',
+    phase: 'before-enter',
+    run: async ({ enter }) => {
+        const { hostHome, hostEnv } = requireEnterContext(enter, 'claude-code-before-enter');
+        try {
+            validateClaudeCredentialsEnvOverride(hostEnv);
+        }
+        catch (error) {
+            return {
+                status: 'fatal',
+                message: redactCommandError(error instanceof Error ? error.message : 'invalid credentials override')
+            };
+        }
+        try {
+            const providerAuthAvailable = hasClaudeProviderAuth(hostHome);
+            const result = reconcileClaudeCredentials(hostHome, { envFn: () => ({ ...hostEnv }) });
+            const message = formatCredentialSyncStatus(result, process.stderr.isTTY, providerAuthAvailable);
+            return {
+                status: 'ready',
+                ...(message === null ? {} : { message })
+            };
+        }
+        catch (error) {
+            return {
+                status: 'warning',
+                message: `Failed to sync Claude Code credentials: ${redactCommandError(error instanceof Error ? error.message : 'unknown error')}`
+            };
+        }
+    }
+};
+export { claudeCodeBeforeContainerCreateHook, claudeCodeBeforeEnterHook, claudeCodeCredentialPreflightHook };
+//# sourceMappingURL=claude-code-sandbox.js.map

package/dist/lib/agent-clients/adapters/claude-code.js

@@ -1,5 +1,6 @@
 import { defineAgentClientAdapter } from '../adapter.js';
 import { hostJoin } from '../../sandbox/engines/wsl2-paths.js';
+import { claudeCodeBeforeContainerCreateHook, claudeCodeBeforeEnterHook, claudeCodeCredentialPreflightHook } from './claude-code-sandbox.js';
 const claudeCodeAdapter = defineAgentClientAdapter({
     id: 'claude-code',
     displayName: 'Claude Code',
@@ -10,13 +11,22 @@ const claudeCodeAdapter = defineAgentClientAdapter({
         commands: { level: 'integrated' },
         hooks: { level: 'integrated' },
         subagents: { level: 'experimental' },
-        orchestration: { level: 'experimental' },
+        orchestration: { level: 'unsupported' },
         sandbox: { level: 'integrated' },
         verification: { level: 'compatible' }
     },
+    modelSelection: {
+        kind: 'interactive-only',
+        command: '/model',
+        guidance: 'Use the host model picker for the complete model and reasoning-effort catalog.'
+    },
+    delegationEvidence: {
+        actualModel: 'unavailable',
+        actualReasoningEffort: 'unavailable'
+    },
     project: {
         ownedPathPrefixes: ['.claude/'],
-        managed: ['.claude/commands/', '.claude/agents/'],
+        managed: ['.claude/commands/', '.claude/agents/', '.claude/rules/'],
         merged: ['.claude/settings.json'],
         ejected: [],
         seedCommands: [{
@@ -25,9 +35,18 @@ const claudeCodeAdapter = defineAgentClientAdapter({
                     'zh-CN': '.claude/commands/update-agent-infra.zh-CN.md'
                 },
                 target: '.claude/commands/update-agent-infra.md'
-            }]
+            }],
+        customCommand: {
+            target: '.claude/commands/${skillName}.md',
+            frontmatter: {},
+            includeUsage: true,
+            inheritDisableModelInvocation: true
+        }
     },
     sandbox: {
+        image: {
+            dockerfileFragment: 'claude-code'
+        },
         createTool: ({ home, project }) => ({
             id: 'claude-code',
             name: 'Claude Code',
@@ -55,7 +74,11 @@ const claudeCodeAdapter = defineAgentClientAdapter({
             { name: 'claude-yolo', command: 'claude --dangerously-skip-permissions; tput ed' },
             { name: 'cy', command: 'claude --dangerously-skip-permissions; tput ed' }
         ],
-        hooks: []
+        hooks: [
+            claudeCodeCredentialPreflightHook,
+            claudeCodeBeforeContainerCreateHook,
+            claudeCodeBeforeEnterHook
+        ]
     }
 });
 export { claudeCodeAdapter };

package/dist/lib/agent-clients/adapters/codex.js

@@ -15,6 +15,15 @@ const codexAdapter = defineAgentClientAdapter({
         sandbox: { level: 'integrated' },
         verification: { level: 'compatible' }
     },
+    modelSelection: {
+        kind: 'interactive-only',
+        command: '/model',
+        guidance: 'Use the host model picker for the complete model and reasoning-effort catalog.'
+    },
+    delegationEvidence: {
+        actualModel: 'unavailable',
+        actualReasoningEffort: 'unavailable'
+    },
     project: {
         ownedPathPrefixes: ['.codex/'],
         managed: ['.codex/hooks.json', '.codex/agents/'],

package/dist/lib/agent-clients/adapters/index.js

@@ -1,12 +1,12 @@
 import { AGENT_CLIENT_IDS } from '../types.js';
 import { claudeCodeAdapter } from './claude-code.js';
 import { codexAdapter } from './codex.js';
-import { geminiCliAdapter } from './gemini-cli.js';
+import { antigravityCliAdapter } from './antigravity-cli.js';
 import { opencodeAdapter } from './opencode.js';
 const adaptersById = new Map([
     claudeCodeAdapter,
     codexAdapter,
-    geminiCliAdapter,
+    antigravityCliAdapter,
     opencodeAdapter
 ].map((adapter) => [adapter.id, adapter]));
 const BUILTIN_AGENT_CLIENT_ADAPTERS = Object.freeze(AGENT_CLIENT_IDS.map((id) => {

package/dist/lib/agent-clients/adapters/opencode-sandbox.js

@@ -0,0 +1,108 @@
+import fs from 'node:fs';
+import path from 'node:path';
+function readJsonObject(filePath) {
+    try {
+        const parsed = JSON.parse(fs.readFileSync(filePath, 'utf8'));
+        return parsed !== null && typeof parsed === 'object' && !Array.isArray(parsed)
+            ? parsed
+            : null;
+    }
+    catch {
+        return null;
+    }
+}
+function resolveXdgRoot(value, fallback) {
+    return typeof value === 'string' && value !== '' && path.isAbsolute(value)
+        ? value
+        : fallback;
+}
+function ensureOpenCodeSandboxState(toolDir, hostHome, hostEnv = {}) {
+    const canonicalConfigDir = path.join(toolDir, '.xdg', 'config', 'opencode');
+    const canonicalStateDir = path.join(toolDir, '.xdg', 'state', 'opencode');
+    const canonicalConfigPath = path.join(canonicalConfigDir, 'opencode.json');
+    const legacyConfigPath = path.join(toolDir, 'opencode.json');
+    fs.mkdirSync(canonicalConfigDir, { recursive: true });
+    fs.mkdirSync(canonicalStateDir, { recursive: true });
+    if (!fs.existsSync(canonicalConfigPath) && fs.existsSync(legacyConfigPath)) {
+        fs.copyFileSync(legacyConfigPath, canonicalConfigPath, fs.constants.COPYFILE_EXCL);
+    }
+    const hostConfigRoot = resolveXdgRoot(hostEnv.XDG_CONFIG_HOME, path.join(hostHome, '.config'));
+    const hostConfig = readJsonObject(path.join(hostConfigRoot, 'opencode', 'opencode.json'));
+    if (!hostConfig) {
+        return;
+    }
+    let sandboxConfig = {};
+    if (fs.existsSync(canonicalConfigPath)) {
+        const existing = readJsonObject(canonicalConfigPath);
+        if (!existing) {
+            return;
+        }
+        sandboxConfig = existing;
+    }
+    let changed = false;
+    for (const key of ['model', 'small_model']) {
+        if (Object.hasOwn(sandboxConfig, key)) {
+            continue;
+        }
+        const value = hostConfig[key];
+        if (typeof value === 'string' && value !== '') {
+            sandboxConfig[key] = value;
+            changed = true;
+        }
+    }
+    if (changed) {
+        fs.writeFileSync(canonicalConfigPath, JSON.stringify(sandboxConfig, null, 2), 'utf8');
+    }
+}
+const opencodeBeforeContainerCreateHook = {
+    id: 'opencode-before-container-create',
+    phase: 'before-container-create',
+    async run(context) {
+        const create = context.create;
+        const entry = create?.resolvedTools.find(({ tool }) => tool.id === 'opencode');
+        if (!create || !entry) {
+            return {
+                status: 'fatal',
+                message: 'OpenCode sandbox hook requires its resolved tool state.'
+            };
+        }
+        ensureOpenCodeSandboxState(entry.dir, create.hostHome, create.hostEnv);
+        return { status: 'ready' };
+    }
+};
+const opencodeRecoveryChecks = [
+    {
+        id: 'command-available',
+        probe: { script: 'command -v "$1"', args: ['opencode'] },
+        finding: {
+            repairKind: 'hard-failure',
+            message: 'OpenCode is not available on PATH inside the sandbox.'
+        }
+    },
+    {
+        id: 'config-writable',
+        probe: {
+            script: 'probe="$1/.agent-infra-opencode-config-$$"; trap \'rm -f -- "$probe"\' EXIT; : > "$probe"',
+            args: ['/home/devuser/.local/share/opencode/.xdg/config/opencode']
+        },
+        finding: {
+            repairKind: 'permissions',
+            message: 'OpenCode config directory is not writable by devuser.',
+            path: '/home/devuser/.local/share/opencode/.xdg/config/opencode'
+        }
+    },
+    {
+        id: 'state-writable',
+        probe: {
+            script: 'probe="$1/.agent-infra-opencode-state-$$"; trap \'rm -f -- "$probe"\' EXIT; : > "$probe"',
+            args: ['/home/devuser/.local/share/opencode/.xdg/state/opencode']
+        },
+        finding: {
+            repairKind: 'permissions',
+            message: 'OpenCode state directory is not writable by devuser.',
+            path: '/home/devuser/.local/share/opencode/.xdg/state/opencode'
+        }
+    }
+];
+export { ensureOpenCodeSandboxState, opencodeBeforeContainerCreateHook, opencodeRecoveryChecks };
+//# sourceMappingURL=opencode-sandbox.js.map