@fitlab-ai/agent-infra 0.9.9 → 0.9.11

package/dist/lib/version.js

@@ -8,5 +8,9 @@ if (!packageJsonUrl) {
 }
 const { version } = JSON.parse(readFileSync(packageJsonUrl, 'utf8'));
 const VERSION = `v${version}`;
-export { VERSION };
+const AGENT_INFRA_VERSION_PATTERN = /^v\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?$/;
+function isValidAgentInfraVersion(value) {
+    return typeof value === 'string' && AGENT_INFRA_VERSION_PATTERN.test(value);
+}
+export { VERSION, isValidAgentInfraVersion };
 //# sourceMappingURL=version.js.map

package/dist/lifecycle-build-manifest.json

@@ -1,6 +1,6 @@
 {
   "protocolVersion": 3,
-  "packageVersion": "0.9.9",
-  "sourceInputHash": "2f2db695db557531b3139eccd1bd530fbeb7b99409e2d49338f3b4646aac9ef6",
-  "internalExecutableBuildHash": "1391ebe2614f3071e7a60920325046a47f1473e7fb23c821327072f947f639d3"
+  "packageVersion": "0.9.11",
+  "sourceInputHash": "00e07caf1313615df10d46ae620767d7d15c3cc59712c1da581623057b87e0a6",
+  "internalExecutableBuildHash": "8a481b1d79da5e5f31ef79cd3428f1b51df2b859e70724e50dcc5910f8ee40c6"
 }

package/lib/agent-client.ts

@@ -128,7 +128,6 @@ async function cmdAgentClient(args: string[]): Promise<number> {
         throw new AgentClientCommandError('AGENT_CLIENT_ARGUMENT_INVALID', 'status accepts no arguments');
       }
       const plan = workflowPlan(projectRoot, config, { type: 'none' });
-      process.stdout.write(`source: ${plan.source}\n`);
       printState(plan.desired);
       for (const seed of plan.seedOperations) {
         process.stdout.write(`  seed ${seed.target}: ${seed.kind}\n`);

package/lib/agent-clients/adapters/codex-lifecycle/build-identity.ts

@@ -28,6 +28,13 @@ type IdentityVerification = Readonly<{
   ok: boolean;
   code: string | null;
   message: string | null;
+  warnings: readonly LifecycleIdentityWarning[];
+}>;
+
+type LifecycleIdentityWarning = Readonly<{
+  code: 'CODEX_LIFECYCLE_BUILD_MISMATCH' | 'CODEX_LIFECYCLE_CONTRACT_MISMATCH';
+  message: string;
+  action: 'rebuild-sandbox';
 }>;
 
 function exactText(value: unknown): value is string {
@@ -201,25 +208,32 @@ function verifyLifecycleBuildIdentity(
     return {
       ok: false,
       code: 'CODEX_LIFECYCLE_PROTOCOL_MISMATCH',
-      message: 'Codex lifecycle protocol version does not match'
+      message: 'Codex lifecycle protocol version does not match',
+      warnings: []
     };
   }
+  const warnings: LifecycleIdentityWarning[] = [];
   if (actual.packageVersion !== expected.packageVersion
     || actual.internalExecutableBuildHash !== expected.internalExecutableBuildHash) {
-    return {
-      ok: false,
+    warnings.push({
       code: 'CODEX_LIFECYCLE_BUILD_MISMATCH',
-      message: 'Codex lifecycle executable build identity does not match'
-    };
+      message: 'Codex lifecycle executable build identity differs; rebuild the sandbox if the runtime is stale',
+      action: 'rebuild-sandbox'
+    });
   }
   if (actual.lifecycleContractHash !== expected.lifecycleContractHash) {
-    return {
-      ok: false,
+    warnings.push({
       code: 'CODEX_LIFECYCLE_CONTRACT_MISMATCH',
-      message: 'Codex lifecycle contract identity does not match'
-    };
+      message: 'Codex lifecycle contract identity differs; rebuild the sandbox if the runtime is stale',
+      action: 'rebuild-sandbox'
+    });
   }
-  return { ok: true, code: null, message: null };
+  return {
+    ok: true,
+    code: null,
+    message: null,
+    warnings: Object.freeze(warnings)
+  };
 }
 
 export {
@@ -233,6 +247,7 @@ export {
 };
 export type {
   IdentityVerification,
+  LifecycleIdentityWarning,
   LifecycleBuildIdentity,
   LifecycleManifestFiles,
   LifecycleBuildIdentityOptions

package/lib/agent-clients/adapters/codex-lifecycle/controller-context.ts

@@ -4,7 +4,12 @@ import path from 'node:path';
 
 import { getProcessIdentityState, type ProcessIdentity } from '../../../server/process-state.ts';
 import type { CodexControllerLeaseProofV1, CodexControllerLeaseV1 } from '../../../sandbox/control/controller-registration.ts';
-import { computeLifecycleBuildIdentity, type LifecycleBuildIdentity } from './build-identity.ts';
+import {
+  computeLifecycleBuildIdentity,
+  verifyLifecycleBuildIdentity,
+  type LifecycleBuildIdentity,
+  type LifecycleIdentityWarning
+} from './build-identity.ts';
 
 const HEX_256 = /^[a-f0-9]{64}$/u;
 
@@ -19,30 +24,12 @@ export type CodexSandboxControllerContextV2 = Readonly<{
   expiresAt: number;
   buildIdentity: LifecycleBuildIdentity;
   hookDefinitionHash: string;
-  lifecycleProfilesHash: string;
 }>;
 
 function exactKeys(value: Record<string, unknown>, keys: readonly string[]): boolean {
   return Object.keys(value).sort().join(',') === [...keys].sort().join(',');
 }
 
-function digestProfiles(repoRoot: string): string {
-  const files = [
-    path.join(repoRoot, '.codex', 'agents', 'agent-infra-lifecycle-executor.toml'),
-    path.join(repoRoot, '.codex', 'agents', 'agent-infra-lifecycle-reviewer.toml')
-  ];
-  const hash = crypto.createHash('sha256');
-  for (const file of files.sort()) {
-    const stat = fs.lstatSync(file);
-    if (!stat.isFile() || stat.isSymbolicLink()) throw new Error('CODEX_SANDBOX_CONTROLLER_BUNDLE_MISMATCH');
-    hash.update(path.basename(file));
-    hash.update('\0');
-    hash.update(fs.readFileSync(file));
-    hash.update('\0');
-  }
-  return hash.digest('hex');
-}
-
 function validProcess(value: unknown): value is ProcessIdentity {
   if (!value || typeof value !== 'object' || Array.isArray(value)) return false;
   const identity = value as Record<string, unknown>;
@@ -72,7 +59,7 @@ function validateContext(value: unknown): CodexSandboxControllerContextV2 {
   if (!exactKeys(context, [
     'buildIdentity', 'controlGeneration', 'controllerInstanceDigest', 'controllerLease',
     'controllerProcess', 'expiresAt', 'hookDefinitionHash', 'issuedAt',
-    'lifecycleProfilesHash', 'taskId', 'version'
+    'taskId', 'version'
   ])
     || context.version !== 2
     || typeof context.taskId !== 'string' || context.taskId.length === 0
@@ -87,8 +74,7 @@ function validateContext(value: unknown): CodexSandboxControllerContextV2 {
     || !Number.isSafeInteger(context.expiresAt)
     || (context.expiresAt as number) <= (context.issuedAt as number)
     || !validBuildIdentity(context.buildIdentity)
-    || typeof context.hookDefinitionHash !== 'string' || !HEX_256.test(context.hookDefinitionHash)
-    || typeof context.lifecycleProfilesHash !== 'string' || !HEX_256.test(context.lifecycleProfilesHash)) {
+    || typeof context.hookDefinitionHash !== 'string' || !HEX_256.test(context.hookDefinitionHash)) {
     throw new Error('CODEX_SANDBOX_CONTROLLER_CONTEXT_INVALID');
   }
   return context as unknown as CodexSandboxControllerContextV2;
@@ -96,7 +82,7 @@ function validateContext(value: unknown): CodexSandboxControllerContextV2 {
 
 export function contextFromControllerLease(
   lease: CodexControllerLeaseV1,
-  hashes: Readonly<{ hookDefinitionHash: string; lifecycleProfilesHash: string }>
+  input: Readonly<{ hookDefinitionHash: string }>
 ): CodexSandboxControllerContextV2 {
   return Object.freeze({
     version: 2,
@@ -108,8 +94,7 @@ export function contextFromControllerLease(
     issuedAt: lease.issuedAt,
     expiresAt: lease.expiresAt,
     buildIdentity: lease.buildIdentity,
-    hookDefinitionHash: hashes.hookDefinitionHash,
-    lifecycleProfilesHash: hashes.lifecycleProfilesHash
+    hookDefinitionHash: input.hookDefinitionHash
   });
 }
 
@@ -129,7 +114,7 @@ export function writeCodexSandboxControllerContext(
   }
 }
 
-export function verifyCodexSandboxControllerContext(
+export function verifyCodexSandboxControllerContextWithWarnings(
   contextPath: string,
   options: Readonly<{
     repoRoot?: string;
@@ -137,7 +122,7 @@ export function verifyCodexSandboxControllerContext(
     generation?: string;
     probeProcess?: (identity: ProcessIdentity) => 'alive' | 'dead' | 'unknown';
   }> = {}
-): CodexSandboxControllerContextV2 {
+): Readonly<{ context: CodexSandboxControllerContextV2; warnings: readonly LifecycleIdentityWarning[] }> {
   let stat: fs.Stats;
   try {
     stat = fs.lstatSync(contextPath);
@@ -162,12 +147,10 @@ export function verifyCodexSandboxControllerContext(
     || state !== 'alive') {
     throw new Error('CODEX_SANDBOX_CONTROLLER_CONTEXT_INVALID');
   }
-  if (JSON.stringify(computeLifecycleBuildIdentity(repoRoot)) !== JSON.stringify(context.buildIdentity)
-    || crypto.createHash('sha256').update(fs.readFileSync(path.join(repoRoot, '.codex', 'hooks.json'))).digest('hex') !== context.hookDefinitionHash
-    || digestProfiles(repoRoot) !== context.lifecycleProfilesHash) {
-    throw new Error('CODEX_SANDBOX_CONTROLLER_BUNDLE_MISMATCH');
-  }
-  return Object.freeze(context);
+  const currentBuildIdentity = computeLifecycleBuildIdentity(repoRoot);
+  const identity = verifyLifecycleBuildIdentity(context.buildIdentity, currentBuildIdentity);
+  if (!identity.ok) throw new Error(`${identity.code}: ${identity.message}`);
+  return Object.freeze({ context: Object.freeze(context), warnings: identity.warnings });
 }
 
 export function controllerProofFromContext(context: CodexSandboxControllerContextV2): CodexControllerLeaseProofV1 {

package/lib/agent-clients/adapters/codex-lifecycle/sandbox-controller.ts

@@ -14,11 +14,11 @@ import {
 } from '../../../sandbox/control/client.ts';
 import { readSandboxControlStatus } from '../../../sandbox/control/state.ts';
 import { getProcessStartTime, type ProcessIdentity } from '../../../server/process-state.ts';
-import { computeLifecycleBuildIdentity } from './build-identity.ts';
+import { LIFECYCLE_PROTOCOL_VERSION, type LifecycleIdentityWarning } from './build-identity.ts';
 import {
   contextFromControllerLease,
   controllerProofFromContext,
-  verifyCodexSandboxControllerContext as verifyContextFile,
+  verifyCodexSandboxControllerContextWithWarnings as verifyContextFileWithWarnings,
   writeCodexSandboxControllerContext,
   type CodexSandboxControllerContextV2
 } from './controller-context.ts';
@@ -70,21 +70,6 @@ type VerifyContextOptions = Readonly<{
   requestControllerVerify?: typeof requestCodexControllerVerify;
 }>;
 
-function digestFiles(files: readonly string[]): string {
-  const hash = crypto.createHash('sha256');
-  for (const file of [...files].sort()) {
-    const stat = fs.lstatSync(file);
-    if (!stat.isFile() || stat.isSymbolicLink()) {
-      throw new Error('CODEX_SANDBOX_CONTROLLER_BUNDLE_MISMATCH');
-    }
-    hash.update(path.basename(file));
-    hash.update('\0');
-    hash.update(fs.readFileSync(file));
-    hash.update('\0');
-  }
-  return hash.digest('hex');
-}
-
 function copyRegular(source: string, destination: string, mode: number): void {
   const stat = fs.lstatSync(source);
   if (!stat.isFile() || stat.isSymbolicLink()) {
@@ -166,17 +151,18 @@ function verifyControl(taskId: string, control: ControllerControl): void {
   if (payload.taskId !== taskId) throw new Error('CODEX_SANDBOX_CONTROLLER_TASK_BINDING_INVALID');
 }
 
-function verifyCodexSandboxControllerContext(
+function verifyCodexSandboxControllerContextWithWarnings(
   contextPath: string,
   options: VerifyContextOptions = {}
-): CodexSandboxControllerContextV2 {
+): Readonly<{ context: CodexSandboxControllerContextV2; warnings: readonly LifecycleIdentityWarning[] }> {
   const control = options.control ?? controlFromEnvironment();
-  const context = verifyContextFile(contextPath, {
+  const fileVerification = verifyContextFileWithWarnings(contextPath, {
     repoRoot: options.repoRoot,
     now: options.now,
     generation: control.generation,
     probeProcess: options.probeProcess
   });
+  const context = fileVerification.context;
   const verified = (options.requestControllerVerify ?? requestCodexControllerVerify)({
     controllerProof: controllerProofFromContext(context),
     ...control,
@@ -187,7 +173,10 @@ function verifyCodexSandboxControllerContext(
     || verified.binding.controllerInstanceDigest !== context.controllerInstanceDigest) {
     throw new Error('CODEX_SANDBOX_CONTROLLER_CONTEXT_INVALID');
   }
-  return context;
+  return Object.freeze({
+    context,
+    warnings: fileVerification.warnings
+  });
 }
 
 function detectedCodexVersion(): string {
@@ -337,30 +326,22 @@ function prepareCodexSandboxController(
     copyRegular(hooks, path.join(home, 'hooks.json'), 0o600);
     copyRegular(executor, path.join(home, 'agents', path.basename(executor)), 0o600);
     copyRegular(reviewer, path.join(home, 'agents', path.basename(reviewer)), 0o600);
-    if (crypto.createHash('sha256').update(fs.readFileSync(path.join(home, 'hooks.json'))).digest('hex')
-      !== crypto.createHash('sha256').update(fs.readFileSync(hooks)).digest('hex')
-      || digestFiles([
-        path.join(home, 'agents', path.basename(executor)),
-        path.join(home, 'agents', path.basename(reviewer))
-      ]) !== digestFiles([executor, reviewer])) {
-      throw new Error('CODEX_SANDBOX_CONTROLLER_BUNDLE_MISMATCH');
-    }
 
-    const buildIdentity = computeLifecycleBuildIdentity(repoRoot);
     const opened = (options.openController ?? requestCodexControllerOpen)({
       controllerProcess: { pid: process.pid, startTime: parentStartTime },
       ...control,
       timeoutMs: 30_000
     });
     const taskId = opened.lease.taskId;
+    if (opened.lease.buildIdentity.protocolVersion !== LIFECYCLE_PROTOCOL_VERSION) {
+      throw new Error('CODEX_LIFECYCLE_PROTOCOL_MISMATCH: Codex lifecycle protocol version does not match');
+    }
     context = contextFromControllerLease(opened.lease, {
-      hookDefinitionHash: crypto.createHash('sha256').update(fs.readFileSync(hooks)).digest('hex'),
-      lifecycleProfilesHash: digestFiles([executor, reviewer])
+      hookDefinitionHash: crypto.createHash('sha256').update(fs.readFileSync(hooks)).digest('hex')
     });
     if (opened.lease.controlGeneration !== control.generation
       || opened.lease.controllerProcess.pid !== process.pid
-      || opened.lease.controllerProcess.startTime !== parentStartTime
-      || JSON.stringify(opened.lease.buildIdentity) !== JSON.stringify(buildIdentity)) {
+      || opened.lease.controllerProcess.startTime !== parentStartTime) {
       throw new Error('SANDBOX_CONTROL_RESULT_INVALID');
     }
     (options.verifyTaskBinding ?? verifyControl)(taskId, control);
@@ -460,7 +441,7 @@ async function runCodexSandboxController(
 export {
   prepareCodexSandboxController,
   runCodexSandboxController,
-  verifyCodexSandboxControllerContext,
+  verifyCodexSandboxControllerContextWithWarnings,
   controllerProofFromContext
 };
 export type {

package/lib/agent-clients/adapters/codex-sandbox.ts

@@ -37,6 +37,8 @@ function resolveHostCatalogPath(value: unknown, hostHomeDir: string): string | n
 }
 
 const CODEX_DISABLED_FEATURE_FLAGS = ['apps', 'enable_mcp_apps'] as const;
+const SANDBOX_CODEX_HOOKS_PATH = '/workspace/.codex/hooks.json';
+const CODEX_HOOK_TRUST_HASH = /^sha256:[a-f0-9]{64}$/;
 
 function removeCodexMcpServers(sandboxParsed: JsonObject): boolean {
   if (!Object.hasOwn(sandboxParsed, 'mcp_servers')) {
@@ -75,27 +77,75 @@ function inheritDisabledCodexFeatureFlags(
   return changed;
 }
 
+function inheritCodexHookTrustState(
+  sandboxParsed: JsonObject,
+  hostParsed: JsonObject,
+  hostProjectDir?: string
+): boolean {
+  if (!hostProjectDir) {
+    return false;
+  }
+
+  if (Object.hasOwn(sandboxParsed, 'hooks') && !isJsonObjectRecord(sandboxParsed.hooks)) {
+    return false;
+  }
+  const sandboxHooks = (sandboxParsed.hooks as JsonObject | undefined) ?? {};
+  if (Object.hasOwn(sandboxHooks, 'state') && !isJsonObjectRecord(sandboxHooks.state)) {
+    return false;
+  }
+
+  const sandboxState = (sandboxHooks.state as JsonObject | undefined) ?? {};
+  const sandboxPrefix = `${SANDBOX_CODEX_HOOKS_PATH}:`;
+  const nextState = Object.fromEntries(
+    Object.entries(sandboxState).filter(([key]) => !key.startsWith(sandboxPrefix))
+  );
+
+  const hostState = isJsonObjectRecord(hostParsed.hooks)
+    && isJsonObjectRecord(hostParsed.hooks.state)
+    ? hostParsed.hooks.state
+    : {};
+  const hostPrefix = `${path.join(hostProjectDir, '.codex', 'hooks.json')}:`;
+  for (const [key, value] of Object.entries(hostState)) {
+    if (!key.startsWith(hostPrefix) || !isJsonObjectRecord(value)) {
+      continue;
+    }
+    const trustedHash = value.trusted_hash;
+    if (typeof trustedHash !== 'string' || !CODEX_HOOK_TRUST_HASH.test(trustedHash)) {
+      continue;
+    }
+    nextState[`${sandboxPrefix}${key.slice(hostPrefix.length)}`] = {
+      trusted_hash: trustedHash,
+      ...(typeof value.enabled === 'boolean' ? { enabled: value.enabled } : {})
+    };
+  }
+
+  if (JSON.stringify(sandboxState) === JSON.stringify(nextState)) {
+    return false;
+  }
+  if (Object.keys(nextState).length > 0) {
+    sandboxHooks.state = nextState;
+    sandboxParsed.hooks = sandboxHooks;
+  } else {
+    delete sandboxHooks.state;
+    if (Object.keys(sandboxHooks).length > 0) {
+      sandboxParsed.hooks = sandboxHooks;
+    } else {
+      delete sandboxParsed.hooks;
+    }
+  }
+  return true;
+}
+
 function ensureCodexModelInheritance(
   toolDir: string,
   hostHomeDir?: string,
-  containerCodexDir: string = '/home/devuser/.codex'
+  containerCodexDir: string = '/home/devuser/.codex',
+  hostProjectDir?: string
 ): void {
   if (!hostHomeDir) {
     return;
   }
 
-  const hostConfigPath = path.join(hostHomeDir, '.codex', 'config.toml');
-  if (!fs.existsSync(hostConfigPath)) {
-    return;
-  }
-
-  let hostParsed: JsonObject;
-  try {
-    hostParsed = toml.parse(fs.readFileSync(hostConfigPath, 'utf8')) as JsonObject;
-  } catch {
-    return;
-  }
-
   const sandboxConfigPath = path.join(toolDir, 'config.toml');
   // This rewrites sandbox-side TOML and drops comments; the host config stays untouched.
   let sandboxParsed: JsonObject = {};
@@ -107,8 +157,25 @@ function ensureCodexModelInheritance(
     }
   }
 
+  const hostConfigPath = path.join(hostHomeDir, '.codex', 'config.toml');
+  let hostParsed: JsonObject | null = null;
+  if (fs.existsSync(hostConfigPath)) {
+    try {
+      hostParsed = toml.parse(fs.readFileSync(hostConfigPath, 'utf8')) as JsonObject;
+    } catch {
+      // An unavailable host trust source must not leave previously projected trust active.
+    }
+  }
+  if (!hostParsed) {
+    if (inheritCodexHookTrustState(sandboxParsed, {}, hostProjectDir)) {
+      fs.writeFileSync(sandboxConfigPath, `${toml.stringify(sandboxParsed)}\n`, 'utf8');
+    }
+    return;
+  }
+
   let changed = removeCodexMcpServers(sandboxParsed);
   changed = inheritDisabledCodexFeatureFlags(sandboxParsed, hostParsed) || changed;
+  changed = inheritCodexHookTrustState(sandboxParsed, hostParsed, hostProjectDir) || changed;
 
   const inheritSpecs: Array<readonly [string, 'string' | 'number']> = [
     ['model', 'string'],
@@ -180,7 +247,15 @@ const codexBeforeContainerCreateHook: AgentClientSandboxHook = {
         message: 'Codex sandbox hook requires its resolved tool state.'
       };
     }
-    ensureCodexModelInheritance(entry.dir, create.hostHome, entry.tool.containerMount);
+    const hostProjectDir = typeof context.config?.repoRoot === 'string'
+      ? context.config.repoRoot
+      : undefined;
+    ensureCodexModelInheritance(
+      entry.dir,
+      create.hostHome,
+      entry.tool.containerMount,
+      hostProjectDir
+    );
     ensureCodexWorkspaceTrust(entry.dir);
     return { status: 'ready' };
   }

package/lib/agent-clients/adapters/index.ts

@@ -4,13 +4,15 @@ import { claudeCodeAdapter } from './claude-code.ts';
 import { codexAdapter } from './codex.ts';
 import { antigravityCliAdapter } from './antigravity-cli.ts';
 import { opencodeAdapter } from './opencode.ts';
+import { traecliAdapter } from './traecli.ts';
 
 const adaptersById = new Map(
   [
     claudeCodeAdapter,
     codexAdapter,
     antigravityCliAdapter,
-    opencodeAdapter
+    opencodeAdapter,
+    traecliAdapter
   ].map((adapter) => [adapter.id, adapter])
 );
 

package/lib/agent-clients/adapters/opencode-sandbox.ts

@@ -33,14 +33,9 @@ function ensureOpenCodeSandboxState(
   const canonicalConfigDir = path.join(toolDir, '.xdg', 'config', 'opencode');
   const canonicalStateDir = path.join(toolDir, '.xdg', 'state', 'opencode');
   const canonicalConfigPath = path.join(canonicalConfigDir, 'opencode.json');
-  const legacyConfigPath = path.join(toolDir, 'opencode.json');
   fs.mkdirSync(canonicalConfigDir, { recursive: true });
   fs.mkdirSync(canonicalStateDir, { recursive: true });
 
-  if (!fs.existsSync(canonicalConfigPath) && fs.existsSync(legacyConfigPath)) {
-    fs.copyFileSync(legacyConfigPath, canonicalConfigPath, fs.constants.COPYFILE_EXCL);
-  }
-
   const hostConfigRoot = resolveXdgRoot(
     hostEnv.XDG_CONFIG_HOME,
     path.join(hostHome, '.config')

package/lib/agent-clients/adapters/traecli.ts

@@ -0,0 +1,66 @@
+import { defineAgentClientAdapter } from '../adapter.ts';
+import { hostJoin } from '../../sandbox/engines/wsl2-paths.ts';
+
+const traecliAdapter = defineAgentClientAdapter({
+  id: 'traecli',
+  displayName: 'TraeCode CLI',
+  invocation: '/${skillName}',
+  capabilities: {
+    instructions: { level: 'compatible' },
+    skills: { level: 'compatible' },
+    commands: { level: 'integrated' },
+    hooks: { level: 'compatible' },
+    subagents: { level: 'experimental' },
+    orchestration: { level: 'experimental' },
+    sandbox: { level: 'integrated' },
+    verification: { level: 'compatible' }
+  },
+  modelSelection: {
+    kind: 'interactive-only',
+    command: '/model',
+    guidance: 'Use the host model picker for the complete model and reasoning-effort catalog.'
+  },
+  delegationEvidence: {
+    actualModel: 'unavailable',
+    actualReasoningEffort: 'unavailable'
+  },
+  project: {
+    ownedPathPrefixes: ['.traecli/'],
+    managed: ['.traecli/commands/'],
+    merged: [],
+    ejected: [],
+    seedCommands: [{
+      templates: {
+        en: '.traecli/commands/update-agent-infra.en.md',
+        'zh-CN': '.traecli/commands/update-agent-infra.zh-CN.md'
+      },
+      target: '.traecli/commands/update-agent-infra.md'
+    }],
+    customCommand: {
+      target: '.traecli/commands/${skillName}.md',
+      frontmatter: {},
+      argumentsToken: '$ARGUMENTS'
+    }
+  },
+  sandbox: {
+    createTool: ({ home }) => ({
+      id: 'traecli',
+      name: 'TraeCode CLI',
+      install: {
+        type: 'shell',
+        cmd: 'curl -fsSL https://trae.cn/trae-cli/install_v2.sh | bash'
+      },
+      sandboxBase: hostJoin(home, '.agent-infra', 'sandboxes', 'traecli'),
+      containerMount: '/home/devuser/.trae',
+      versionCmd: 'traecli --version',
+      setupHint: 'Run traecli login inside the container to authenticate.'
+    }),
+    aliases: [
+      { name: 'traecli-yolo', command: 'traecli --dangerously-bypass-approvals-and-sandbox; tput ed' },
+      { name: 'ty', command: 'traecli --dangerously-bypass-approvals-and-sandbox; tput ed' }
+    ],
+    hooks: []
+  }
+});
+
+export { traecliAdapter };