chainlesschain 0.162.163 → 0.162.164

package/src/lib/doctor-checkup.js

@@ -23,10 +23,18 @@ import {
   statSync,
   rmSync,
 } from "node:fs";
-import { execSync } from "node:child_process";
+import { execSync, spawnSync } from "node:child_process";
 import { join, basename } from "node:path";
 import { getHomeDir, getConfigPath } from "./paths.js";
-import { checkAgenda, checkInstructionFiles } from "./runtime-checkup.js";
+import {
+  checkAgenda,
+  checkInstructionFiles,
+  checkHookConfig,
+  checkHooks,
+  checkSandbox,
+  checkDuplicateSkills,
+  DEFAULT_CHECKUP_THRESHOLDS,
+} from "./runtime-checkup.js";
 
 export const CHECK_LEVELS = Object.freeze({
   OK: "ok",
@@ -45,6 +53,7 @@ export const _deps = {
   statSync,
   rmSync,
   execSync,
+  spawnSync,
   now: () => Date.now(),
 };
 
@@ -618,7 +627,7 @@ async function runtimeSection(opts, deps) {
       dueAt: e.kind === "wakeup" ? e.dueAt : e.nextAt,
       recurring: e.kind !== "wakeup",
     }));
-    for (const f of checkAgenda(entries, now)) {
+    for (const f of checkAgenda(entries, now, DEFAULT_CHECKUP_THRESHOLDS)) {
       checks.push(
         check(
           f.id,
@@ -647,7 +656,7 @@ async function runtimeSection(opts, deps) {
         }
       }
     }
-    for (const f of checkInstructionFiles(files)) {
+    for (const f of checkInstructionFiles(files, DEFAULT_CHECKUP_THRESHOLDS)) {
       checks.push(
         check(
           f.id,
@@ -661,12 +670,221 @@ async function runtimeSection(opts, deps) {
     checks.push(failedCheck("instructions", "instruction files", err));
   }
 
+  // settings.json hook config — statically catch hooks that will silently never
+  // fire (unknown event / bad regex matcher / missing command) or are
+  // misconfigured (bad timeout). Runtime hook health (slow/circuit-broken) needs
+  // live per-process stats and isn't computed here.
+  try {
+    const settingsHooks = await import("./settings-hooks.cjs");
+    const mod = settingsHooks.default || settingsHooks;
+    const cwd = opts.cwd || process.cwd();
+    const files = mod.settingsFiles(cwd);
+    const seen = new Set();
+    for (const file of files) {
+      if (seen.has(file) || !deps.existsSync(file)) continue;
+      seen.add(file);
+      let hooksBlock = null;
+      try {
+        const parsed = JSON.parse(deps.readFileSync(file, "utf-8"));
+        hooksBlock = parsed && typeof parsed === "object" ? parsed.hooks : null;
+      } catch {
+        continue; // malformed settings.json is reported elsewhere (config section)
+      }
+      if (!hooksBlock) continue;
+      for (const f of checkHookConfig(hooksBlock, {
+        validEvents: mod.HOOK_EVENTS,
+      })) {
+        checks.push(
+          check(
+            f.id,
+            `${basename(file)} ${f.ref}`,
+            SEVERITY_TO_LEVEL[f.severity] || CHECK_LEVELS.INFO,
+            `${f.message} — ${f.remediation}`,
+          ),
+        );
+      }
+    }
+  } catch (err) {
+    checks.push(failedCheck("hook-config", "settings hook config", err));
+  }
+
+  // Async-hook RUNTIME health — the reliability aggregate persisted by
+  // AsyncHookSupervisor.stopAll(): hooks that have been repeatedly failing,
+  // circuit-broken (N failures in a row), or slow on average. Complements the
+  // static config check above (which catches hooks that never fire at all).
+  try {
+    const store = await import("./hook-stats-store.cjs");
+    const mod = store.default || store;
+    const statsFs = {
+      existsSync: deps.existsSync,
+      readFileSync: deps.readFileSync,
+    };
+    const stats = mod.loadHookStats(mod.defaultHookStatsPath(), statsFs);
+    const hooks = mod.toCheckHooksInput(stats, {
+      circuitThreshold: DEFAULT_CHECKUP_THRESHOLDS.hookFailureThreshold,
+    });
+    for (const f of checkHooks(hooks, DEFAULT_CHECKUP_THRESHOLDS)) {
+      checks.push(
+        check(
+          f.id,
+          `hook ${f.ref}`,
+          SEVERITY_TO_LEVEL[f.severity] || CHECK_LEVELS.INFO,
+          `${f.message} — ${f.remediation}`,
+        ),
+      );
+    }
+  } catch (err) {
+    checks.push(failedCheck("hook-health", "async hook stats", err));
+  }
+
+  // Sandbox real capability — catch the "silent degradation" case where a
+  // sandbox is configured in settings.json but its engine (docker/bwrap) isn't
+  // actually runnable, so tool subprocesses run UNSANDBOXED without warning.
+  try {
+    const settingsHooks = await import("./settings-hooks.cjs");
+    const shMod = settingsHooks.default || settingsHooks;
+    const sandboxMod = await import("./agent-sandbox.js");
+    const cwd = opts.cwd || process.cwd();
+    let sandboxSettings = null;
+    for (const file of shMod.settingsFiles(cwd)) {
+      if (!deps.existsSync(file)) continue;
+      try {
+        const parsed = JSON.parse(deps.readFileSync(file, "utf-8"));
+        if (parsed && parsed.sandbox && typeof parsed.sandbox === "object") {
+          sandboxSettings = { ...(sandboxSettings || {}), ...parsed.sandbox };
+        }
+      } catch {
+        // malformed settings.json is reported by the config section
+      }
+    }
+    if (sandboxSettings && sandboxSettings.enabled === true) {
+      const sandbox = sandboxMod.normalizeAgentSandbox(true, {
+        settings: sandboxSettings,
+        cwd,
+      });
+      if (sandbox) {
+        const probe = sandboxMod.probeSandboxAvailability(sandbox, {
+          spawnSync: deps.spawnSync,
+        });
+        for (const f of checkSandbox({
+          configured: true,
+          engine: sandbox.engine,
+          available: probe.available,
+          reason: probe.reason,
+          failIfUnavailable: sandbox.policy?.failIfUnavailable === true,
+          isolationLevel: sandboxMod.isolationLevel(sandbox),
+        })) {
+          checks.push(
+            check(
+              f.id,
+              `sandbox ${f.ref}`,
+              SEVERITY_TO_LEVEL[f.severity] || CHECK_LEVELS.INFO,
+              f.remediation ? `${f.message} — ${f.remediation}` : f.message,
+            ),
+          );
+        }
+      }
+    }
+  } catch (err) {
+    checks.push(failedCheck("sandbox", "sandbox availability", err));
+  }
+
+  // Duplicate skills — an id defined in more than one layer silently shadows
+  // (loadAll keeps only the winner), so a user's custom skill can override, or
+  // be overridden by, another without any signal. opts.skillLayerEntries lets a
+  // caller inject the (un-deduped) entry list; otherwise scan via the loader.
+  try {
+    let entries = opts.skillLayerEntries;
+    if (!entries) {
+      const { CLISkillLoader } = await import("./skill-loader.js");
+      entries = new CLISkillLoader().listSkillLayerEntries();
+    }
+    for (const f of checkDuplicateSkills(entries)) {
+      checks.push(
+        check(
+          f.id,
+          `skill ${f.ref}`,
+          SEVERITY_TO_LEVEL[f.severity] || CHECK_LEVELS.INFO,
+          `${f.message} — ${f.remediation}`,
+        ),
+      );
+    }
+  } catch (err) {
+    checks.push(failedCheck("skill-duplicate", "skill layers", err));
+  }
+
   if (checks.length === 0) {
     checks.push(check("runtime-clean", "runtime hygiene", CHECK_LEVELS.OK, ""));
   }
   return { id: "runtime", title: "Runtime checkup", checks };
 }
 
+// ── execution context (P1-7) ───────────────────────────────────────────────
+// "任务在哪执行是 Session 一等属性": surface the DETECTED execution location and
+// the fail-closed permission posture it implies. Read-only advisory — it never
+// blocks. A local trusted machine is OK; a remote/unknown environment is a WARN
+// because a session there fails closed to read-only unless powers are granted
+// explicitly (and any policy violation from the pure model is listed).
+async function executionSection(opts, deps) {
+  const checks = [];
+  try {
+    const {
+      detectAmbientLocation,
+      validateExecutionContext,
+      EXECUTION_LOCATION,
+    } = await import("./execution-location.js");
+    // /.dockerenv is the classic in-container marker; keep it injectable via deps
+    // so the section is deterministic under test.
+    let dockerEnvFileExists = false;
+    try {
+      dockerEnvFileExists = deps.existsSync("/.dockerenv") === true;
+    } catch {
+      // non-POSIX host / unreadable — treat as not-a-container.
+    }
+    const location = detectAmbientLocation({
+      env: opts.env || process.env,
+      dockerEnvFileExists,
+    });
+    // Honest minimal input: just the detected location + the working dir. We do
+    // NOT fabricate a return path or granted powers — the validation then flags a
+    // real remote box with nowhere to return results, which is a meaningful hint.
+    const result = validateExecutionContext({
+      location,
+      source: { dir: opts.cwd || process.cwd() },
+    });
+    const isUnknown = location === EXECUTION_LOCATION.UNKNOWN;
+    const level =
+      isUnknown || result.descriptor.remote
+        ? CHECK_LEVELS.WARN
+        : CHECK_LEVELS.OK;
+    checks.push(
+      check(
+        "execution-location",
+        `Execution location: ${location}`,
+        level,
+        result.descriptor.remote
+          ? "remote/unknown — a session here fails closed to read-only unless powers are granted explicitly"
+          : isUnknown
+            ? "could not identify the environment — treated as untrusted (read-only floor)"
+            : "local trusted machine",
+      ),
+    );
+    if (result.violations.length > 0) {
+      checks.push(
+        check(
+          "execution-policy",
+          "Execution policy",
+          CHECK_LEVELS.WARN,
+          `fail-closed advisories: ${result.violations.join(", ")}`,
+        ),
+      );
+    }
+  } catch (err) {
+    checks.push(failedCheck("execution-location", "execution context", err));
+  }
+  return { id: "execution", title: "Execution context", checks };
+}
+
 /**
  * Collect all checkup sections. Never throws — a failing subsystem becomes an
  * `err` check inside its section.
@@ -685,6 +903,7 @@ export async function collectCheckupSections(opts = {}) {
     backgroundSection,
     worktreeSection,
     runtimeSection,
+    executionSection,
   ]) {
     try {
       sections.push(await build(opts, deps));

package/src/lib/execution-location.js

@@ -0,0 +1,286 @@
+/**
+ * Execution-location model — the "任务在哪执行是 Session 一等属性" core of P1-7
+ * (Local / SSH / Cloud / Remote Control 统一模型) of
+ * CLAUDE_CODE_IDE_INCREMENTAL_GAP_ANALYSIS_2026-07-13.md.
+ *
+ * [[execution-backend.js]] is the runtime EXECUTOR (Local / Docker / SSH backends
+ * that actually run a command). It is NOT a session-level, displayable, policy
+ * layer: it has no notion of "show the user where this runs, with what
+ * permissions, whose credentials (source+scope only) and how results return",
+ * and no fail-closed default for an UNKNOWN location.
+ *
+ * This module is that pure descriptor + policy. The P1-7 table requires every
+ * session to surface: Execution Location, Source, Permissions, Credentials
+ * (source & scope only — never a value), Lifecycle, Cost and Return Path. This
+ * module normalizes those, and enforces the two invariants that give it teeth:
+ *
+ *   1. Credentials NEVER carry values — only {name, source, scope} survive, so a
+ *      descriptor can be rendered/logged/shipped without leaking a secret.
+ *   2. An UNKNOWN or unrecognized location fails CLOSED to the most-restrictive
+ *      permission profile (read-only, no shell/network/mcp/external), because we
+ *      must not grant a remote/unknown environment ambient power by default.
+ *
+ * PURE: no fs / clock / RNG / process. A caller feeds observed session facts and
+ * reads back a safe descriptor plus a list of policy violations.
+ */
+
+/** Canonical execution locations. UNKNOWN is the fail-closed sink. */
+export const EXECUTION_LOCATION = Object.freeze({
+  LOCAL: "local",
+  WSL: "wsl",
+  SSH: "ssh",
+  CONTAINER: "container",
+  CLOUD: "cloud",
+  UNKNOWN: "unknown",
+});
+
+const LOCATION_ALIASES = new Map([
+  ["local", EXECUTION_LOCATION.LOCAL],
+  ["localhost", EXECUTION_LOCATION.LOCAL],
+  ["wsl", EXECUTION_LOCATION.WSL],
+  ["wsl2", EXECUTION_LOCATION.WSL],
+  ["ssh", EXECUTION_LOCATION.SSH],
+  ["remote-ssh", EXECUTION_LOCATION.SSH],
+  ["remote_ssh", EXECUTION_LOCATION.SSH],
+  ["container", EXECUTION_LOCATION.CONTAINER],
+  ["docker", EXECUTION_LOCATION.CONTAINER],
+  ["devcontainer", EXECUTION_LOCATION.CONTAINER],
+  ["dev-container", EXECUTION_LOCATION.CONTAINER],
+  ["cloud", EXECUTION_LOCATION.CLOUD],
+  ["codespaces", EXECUTION_LOCATION.CLOUD],
+  ["codespace", EXECUTION_LOCATION.CLOUD],
+  ["sandbox", EXECUTION_LOCATION.CLOUD],
+]);
+
+/** Locations that are NOT the user's own trusted machine. */
+const REMOTE_LOCATIONS = new Set([
+  EXECUTION_LOCATION.SSH,
+  EXECUTION_LOCATION.CONTAINER,
+  EXECUTION_LOCATION.CLOUD,
+]);
+
+/** Normalize any location label to a canonical value; unrecognized → UNKNOWN. */
+export function normalizeExecutionLocation(value) {
+  if (typeof value !== "string") return EXECUTION_LOCATION.UNKNOWN;
+  return (
+    LOCATION_ALIASES.get(value.trim().toLowerCase()) ||
+    EXECUTION_LOCATION.UNKNOWN
+  );
+}
+
+export function isRemoteLocation(location) {
+  return REMOTE_LOCATIONS.has(normalizeExecutionLocation(location));
+}
+
+/**
+ * Detect the ambient execution location from process signals. PURE: the caller
+ * supplies `env` (process.env) and `dockerEnvFileExists` (existsSync('/.dockerenv'))
+ * so this stays fs/process-free and unit-testable. Ordered most-specific-first,
+ * so a Codespace (which is also a container) reports CLOUD, and an SSH login
+ * outranks a bare WSL marker.
+ *
+ * @param {{env?:object, dockerEnvFileExists?:boolean}} [signals]
+ * @returns {string} a canonical EXECUTION_LOCATION value
+ */
+export function detectAmbientLocation({ env = {}, dockerEnvFileExists } = {}) {
+  const e = env && typeof env === "object" ? env : {};
+  const has = (k) => typeof e[k] === "string" && e[k].trim() !== "";
+
+  // Cloud dev environments (GitHub Codespaces) — most specific.
+  if (e.CODESPACES === "true" || has("GITHUB_CODESPACE_TOKEN")) {
+    return EXECUTION_LOCATION.CLOUD;
+  }
+  // An interactive SSH login carries these — a remote shell, not the box's own tty.
+  if (has("SSH_CONNECTION") || has("SSH_CLIENT") || has("SSH_TTY")) {
+    return EXECUTION_LOCATION.SSH;
+  }
+  // Containers: the classic /.dockerenv marker, an explicit `container` env, or k8s.
+  if (
+    dockerEnvFileExists === true ||
+    has("container") ||
+    has("KUBERNETES_SERVICE_HOST")
+  ) {
+    return EXECUTION_LOCATION.CONTAINER;
+  }
+  // WSL exports these into every shell.
+  if (has("WSL_DISTRO_NAME") || has("WSL_INTEROP")) {
+    return EXECUTION_LOCATION.WSL;
+  }
+  return EXECUTION_LOCATION.LOCAL;
+}
+
+/** The most-restrictive permission profile — the fail-closed floor. */
+function lockedDownPermissions() {
+  return Object.freeze({
+    file: "read", // read-only
+    shell: false,
+    network: false,
+    mcp: false,
+    externalSystems: false,
+  });
+}
+
+function normalizeFileAccess(v) {
+  const s = String(v || "").toLowerCase();
+  if (s === "write" || s === "readwrite" || s === "read-write") return "write";
+  if (s === "none") return "none";
+  return "read";
+}
+
+/**
+ * Clamp a requested permission set to what a location may grant. Every ambient
+ * power (shell / network / mcp / external) requires an EXPLICIT `true` — an
+ * unspecified or truthy-but-not-true power stays off. File access defaults to
+ * read; only a write-class request ("write" / "readwrite") grants write. An
+ * UNKNOWN location ignores the request entirely and returns the locked-down
+ * floor — the fail-closed core.
+ */
+export function clampPermissionsForLocation(location, requested = {}) {
+  const loc = normalizeExecutionLocation(location);
+  if (loc === EXECUTION_LOCATION.UNKNOWN) return lockedDownPermissions();
+
+  const req = requested && typeof requested === "object" ? requested : {};
+  const grant = (key) => req[key] === true;
+
+  return {
+    file: normalizeFileAccess(req.file),
+    shell: grant("shell"),
+    network: grant("network"),
+    mcp: grant("mcp"),
+    externalSystems: grant("externalSystems"),
+  };
+}
+
+/**
+ * Strip credential references down to what may be displayed: name, source and
+ * scope only. Any `value` / `token` / `secret` field is dropped — this is the
+ * enforcement point behind "Credentials 只显示来源和作用域，不显示值".
+ */
+export function redactCredentialRefs(creds) {
+  const list = Array.isArray(creds) ? creds : [];
+  return list
+    .filter((c) => c && typeof c === "object")
+    .map((c) => ({
+      name: c.name == null ? null : String(c.name),
+      source: c.source == null ? null : String(c.source),
+      scope: c.scope == null ? null : String(c.scope),
+    }));
+}
+
+const RETURN_PATHS = new Set([
+  "commit",
+  "pr",
+  "patch",
+  "artifact",
+  "report",
+  "none",
+]);
+
+function normalizeReturnPath(v) {
+  const s = String(v || "").toLowerCase();
+  return RETURN_PATHS.has(s) ? s : "none";
+}
+
+/**
+ * Build the safe, displayable execution-context descriptor for a session.
+ *
+ * @param {object} input
+ * @param {string} input.location            raw location label
+ * @param {object} [input.source]            {dir, repo, commit, repos?}
+ * @param {object} [input.permissions]       requested permissions (clamped)
+ * @param {Array}  [input.credentials]       credential refs (values stripped)
+ * @param {object} [input.lifecycle]         {foreground?, onDisconnect?, onSleep?}
+ * @param {object} [input.cost]              {model?, tokenBudget?, remote?}
+ * @param {string} [input.returnPath]        commit|pr|patch|artifact|report|none
+ * @returns {object} normalized descriptor (safe to render/log/ship)
+ */
+export function describeExecutionContext(input = {}) {
+  const location = normalizeExecutionLocation(input.location);
+  const permissions = clampPermissionsForLocation(location, input.permissions);
+  const src =
+    input.source && typeof input.source === "object" ? input.source : {};
+  return {
+    location,
+    remote: REMOTE_LOCATIONS.has(location),
+    source: {
+      dir: src.dir == null ? null : String(src.dir),
+      repo: src.repo == null ? null : String(src.repo),
+      commit: src.commit == null ? null : String(src.commit),
+      repos: Array.isArray(src.repos) ? src.repos.map((r) => String(r)) : [],
+    },
+    permissions,
+    credentials: redactCredentialRefs(input.credentials),
+    lifecycle: {
+      foreground: input.lifecycle?.foreground !== false,
+      onDisconnect: input.lifecycle?.onDisconnect
+        ? String(input.lifecycle.onDisconnect)
+        : "pause",
+      onSleep: input.lifecycle?.onSleep
+        ? String(input.lifecycle.onSleep)
+        : "pause",
+    },
+    cost: {
+      model: input.cost?.model ? String(input.cost.model) : null,
+      tokenBudget: Number.isFinite(Number(input.cost?.tokenBudget))
+        ? Number(input.cost.tokenBudget)
+        : null,
+      remote: input.cost?.remote === true,
+    },
+    returnPath: normalizeReturnPath(input.returnPath),
+  };
+}
+
+/** Keys that must never appear on a credential ref (a value leak). */
+const CREDENTIAL_VALUE_KEYS = ["value", "token", "secret", "password", "key"];
+
+/**
+ * Validate a raw execution-context input for policy compliance. EXHAUSTIVE:
+ * collects every violation. Fail-closed reads:
+ *   - a credential ref carrying a value/token/secret/password/key → leak
+ *   - location UNKNOWN → the session runs somewhere we cannot vouch for
+ *   - a remote location with no return path → results have nowhere safe to go
+ *   - a remote session granted network / external egress → surfaced as
+ *     `remote-egress-granted` so it must be explicitly acknowledged, not ambient
+ *
+ * @returns {{ok:boolean, violations:string[], descriptor:object}}
+ */
+export function validateExecutionContext(input = {}) {
+  const violations = [];
+  const rawCreds = Array.isArray(input.credentials) ? input.credentials : [];
+  for (const c of rawCreds) {
+    if (c && typeof c === "object") {
+      for (const k of CREDENTIAL_VALUE_KEYS) {
+        if (c[k] != null) {
+          violations.push("credential-value-present");
+          break;
+        }
+      }
+    }
+  }
+
+  const location = normalizeExecutionLocation(input.location);
+  if (location === EXECUTION_LOCATION.UNKNOWN) {
+    violations.push("unknown-location");
+  }
+
+  const descriptor = describeExecutionContext(input);
+
+  if (descriptor.remote && descriptor.returnPath === "none") {
+    violations.push("remote-without-return-path");
+  }
+
+  // Network / external egress FROM a remote box is the highest-risk grant — it
+  // must be an explicit, acknowledged decision, never ambient.
+  if (
+    descriptor.remote &&
+    (descriptor.permissions.network || descriptor.permissions.externalSystems)
+  ) {
+    violations.push("remote-egress-granted");
+  }
+
+  return {
+    ok: violations.length === 0,
+    violations,
+    descriptor,
+  };
+}

package/src/lib/headless-manifest.js

@@ -17,6 +17,10 @@
 import crypto from "node:crypto";
 import { createRequire } from "node:module";
 import { PROTOCOL_MIN_VERSION } from "./capability-negotiation.js";
+import {
+  CAPABILITY_MANIFEST,
+  toAgentFeatureFlags,
+} from "./capability-manifest.js";
 
 export const STREAM_PROTOCOL_VERSION = 1;
 
@@ -143,46 +147,15 @@ export function buildAgentCapabilities() {
     // older line shape, so min === current.
     min_protocol_version: PROTOCOL_MIN_VERSION,
     agent_tools: contract.listCodingAgentToolNames(),
-    permission_modes: [
-      "default",
-      "manual",
-      "auto",
-      "dontAsk",
-      "plan",
-      "acceptEdits",
-      "bypassPermissions",
-    ],
-    output_formats: ["text", "json", "stream-json"],
-    input_formats: ["text", "stream-json"],
+    // P1-9: permission modes, formats and the feature flags all project from the
+    // single canonical [[capability-manifest.js]] so `cc agent --capabilities`,
+    // the negotiator and the docs can no longer drift. Additive protocol-v1
+    // stream fields (event_seq / tool_use_id / trace_id) come in via the wire
+    // features; the mcp object and sandbox_engines come from the manifest too.
+    permission_modes: [...CAPABILITY_MANIFEST.permissionModes],
+    output_formats: [...CAPABILITY_MANIFEST.outputFormats],
+    input_formats: [...CAPABILITY_MANIFEST.inputFormats],
     exit_codes: HEADLESS_EXIT_CODES,
-    features: {
-      bare: true,
-      safe_mode: true,
-      ephemeral: true,
-      background: true,
-      worktree: true,
-      checkpoint: true,
-      json_schema_output: true,
-      partial_messages: true,
-      interactive_approvals: true,
-      permission_prompt_tool: true,
-      remote_control: true,
-      // Additive protocol-v1 stream fields (agent-sdk docs/PROTOCOL.md §1.2.1):
-      // every stream-json stdout line carries a monotonic `seq` and a
-      // run-scoped `trace_id`, and tool_use/tool_result lines carry a pairing
-      // `id` ("tu-<n>"). `trace_id` is caller-injectable (--trace-id /
-      // CC_TRACE_ID) for end-to-end IDE ↔ CLI correlation.
-      tool_use_id: true,
-      event_seq: true,
-      trace_id: true,
-      mcp: {
-        config_file: true,
-        registry: true,
-        tool_search: true,
-        oauth: true,
-        managed_allowlist: true,
-      },
-      sandbox_engines: ["docker", "bubblewrap"],
-    },
+    features: toAgentFeatureFlags(),
   };
 }