# 03 — Packages (rename + new package + meta)

> Sub-plan of [trap-sandbox-gateway-spec](./trap-sandbox-gateway-spec.md). Mechanical wiring. M3;
> may run in parallel with M2. Depends on the Lua file paths from
> [02-lua-client](./02-lua-client.md) being settled.

## Scope
ccpm package definitions only: rename the legacy package, register the new `trapos-sandbox`, keep
`packages/index.json` consistent, and add `trapos-sandbox` to the `trapos` meta with a version bump.

## Task checklist
- [ ] **Rename** `packages/trapos-sandbox/` → `packages/trapos-sandbox-legacy/`; set
      `"name": "trapos-sandbox-legacy"` (keep its files/autostart).
- [ ] **New** `packages/trapos-sandbox/ccpm.json`: name `trapos-sandbox`, version `0.1.0`, deps
      `["trapos-core"]`, files `["apis/libsandbox.lua","programs/sandbox.lua","servers/sandbox.lua"]`,
      autostart `["servers/sandbox"]`.
- [ ] **`packages/index.json`**: `trapos-sandbox: "0.1.0"` + add `trapos-sandbox-legacy: "0.2.2"`.
- [ ] **`packages/trapos/ccpm.json`**: add `trapos-sandbox` to deps; bump meta version.

## Notes
- The daemon stays dormant until `sandbox.url` is set, so adding it to the `trapos` meta is safe.
- Confirm the legacy version pinned in `index.json` (`0.2.2`) matches the renamed package's current
  version before committing.

## Verification gate
`packages/index.json` resolves both names; `trapos` meta installs `trapos-sandbox`; legacy package
still installs under its new name with files/autostart intact.