@probelabs/visor 0.1.152 → 0.1.153-ee

package/dist/sdk/{chunk-XJZKNTKZ.mjs → chunk-DXNWUIAN.mjs}

@@ -33,7 +33,7 @@ import {
 import {
   config_exports,
   init_config
-} from "./chunk-FYK2DJK6.mjs";
+} from "./chunk-CPYQDJ27.mjs";
 import {
   ExecutionJournal,
   checkLoopBudget,
@@ -2300,7 +2300,7 @@ ${"=".repeat(60)}
        * Generate mock response for testing
        */
       async generateMockResponse(_prompt, _checkName, _schema) {
-        await new Promise((resolve8) => setTimeout(resolve8, 500));
+        await new Promise((resolve9) => setTimeout(resolve9, 500));
         const name = (_checkName || "").toLowerCase();
         if (name.includes("extract-facts")) {
           const arr = Array.from({ length: 6 }, (_, i) => ({
@@ -3959,7 +3959,7 @@ async function executeWorkflowAsTool(workflowId, args, context2, argsOverrides)
     ...args,
     ...argsOverrides
   };
-  const { WorkflowCheckProvider: WorkflowCheckProvider2 } = await import("./workflow-check-provider-FONJYRMR.mjs");
+  const { WorkflowCheckProvider: WorkflowCheckProvider2 } = await import("./workflow-check-provider-JHHACJHF.mjs");
   const provider = new WorkflowCheckProvider2();
   const checkConfig = {
     type: "workflow",
@@ -6171,7 +6171,7 @@ var init_check_runner = __esm({
               sandboxConfig.env_passthrough,
               workspaceDefaults?.env_passthrough
             );
-            const workdir = sandboxConfig.workdir || "/workspace";
+            const workdir = sandboxConfig.workdir === "host" ? sandboxManager.getRepoPath() : sandboxConfig.workdir || "/workspace";
             let hostTracePath;
             if (!sandboxConfig.read_only) {
               const traceFileName = `.visor-trace-${randomUUID().slice(0, 8)}.ndjson`;
@@ -11208,7 +11208,7 @@ var init_runner = __esm({
 import { promisify } from "util";
 import { execFile as execFileCb } from "child_process";
 import { writeFileSync as writeFileSync3, unlinkSync as unlinkSync2, mkdtempSync } from "fs";
-import { join as join5 } from "path";
+import { join as join5, resolve } from "path";
 import { tmpdir } from "os";
 import { randomUUID as randomUUID2 } from "crypto";
 var execFileAsync, EXEC_MAX_BUFFER, DockerImageSandbox;
@@ -11296,7 +11296,7 @@ var init_docker_image_sandbox = __esm({
        */
       async start() {
         const image = await this.buildImageIfNeeded();
-        const workdir = this.config.workdir || "/workspace";
+        const workdir = this.config.workdir === "host" ? this.repoPath : this.config.workdir || "/workspace";
         const visorPath = this.config.visor_path || "/opt/visor";
         const readOnlySuffix = this.config.read_only ? ":ro" : "";
         const args = [
@@ -11324,6 +11324,14 @@ var init_docker_image_sandbox = __esm({
         for (const mount of this.cacheVolumeMounts) {
           args.push("-v", mount);
         }
+        if (this.config.bind_paths) {
+          for (const bp of this.config.bind_paths) {
+            const hostPath = bp.host.startsWith("~") ? resolve((process.env.HOME || "/root") + bp.host.slice(1)) : resolve(bp.host);
+            const containerPath = bp.container || hostPath;
+            const readOnly = bp.read_only !== false;
+            args.push("-v", `${hostPath}:${containerPath}${readOnly ? ":ro" : ""}`);
+          }
+        }
         args.push(image, "sleep", "infinity");
         logger.info(`Starting sandbox container '${this.containerName}'`);
         const { stdout } = await execFileAsync(args[0], args.slice(1), {
@@ -11702,7 +11710,7 @@ __export(bubblewrap_sandbox_exports, {
 import { promisify as promisify4 } from "util";
 import { execFile as execFileCb4 } from "child_process";
 import { existsSync as existsSync4 } from "fs";
-import { resolve } from "path";
+import { resolve as resolve2 } from "path";
 var execFileAsync4, EXEC_MAX_BUFFER4, BubblewrapSandbox;
 var init_bubblewrap_sandbox = __esm({
   "src/sandbox/bubblewrap-sandbox.ts"() {
@@ -11719,8 +11727,8 @@ var init_bubblewrap_sandbox = __esm({
       constructor(name, config, repoPath, visorDistPath) {
         this.name = name;
         this.config = config;
-        this.repoPath = resolve(repoPath);
-        this.visorDistPath = resolve(visorDistPath);
+        this.repoPath = resolve2(repoPath);
+        this.visorDistPath = resolve2(visorDistPath);
       }
       /**
        * Check if bwrap binary is available on the system.
@@ -11776,7 +11784,7 @@ var init_bubblewrap_sandbox = __esm({
        * Build the bwrap command-line arguments.
        */
       buildArgs(options) {
-        const workdir = this.config.workdir || "/workspace";
+        const workdir = this.config.workdir === "host" ? this.repoPath : this.config.workdir || "/workspace";
         const args = [];
         args.push("--ro-bind", "/usr", "/usr");
         args.push("--ro-bind", "/bin", "/bin");
@@ -11803,6 +11811,14 @@ var init_bubblewrap_sandbox = __esm({
         }
         const visorPath = this.config.visor_path || "/opt/visor";
         args.push("--ro-bind", this.visorDistPath, visorPath);
+        if (this.config.bind_paths) {
+          for (const bp of this.config.bind_paths) {
+            const hostPath = bp.host.startsWith("~") ? resolve2((process.env.HOME || "/root") + bp.host.slice(1)) : resolve2(bp.host);
+            const containerPath = bp.container || hostPath;
+            const readOnly = bp.read_only !== false;
+            args.push(readOnly ? "--ro-bind" : "--bind", hostPath, containerPath);
+          }
+        }
         args.push("--chdir", workdir);
         args.push("--unshare-pid");
         args.push("--new-session");
@@ -11830,7 +11846,7 @@ __export(seatbelt_sandbox_exports, {
 });
 import { promisify as promisify5 } from "util";
 import { execFile as execFileCb5 } from "child_process";
-import { resolve as resolve2 } from "path";
+import { resolve as resolve3 } from "path";
 import { realpathSync } from "fs";
 var execFileAsync5, EXEC_MAX_BUFFER5, SeatbeltSandbox;
 var init_seatbelt_sandbox = __esm({
@@ -11848,8 +11864,8 @@ var init_seatbelt_sandbox = __esm({
       constructor(name, config, repoPath, visorDistPath) {
         this.name = name;
         this.config = config;
-        this.repoPath = realpathSync(resolve2(repoPath));
-        this.visorDistPath = realpathSync(resolve2(visorDistPath));
+        this.repoPath = realpathSync(resolve3(repoPath));
+        this.visorDistPath = realpathSync(resolve3(visorDistPath));
       }
       /**
        * Check if sandbox-exec binary is available on the system.
@@ -11952,6 +11968,16 @@ var init_seatbelt_sandbox = __esm({
         }
         const visorDistPath = this.escapePath(this.visorDistPath);
         lines.push(`(allow file-read* (subpath "${visorDistPath}"))`);
+        if (this.config.bind_paths) {
+          for (const bp of this.config.bind_paths) {
+            const hostPath = bp.host.startsWith("~") ? resolve3((process.env.HOME || "/root") + bp.host.slice(1)) : resolve3(bp.host);
+            const escapedPath = this.escapePath(hostPath);
+            lines.push(`(allow file-read* (subpath "${escapedPath}"))`);
+            if (bp.read_only === false) {
+              lines.push(`(allow file-write* (subpath "${escapedPath}"))`);
+            }
+          }
+        }
         if (this.config.network !== false) {
           lines.push("(allow network*)");
         }
@@ -11965,7 +11991,7 @@ var init_seatbelt_sandbox = __esm({
 });
 
 // src/sandbox/sandbox-manager.ts
-import { resolve as resolve3, dirname, join as join6 } from "path";
+import { resolve as resolve4, dirname, join as join6 } from "path";
 import { existsSync as existsSync5 } from "fs";
 var SandboxManager;
 var init_sandbox_manager = __esm({
@@ -11989,10 +12015,10 @@ var init_sandbox_manager = __esm({
       }
       constructor(sandboxDefs, repoPath, gitBranch) {
         this.sandboxDefs = sandboxDefs;
-        this.repoPath = resolve3(repoPath);
+        this.repoPath = resolve4(repoPath);
         this.gitBranch = gitBranch;
         this.cacheManager = new CacheVolumeManager();
-        this.visorDistPath = existsSync5(join6(__dirname, "index.js")) ? __dirname : resolve3(dirname(__dirname));
+        this.visorDistPath = existsSync5(join6(__dirname, "index.js")) ? __dirname : resolve4(dirname(__dirname));
       }
       /**
        * Resolve which sandbox a check should use.
@@ -12213,8 +12239,8 @@ var init_workspace_manager = __esm({
         );
         if (this.cleanupRequested && this.activeOperations === 0) {
           logger.debug(`[Workspace] All references released, proceeding with deferred cleanup`);
-          for (const resolve8 of this.cleanupResolvers) {
-            resolve8();
+          for (const resolve9 of this.cleanupResolvers) {
+            resolve9();
           }
           this.cleanupResolvers = [];
         }
@@ -12371,19 +12397,19 @@ var init_workspace_manager = __esm({
           );
           this.cleanupRequested = true;
           await Promise.race([
-            new Promise((resolve8) => {
+            new Promise((resolve9) => {
               if (this.activeOperations === 0) {
-                resolve8();
+                resolve9();
               } else {
-                this.cleanupResolvers.push(resolve8);
+                this.cleanupResolvers.push(resolve9);
               }
             }),
-            new Promise((resolve8) => {
+            new Promise((resolve9) => {
               setTimeout(() => {
                 logger.warn(
                   `[Workspace] Cleanup timeout after ${timeout}ms, proceeding anyway (${this.activeOperations} operations still active)`
                 );
-                resolve8();
+                resolve9();
               }, timeout);
             })
           ]);
@@ -13001,7 +13027,7 @@ var init_state_machine_execution_engine = __esm({
           try {
             const map = options?.webhookContext?.webhookData;
             if (map) {
-              const { CheckProviderRegistry: CheckProviderRegistry2 } = await import("./check-provider-registry-DCZR46KQ.mjs");
+              const { CheckProviderRegistry: CheckProviderRegistry2 } = await import("./check-provider-registry-XZE5PRSE.mjs");
               const reg = CheckProviderRegistry2.getInstance();
               const p = reg.getProvider("http_input");
               if (p && typeof p.setWebhookContext === "function") p.setWebhookContext(map);
@@ -13114,7 +13140,7 @@ var init_state_machine_execution_engine = __esm({
           logger.info("[StateMachine] Using state machine engine");
         }
         if (!config) {
-          const { ConfigManager } = await import("./config-MTEIGCOQ.mjs");
+          const { ConfigManager } = await import("./config-SW3VO4DQ.mjs");
           const configManager = new ConfigManager();
           config = await configManager.getDefaultConfig();
           logger.debug("[StateMachine] Using default configuration (no config provided)");
@@ -13124,7 +13150,7 @@ var init_state_machine_execution_engine = __esm({
           tag_filter: tagFilter
         } : config;
         try {
-          const { CheckProviderRegistry: CheckProviderRegistry2 } = await import("./check-provider-registry-DCZR46KQ.mjs");
+          const { CheckProviderRegistry: CheckProviderRegistry2 } = await import("./check-provider-registry-XZE5PRSE.mjs");
           const registry = CheckProviderRegistry2.getInstance();
           registry.setCustomTools(configWithTagFilter.tools || {});
         } catch (error) {
@@ -13165,7 +13191,7 @@ var init_state_machine_execution_engine = __esm({
             logger.debug(
               `[PolicyEngine] Loading enterprise policy engine (engine=${configWithTagFilter.policy.engine})`
             );
-            const { loadEnterprisePolicyEngine } = await import("./enterprise/loader");
+            const { loadEnterprisePolicyEngine } = await import("./loader-NJCF7DUS.mjs");
             context2.policyEngine = await loadEnterprisePolicyEngine(configWithTagFilter.policy);
             logger.debug(
               `[PolicyEngine] Initialized: ${context2.policyEngine?.constructor?.name || "unknown"}`
@@ -13188,7 +13214,7 @@ var init_state_machine_execution_engine = __esm({
           try {
             const webhookData = this.executionContext?.webhookContext?.webhookData;
             if (webhookData instanceof Map) {
-              const { extractSlackContext: extractSlackContext2 } = await import("./schedule-tool-handler-T4L2ECBA.mjs");
+              const { extractSlackContext: extractSlackContext2 } = await import("./schedule-tool-handler-Q7E5NBHS.mjs");
               const slackCtx = extractSlackContext2(webhookData);
               if (slackCtx) {
                 const payload = Array.from(webhookData.values())[0];
@@ -13217,7 +13243,7 @@ var init_state_machine_execution_engine = __esm({
         if (Array.isArray(configWithTagFilter.frontends) && configWithTagFilter.frontends.length > 0) {
           try {
             const { EventBus } = await import("./event-bus-5K3Y2FCS.mjs");
-            const { FrontendsHost } = await import("./host-A5HS6F6G.mjs");
+            const { FrontendsHost } = await import("./host-X7ID5EW7.mjs");
             const bus = new EventBus();
             context2.eventBus = bus;
             frontendsHost = new FrontendsHost(bus, logger);
@@ -15022,11 +15048,11 @@ async function handleCreateTrigger(args, context2, store) {
       error: `Available workflows: ${context2.availableWorkflows.slice(0, 5).join(", ")}${context2.availableWorkflows.length > 5 ? "..." : ""}`
     };
   }
-  if ((!args.trigger_channels || args.trigger_channels.length === 0) && (!args.trigger_contains || args.trigger_contains.length === 0) && !args.trigger_match) {
+  if ((!args.trigger_channels || args.trigger_channels.length === 0) && (!args.trigger_from || args.trigger_from.length === 0) && (!args.trigger_contains || args.trigger_contains.length === 0) && !args.trigger_match) {
     return {
       success: false,
       message: "Missing trigger filters",
-      error: "Please specify at least one filter: trigger_channels, trigger_contains, or trigger_match."
+      error: "Please specify at least one filter: trigger_channels, trigger_from, trigger_contains, or trigger_match."
     };
   }
   const permissionCheck = checkSchedulePermissions(context2, args.workflow);
@@ -15044,6 +15070,7 @@ async function handleCreateTrigger(args, context2, store) {
       creatorName: context2.userName,
       description: args.trigger_description,
       channels: args.trigger_channels,
+      fromUsers: args.trigger_from,
       fromBots: args.trigger_from_bots ?? false,
       contains: args.trigger_contains,
       matchPattern: args.trigger_match,
@@ -15062,7 +15089,8 @@ async function handleCreateTrigger(args, context2, store) {
 
 **Workflow**: ${trigger.workflow}
 **Channels**: ${trigger.channels?.join(", ") || "all"}
-${trigger.contains?.length ? `**Contains**: ${trigger.contains.join(", ")}
+${trigger.fromUsers?.length ? `**From users**: ${trigger.fromUsers.join(", ")}
+` : ""}${trigger.contains?.length ? `**Contains**: ${trigger.contains.join(", ")}
 ` : ""}${trigger.matchPattern ? `**Pattern**: /${trigger.matchPattern}/
 ` : ""}${trigger.description ? `**Description**: ${trigger.description}
 ` : ""}
@@ -15188,7 +15216,7 @@ Slack messages in specific channels. Use the create_trigger, list_triggers, dele
 actions for this. Message triggers fire workflows based on message content, channel, sender, and thread scope.
 
 TRIGGER ACTIONS:
-- create_trigger: Create a new message trigger (requires workflow + at least one filter)
+- create_trigger: Create a new message trigger (requires workflow + at least one filter). Supports filtering by user IDs (trigger_from), channels, keywords, regex, and thread scope.
 - list_triggers: Show user's message triggers
 - delete_trigger: Remove a trigger by ID
 - update_trigger: Enable/disable a trigger by ID
@@ -15285,6 +15313,9 @@ User: "cancel schedule abc123"
 User: "watch #cicd for messages containing 'failed' and run %handle-cicd"
 \u2192 { "action": "create_trigger", "trigger_channels": ["C0CICD"], "trigger_contains": ["failed"], "workflow": "handle-cicd" }
 
+User: "trigger on each of my messages in this channel and run %auto-reply" (user ID is U3P2L4XNE)
+\u2192 { "action": "create_trigger", "trigger_channels": ["C09V810NY6R"], "trigger_from": ["U3P2L4XNE"], "workflow": "auto-reply" }
+
 User: "list my message triggers"
 \u2192 { "action": "list_triggers" }
 
@@ -15366,6 +15397,11 @@ User: "disable trigger abc123"
           items: { type: "string" },
           description: 'For create_trigger: Slack channel IDs to monitor (e.g., ["C0CICD"]). Supports wildcard suffix (e.g., "CENG*").'
         },
+        trigger_from: {
+          type: "array",
+          items: { type: "string" },
+          description: 'For create_trigger: Slack user IDs to filter by. Only messages from these users will trigger the workflow. E.g., ["U3P2L4XNE"]. If omitted, messages from any user will trigger.'
+        },
         trigger_from_bots: {
           type: "boolean",
           description: "For create_trigger: allow bot messages to trigger (default: false)"
@@ -15713,7 +15749,7 @@ var init_mcp_custom_sse_server = __esm({
        * Returns the actual bound port number
        */
       async start() {
-        return new Promise((resolve8, reject) => {
+        return new Promise((resolve9, reject) => {
           try {
             this.server = http.createServer((req, res) => {
               this.handleRequest(req, res).catch((error) => {
@@ -15747,7 +15783,7 @@ var init_mcp_custom_sse_server = __esm({
                 );
               }
               this.startKeepalive();
-              resolve8(this.port);
+              resolve9(this.port);
             });
           } catch (error) {
             reject(error);
@@ -15810,7 +15846,7 @@ var init_mcp_custom_sse_server = __esm({
             logger.debug(
               `[CustomToolsSSEServer:${this.sessionId}] Grace period before stop: ${waitMs}ms (activeToolCalls=${this.activeToolCalls})`
             );
-            await new Promise((resolve8) => setTimeout(resolve8, waitMs));
+            await new Promise((resolve9) => setTimeout(resolve9, waitMs));
           }
         }
         if (this.activeToolCalls > 0) {
@@ -15819,7 +15855,7 @@ var init_mcp_custom_sse_server = __esm({
             `[CustomToolsSSEServer:${this.sessionId}] Waiting for ${this.activeToolCalls} active tool call(s) before stop`
           );
           while (this.activeToolCalls > 0 && Date.now() - startedAt < effectiveDrainTimeoutMs) {
-            await new Promise((resolve8) => setTimeout(resolve8, 250));
+            await new Promise((resolve9) => setTimeout(resolve9, 250));
           }
           if (this.activeToolCalls > 0) {
             logger.warn(
@@ -15844,21 +15880,21 @@ var init_mcp_custom_sse_server = __esm({
         }
         this.connections.clear();
         if (this.server) {
-          await new Promise((resolve8, reject) => {
+          await new Promise((resolve9, reject) => {
             const timeout = setTimeout(() => {
               if (this.debug) {
                 logger.debug(
                   `[CustomToolsSSEServer:${this.sessionId}] Force closing server after timeout`
                 );
               }
-              this.server?.close(() => resolve8());
+              this.server?.close(() => resolve9());
             }, 5e3);
             this.server.close((error) => {
               clearTimeout(timeout);
               if (error) {
                 reject(error);
               } else {
-                resolve8();
+                resolve9();
               }
             });
           });
@@ -16284,7 +16320,7 @@ var init_mcp_custom_sse_server = __esm({
               logger.warn(
                 `[CustomToolsSSEServer:${this.sessionId}] Tool ${toolName} failed (attempt ${attempt + 1}/${retryCount + 1}): ${errorMsg}. Retrying in ${delay}ms`
               );
-              await new Promise((resolve8) => setTimeout(resolve8, delay));
+              await new Promise((resolve9) => setTimeout(resolve9, delay));
               attempt++;
             }
           }
@@ -25554,8 +25590,8 @@ var require_util2 = __commonJS({
     function createDeferredPromise() {
       let res;
       let rej;
-      const promise = new Promise((resolve8, reject) => {
-        res = resolve8;
+      const promise = new Promise((resolve9, reject) => {
+        res = resolve9;
         rej = reject;
       });
       return { promise, resolve: res, reject: rej };
@@ -27060,8 +27096,8 @@ Content-Type: ${value.type || "application/octet-stream"}\r
                 });
               }
             });
-            const busboyResolve = new Promise((resolve8, reject) => {
-              busboy.on("finish", resolve8);
+            const busboyResolve = new Promise((resolve9, reject) => {
+              busboy.on("finish", resolve9);
               busboy.on("error", (err) => reject(new TypeError(err)));
             });
             if (this.body !== null) for await (const chunk of consumeBody(this[kState].body)) busboy.write(chunk);
@@ -27595,9 +27631,9 @@ var require_dispatcher_base = __commonJS({
       }
       close(callback) {
         if (callback === void 0) {
-          return new Promise((resolve8, reject) => {
+          return new Promise((resolve9, reject) => {
             this.close((err, data) => {
-              return err ? reject(err) : resolve8(data);
+              return err ? reject(err) : resolve9(data);
             });
           });
         }
@@ -27635,12 +27671,12 @@ var require_dispatcher_base = __commonJS({
           err = null;
         }
         if (callback === void 0) {
-          return new Promise((resolve8, reject) => {
+          return new Promise((resolve9, reject) => {
             this.destroy(err, (err2, data) => {
               return err2 ? (
                 /* istanbul ignore next: should never error */
                 reject(err2)
-              ) : resolve8(data);
+              ) : resolve9(data);
             });
           });
         }
@@ -28702,16 +28738,16 @@ var require_client = __commonJS({
         return this[kNeedDrain] < 2;
       }
       async [kClose]() {
-        return new Promise((resolve8) => {
+        return new Promise((resolve9) => {
           if (!this[kSize]) {
-            resolve8(null);
+            resolve9(null);
           } else {
-            this[kClosedResolve] = resolve8;
+            this[kClosedResolve] = resolve9;
           }
         });
       }
       async [kDestroy](err) {
-        return new Promise((resolve8) => {
+        return new Promise((resolve9) => {
           const requests = this[kQueue].splice(this[kPendingIdx]);
           for (let i = 0; i < requests.length; i++) {
             const request = requests[i];
@@ -28722,7 +28758,7 @@ var require_client = __commonJS({
               this[kClosedResolve]();
               this[kClosedResolve] = null;
             }
-            resolve8();
+            resolve9();
           };
           if (this[kHTTP2Session] != null) {
             util.destroy(this[kHTTP2Session], err);
@@ -29302,7 +29338,7 @@ var require_client = __commonJS({
         });
       }
       try {
-        const socket = await new Promise((resolve8, reject) => {
+        const socket = await new Promise((resolve9, reject) => {
           client[kConnector]({
             host,
             hostname,
@@ -29314,7 +29350,7 @@ var require_client = __commonJS({
             if (err) {
               reject(err);
             } else {
-              resolve8(socket2);
+              resolve9(socket2);
             }
           });
         });
@@ -29938,12 +29974,12 @@ upgrade: ${upgrade}\r
           cb();
         }
       }
-      const waitForDrain = () => new Promise((resolve8, reject) => {
+      const waitForDrain = () => new Promise((resolve9, reject) => {
         assert(callback === null);
         if (socket[kError]) {
           reject(socket[kError]);
         } else {
-          callback = resolve8;
+          callback = resolve9;
         }
       });
       if (client[kHTTPConnVersion] === "h2") {
@@ -30289,8 +30325,8 @@ var require_pool_base = __commonJS({
         if (this[kQueue].isEmpty()) {
           return Promise.all(this[kClients].map((c) => c.close()));
         } else {
-          return new Promise((resolve8) => {
-            this[kClosedResolve] = resolve8;
+          return new Promise((resolve9) => {
+            this[kClosedResolve] = resolve9;
           });
         }
       }
@@ -30868,7 +30904,7 @@ var require_readable = __commonJS({
         if (this.closed) {
           return Promise.resolve(null);
         }
-        return new Promise((resolve8, reject) => {
+        return new Promise((resolve9, reject) => {
           const signalListenerCleanup = signal ? util.addAbortListener(signal, () => {
             this.destroy();
           }) : noop;
@@ -30877,7 +30913,7 @@ var require_readable = __commonJS({
             if (signal && signal.aborted) {
               reject(signal.reason || Object.assign(new Error("The operation was aborted"), { name: "AbortError" }));
             } else {
-              resolve8(null);
+              resolve9(null);
             }
           }).on("error", noop).on("data", function(chunk) {
             limit -= chunk.length;
@@ -30899,11 +30935,11 @@ var require_readable = __commonJS({
         throw new TypeError("unusable");
       }
       assert(!stream[kConsume]);
-      return new Promise((resolve8, reject) => {
+      return new Promise((resolve9, reject) => {
         stream[kConsume] = {
           type,
           stream,
-          resolve: resolve8,
+          resolve: resolve9,
           reject,
           length: 0,
           body: []
@@ -30938,12 +30974,12 @@ var require_readable = __commonJS({
       }
     }
     function consumeEnd(consume2) {
-      const { type, body, resolve: resolve8, stream, length } = consume2;
+      const { type, body, resolve: resolve9, stream, length } = consume2;
       try {
         if (type === "text") {
-          resolve8(toUSVString(Buffer.concat(body)));
+          resolve9(toUSVString(Buffer.concat(body)));
         } else if (type === "json") {
-          resolve8(JSON.parse(Buffer.concat(body)));
+          resolve9(JSON.parse(Buffer.concat(body)));
         } else if (type === "arrayBuffer") {
           const dst = new Uint8Array(length);
           let pos = 0;
@@ -30951,12 +30987,12 @@ var require_readable = __commonJS({
             dst.set(buf, pos);
             pos += buf.byteLength;
           }
-          resolve8(dst.buffer);
+          resolve9(dst.buffer);
         } else if (type === "blob") {
           if (!Blob2) {
             Blob2 = __require("buffer").Blob;
           }
-          resolve8(new Blob2(body, { type: stream[kContentType] }));
+          resolve9(new Blob2(body, { type: stream[kContentType] }));
         }
         consumeFinish(consume2);
       } catch (err) {
@@ -31213,9 +31249,9 @@ var require_api_request = __commonJS({
     };
     function request(opts, callback) {
       if (callback === void 0) {
-        return new Promise((resolve8, reject) => {
+        return new Promise((resolve9, reject) => {
           request.call(this, opts, (err, data) => {
-            return err ? reject(err) : resolve8(data);
+            return err ? reject(err) : resolve9(data);
           });
         });
       }
@@ -31388,9 +31424,9 @@ var require_api_stream = __commonJS({
     };
     function stream(opts, factory, callback) {
       if (callback === void 0) {
-        return new Promise((resolve8, reject) => {
+        return new Promise((resolve9, reject) => {
           stream.call(this, opts, factory, (err, data) => {
-            return err ? reject(err) : resolve8(data);
+            return err ? reject(err) : resolve9(data);
           });
         });
       }
@@ -31671,9 +31707,9 @@ var require_api_upgrade = __commonJS({
     };
     function upgrade(opts, callback) {
       if (callback === void 0) {
-        return new Promise((resolve8, reject) => {
+        return new Promise((resolve9, reject) => {
           upgrade.call(this, opts, (err, data) => {
-            return err ? reject(err) : resolve8(data);
+            return err ? reject(err) : resolve9(data);
           });
         });
       }
@@ -31762,9 +31798,9 @@ var require_api_connect = __commonJS({
     };
     function connect(opts, callback) {
       if (callback === void 0) {
-        return new Promise((resolve8, reject) => {
+        return new Promise((resolve9, reject) => {
           connect.call(this, opts, (err, data) => {
-            return err ? reject(err) : resolve8(data);
+            return err ? reject(err) : resolve9(data);
           });
         });
       }
@@ -35387,7 +35423,7 @@ var require_fetch = __commonJS({
       async function dispatch({ body }) {
         const url = requestCurrentURL(request);
         const agent = fetchParams.controller.dispatcher;
-        return new Promise((resolve8, reject) => agent.dispatch(
+        return new Promise((resolve9, reject) => agent.dispatch(
           {
             path: url.pathname + url.search,
             origin: url.origin,
@@ -35463,7 +35499,7 @@ var require_fetch = __commonJS({
                   }
                 }
               }
-              resolve8({
+              resolve9({
                 status,
                 statusText,
                 headersList: headers[kHeadersList],
@@ -35506,7 +35542,7 @@ var require_fetch = __commonJS({
                 const val = headersList[n + 1].toString("latin1");
                 headers[kHeadersList].append(key, val);
               }
-              resolve8({
+              resolve9({
                 status,
                 statusText: STATUS_CODES[status],
                 headersList: headers[kHeadersList],
@@ -39301,7 +39337,7 @@ var init_mcp_check_provider = __esm({
             logger.warn(
               `MCP ${transportName} failed (attempt ${attempt + 1}/${maxRetries + 1}), retrying in ${delay}ms: ${error instanceof Error ? error.message : String(error)}`
             );
-            await new Promise((resolve8) => setTimeout(resolve8, delay));
+            await new Promise((resolve9) => setTimeout(resolve9, delay));
             attempt += 1;
           } finally {
             try {
@@ -39584,7 +39620,7 @@ async function acquirePromptLock() {
     activePrompt = true;
     return;
   }
-  await new Promise((resolve8) => waiters.push(resolve8));
+  await new Promise((resolve9) => waiters.push(resolve9));
   activePrompt = true;
 }
 function releasePromptLock() {
@@ -39594,7 +39630,7 @@ function releasePromptLock() {
 }
 async function interactivePrompt(options) {
   await acquirePromptLock();
-  return new Promise((resolve8, reject) => {
+  return new Promise((resolve9, reject) => {
     const dbg = process.env.VISOR_DEBUG === "true";
     try {
       if (dbg) {
@@ -39681,12 +39717,12 @@ async function interactivePrompt(options) {
     };
     const finish = (value) => {
       cleanup();
-      resolve8(value);
+      resolve9(value);
     };
     if (options.timeout && options.timeout > 0) {
       timeoutId = setTimeout(() => {
         cleanup();
-        if (defaultValue !== void 0) return resolve8(defaultValue);
+        if (defaultValue !== void 0) return resolve9(defaultValue);
         return reject(new Error("Input timeout"));
       }, options.timeout);
     }
@@ -39818,7 +39854,7 @@ async function interactivePrompt(options) {
   });
 }
 async function simplePrompt(prompt) {
-  return new Promise((resolve8) => {
+  return new Promise((resolve9) => {
     const rl = readline.createInterface({
       input: process.stdin,
       output: process.stdout
@@ -39834,7 +39870,7 @@ async function simplePrompt(prompt) {
     rl.question(`${prompt}
 > `, (answer) => {
       rl.close();
-      resolve8(answer.trim());
+      resolve9(answer.trim());
     });
   });
 }
@@ -39852,7 +39888,7 @@ function isStdinAvailable() {
   return !process.stdin.isTTY;
 }
 async function readStdin(timeout, maxSize = 1024 * 1024) {
-  return new Promise((resolve8, reject) => {
+  return new Promise((resolve9, reject) => {
     let data = "";
     let timeoutId;
     if (timeout) {
@@ -39879,7 +39915,7 @@ async function readStdin(timeout, maxSize = 1024 * 1024) {
     };
     const onEnd = () => {
       cleanup();
-      resolve8(data.trim());
+      resolve9(data.trim());
     };
     const onError = (err) => {
       cleanup();
@@ -40666,8 +40702,8 @@ function buildBuiltinGlobals(opts) {
   const asyncFunctionNames = /* @__PURE__ */ new Set();
   const scheduleFn = async (args = {}) => {
     try {
-      const { handleScheduleAction: handleScheduleAction2, buildScheduleToolContext: buildScheduleToolContext2 } = await import("./schedule-tool-IJC2TSKU.mjs");
-      const { extractSlackContext: extractSlackContext2 } = await import("./schedule-tool-handler-T4L2ECBA.mjs");
+      const { handleScheduleAction: handleScheduleAction2, buildScheduleToolContext: buildScheduleToolContext2 } = await import("./schedule-tool-WSZKJUNQ.mjs");
+      const { extractSlackContext: extractSlackContext2 } = await import("./schedule-tool-handler-Q7E5NBHS.mjs");
       const parentCtx = opts.sessionInfo?._parentContext;
       const webhookData = parentCtx?.prInfo?.eventContext?.webhookData;
       const visorCfg = parentCtx?.config;
@@ -42895,7 +42931,10 @@ function projectWorkflowToGraph(workflow, workflowInputs, _parentCheckId) {
         group_by: "check",
         collapse: false
       }
-    }
+    },
+    ...workflow.sandboxes && { sandboxes: workflow.sandboxes },
+    ...workflow.sandbox && { sandbox: workflow.sandbox },
+    ...workflow.sandbox_defaults && { sandbox_defaults: workflow.sandbox_defaults }
   };
   if (logger.isDebugEnabled?.()) {
     logger.debug(
@@ -43712,4 +43751,4 @@ undici/lib/fetch/body.js:
 undici/lib/websocket/frame.js:
   (*! ws. MIT License. Einar Otto Stangvik <einaros@gmail.com> *)
 */
-//# sourceMappingURL=chunk-XJZKNTKZ.mjs.map
+//# sourceMappingURL=chunk-DXNWUIAN.mjs.map