@sentry/junior-plugin-api 0.69.0 → 0.70.0

package/dist/index.d.ts

@@ -321,18 +321,40 @@ export declare const agentPluginCredentialResultSchema: z.ZodDiscriminatedUnion<
 export type AgentPluginGrantAccess = z.output<typeof agentPluginGrantAccessSchema>;
 /** Provider authorization Junior can start when a plugin-owned grant is missing. */
 export type AgentPluginAuthorization = z.output<typeof agentPluginAuthorizationSchema>;
+/** Interrupt sandbox egress so Junior can start provider authorization. */
+export declare class EgressAuthRequired extends Error {
+    authorization?: AgentPluginAuthorization;
+    constructor(message: string, options?: {
+        authorization?: AgentPluginAuthorization;
+        cause?: unknown;
+    });
+}
 /** Provider account identity resolved by a plugin OAuth hook. */
 export type AgentPluginProviderAccount = z.output<typeof agentPluginProviderAccountSchema>;
 /** Plugin-defined grant required before Junior can forward one outbound request. */
 export type AgentPluginGrant = z.output<typeof agentPluginGrantSchema>;
 /** Request details available while selecting the grant for sandbox egress. */
 export interface AgentPluginEgressRequest {
+    /** Capped request body text when the host exposes it for provider-specific grant classification. */
+    bodyText?: string;
     method: string;
     url: string;
 }
 export interface EgressHookContext extends AgentPluginContext {
     request: AgentPluginEgressRequest;
 }
+export interface AgentPluginEgressResponse {
+    /** Snapshot of upstream response headers; mutations do not affect pass-through. */
+    headers: Headers;
+    readText(maxBytes: number): Promise<string | undefined>;
+    status: number;
+}
+export interface EgressResponseHookContext extends AgentPluginContext {
+    grant: AgentPluginGrant;
+    permissionDenied(message: string): void;
+    request: Omit<AgentPluginEgressRequest, "bodyText">;
+    response: AgentPluginEgressResponse;
+}
 /** Header mutations a plugin-issued credential lease may apply to owned domains. */
 export type AgentPluginCredentialHeaderTransform = z.output<typeof agentPluginCredentialHeaderTransformSchema>;
 /** Short-lived credential headers issued by a plugin for a selected grant. */
@@ -379,6 +401,7 @@ export interface AgentPluginHooks {
     beforeToolExecute?(ctx: BeforeToolExecuteHookContext): Promise<void> | void;
     grantForEgress?(ctx: EgressHookContext): Promise<AgentPluginGrant | undefined> | AgentPluginGrant | undefined;
     issueCredential?(ctx: IssueCredentialHookContext): Promise<AgentPluginCredentialResult> | AgentPluginCredentialResult;
+    onEgressResponse?(ctx: EgressResponseHookContext): Promise<void> | void;
     resolveOAuthAccount?(ctx: ResolveOAuthAccountHookContext): Promise<AgentPluginProviderAccount | undefined> | AgentPluginProviderAccount | undefined;
     routes?(ctx: RouteRegistrationHookContext): AgentPluginRoute[];
     tools?(ctx: ToolRegistrationHookContext): Record<string, AgentPluginToolDefinition>;

package/dist/index.js

@@ -116,6 +116,14 @@ var agentPluginCredentialResultSchema = z.discriminatedUnion("type", [
     type: z.literal("unavailable")
   }).strict()
 ]);
+var EgressAuthRequired = class extends Error {
+  authorization;
+  constructor(message, options) {
+    super(message, { cause: options?.cause });
+    this.name = "EgressAuthRequired";
+    this.authorization = options?.authorization;
+  }
+};
 var PLUGIN_NAME_RE = /^[a-z][a-z0-9-]*$/;
 function defineJuniorPlugin(plugin) {
   if ("pluginConfig" in plugin) {
@@ -157,6 +165,7 @@ function defineJuniorPlugin(plugin) {
 }
 export {
   AgentPluginToolInputError,
+  EgressAuthRequired,
   agentPluginAuthorizationSchema,
   agentPluginCredentialHeaderTransformSchema,
   agentPluginCredentialLeaseSchema,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sentry/junior-plugin-api",
-  "version": "0.69.0",
+  "version": "0.70.0",
   "private": false,
   "publishConfig": {
     "access": "public"

package/src/index.ts

@@ -443,6 +443,23 @@ export type AgentPluginAuthorization = z.output<
   typeof agentPluginAuthorizationSchema
 >;
 
+/** Interrupt sandbox egress so Junior can start provider authorization. */
+export class EgressAuthRequired extends Error {
+  authorization?: AgentPluginAuthorization;
+
+  constructor(
+    message: string,
+    options?: {
+      authorization?: AgentPluginAuthorization;
+      cause?: unknown;
+    },
+  ) {
+    super(message, { cause: options?.cause });
+    this.name = "EgressAuthRequired";
+    this.authorization = options?.authorization;
+  }
+}
+
 /** Provider account identity resolved by a plugin OAuth hook. */
 export type AgentPluginProviderAccount = z.output<
   typeof agentPluginProviderAccountSchema
@@ -453,6 +470,8 @@ export type AgentPluginGrant = z.output<typeof agentPluginGrantSchema>;
 
 /** Request details available while selecting the grant for sandbox egress. */
 export interface AgentPluginEgressRequest {
+  /** Capped request body text when the host exposes it for provider-specific grant classification. */
+  bodyText?: string;
   method: string;
   url: string;
 }
@@ -461,6 +480,20 @@ export interface EgressHookContext extends AgentPluginContext {
   request: AgentPluginEgressRequest;
 }
 
+export interface AgentPluginEgressResponse {
+  /** Snapshot of upstream response headers; mutations do not affect pass-through. */
+  headers: Headers;
+  readText(maxBytes: number): Promise<string | undefined>;
+  status: number;
+}
+
+export interface EgressResponseHookContext extends AgentPluginContext {
+  grant: AgentPluginGrant;
+  permissionDenied(message: string): void;
+  request: Omit<AgentPluginEgressRequest, "bodyText">;
+  response: AgentPluginEgressResponse;
+}
+
 /** Header mutations a plugin-issued credential lease may apply to owned domains. */
 export type AgentPluginCredentialHeaderTransform = z.output<
   typeof agentPluginCredentialHeaderTransformSchema
@@ -529,6 +562,7 @@ export interface AgentPluginHooks {
   issueCredential?(
     ctx: IssueCredentialHookContext,
   ): Promise<AgentPluginCredentialResult> | AgentPluginCredentialResult;
+  onEgressResponse?(ctx: EgressResponseHookContext): Promise<void> | void;
   resolveOAuthAccount?(
     ctx: ResolveOAuthAccountHookContext,
   ):