@sentry/junior 0.1.1 → 0.3.0

package/dist/chunk-DPTR2FNH.js

@@ -0,0 +1,1866 @@
+import {
+  logInfo,
+  logWarn,
+  setSpanAttributes,
+  withSpan
+} from "./chunk-PY4AI2GZ.js";
+import {
+  discoverInstalledPluginPackageContent,
+  discoverProjectRoots
+} from "./chunk-SP6LV35L.js";
+
+// src/chat/config.ts
+var MIN_AGENT_TURN_TIMEOUT_MS = 10 * 1e3;
+var DEFAULT_AGENT_TURN_TIMEOUT_MS = 12 * 60 * 1e3;
+var DEFAULT_QUEUE_CALLBACK_MAX_DURATION_SECONDS = 800;
+var TURN_TIMEOUT_BUFFER_SECONDS = 20;
+function parseAgentTurnTimeoutMs(rawValue, maxTimeoutMs) {
+  const value = Number.parseInt(rawValue ?? "", 10);
+  if (Number.isNaN(value)) {
+    return Math.max(MIN_AGENT_TURN_TIMEOUT_MS, Math.min(DEFAULT_AGENT_TURN_TIMEOUT_MS, maxTimeoutMs));
+  }
+  return Math.max(MIN_AGENT_TURN_TIMEOUT_MS, Math.min(value, maxTimeoutMs));
+}
+function resolveQueueCallbackMaxDurationSeconds() {
+  const value = Number.parseInt(process.env.QUEUE_CALLBACK_MAX_DURATION_SECONDS ?? "", 10);
+  if (Number.isNaN(value) || value <= 0) {
+    return DEFAULT_QUEUE_CALLBACK_MAX_DURATION_SECONDS;
+  }
+  return value;
+}
+function resolveMaxTurnTimeoutMs(queueCallbackMaxDurationSeconds) {
+  const budgetSeconds = queueCallbackMaxDurationSeconds - TURN_TIMEOUT_BUFFER_SECONDS;
+  return Math.max(MIN_AGENT_TURN_TIMEOUT_MS, budgetSeconds * 1e3);
+}
+function buildBotConfig() {
+  const queueCallbackMaxDurationSeconds = resolveQueueCallbackMaxDurationSeconds();
+  const maxTurnTimeoutMs = resolveMaxTurnTimeoutMs(queueCallbackMaxDurationSeconds);
+  return {
+    userName: process.env.JUNIOR_BOT_NAME ?? "junior",
+    modelId: process.env.AI_MODEL ?? "anthropic/claude-sonnet-4.6",
+    fastModelId: process.env.AI_FAST_MODEL ?? process.env.AI_MODEL ?? "anthropic/claude-haiku-4.5",
+    turnTimeoutMs: parseAgentTurnTimeoutMs(process.env.AGENT_TURN_TIMEOUT_MS, maxTurnTimeoutMs)
+  };
+}
+var botConfig = buildBotConfig();
+function toOptionalTrimmed(value) {
+  if (!value) {
+    return void 0;
+  }
+  const trimmed = value.trim();
+  return trimmed.length > 0 ? trimmed : void 0;
+}
+function getSlackBotToken() {
+  return toOptionalTrimmed(process.env.SLACK_BOT_TOKEN) ?? toOptionalTrimmed(process.env.SLACK_BOT_USER_TOKEN);
+}
+function getSlackSigningSecret() {
+  return toOptionalTrimmed(process.env.SLACK_SIGNING_SECRET);
+}
+function getSlackClientId() {
+  return toOptionalTrimmed(process.env.SLACK_CLIENT_ID);
+}
+function getSlackClientSecret() {
+  return toOptionalTrimmed(process.env.SLACK_CLIENT_SECRET);
+}
+function hasRedisConfig() {
+  return Boolean(process.env.REDIS_URL);
+}
+
+// src/chat/state.ts
+import { createRedisState } from "@chat-adapter/state-redis";
+import { createMemoryState } from "@chat-adapter/state-memory";
+var MIN_LOCK_TTL_MS = 1e3 * 60 * 5;
+var QUEUE_INGRESS_DEDUP_PREFIX = "junior:queue_ingress";
+var QUEUE_MESSAGE_PROCESSING_PREFIX = "junior:queue_message";
+var AGENT_TURN_SESSION_PREFIX = "junior:agent_turn_session";
+var QUEUE_MESSAGE_PROCESSING_TTL_MS = 30 * 60 * 1e3;
+var QUEUE_MESSAGE_COMPLETED_TTL_MS = 7 * 24 * 60 * 60 * 1e3;
+var QUEUE_MESSAGE_FAILED_TTL_MS = 6 * 60 * 60 * 1e3;
+var AGENT_TURN_SESSION_TTL_MS = 24 * 60 * 60 * 1e3;
+var CLAIM_OR_RECLAIM_PROCESSING_SCRIPT = `
+  local key = KEYS[1]
+  local nowMs = tonumber(ARGV[1])
+  local ttlMs = tonumber(ARGV[2])
+  local payload = ARGV[3]
+  local current = redis.call("get", key)
+
+  if not current then
+    redis.call("set", key, payload, "PX", ttlMs)
+    return 1
+  end
+
+  local ok, parsed = pcall(cjson.decode, current)
+  if not ok or type(parsed) ~= "table" then
+    return 0
+  end
+
+  local status = parsed["status"]
+  if status == "failed" then
+    redis.call("set", key, payload, "PX", ttlMs)
+    return 3
+  end
+  if status ~= "processing" then
+    return 0
+  end
+
+  local updatedAtMs = tonumber(parsed["updatedAtMs"])
+  if not updatedAtMs then
+    return 0
+  end
+
+  if updatedAtMs + ttlMs < nowMs then
+    redis.call("set", key, payload, "PX", ttlMs)
+    return 2
+  end
+
+  return 0
+`;
+var UPDATE_PROCESSING_STATE_IF_OWNER_SCRIPT = `
+  local key = KEYS[1]
+  local ownerToken = ARGV[1]
+  local ttlMs = tonumber(ARGV[2])
+  local payload = ARGV[3]
+  local current = redis.call("get", key)
+
+  if not current then
+    return 0
+  end
+
+  local ok, parsed = pcall(cjson.decode, current)
+  if not ok or type(parsed) ~= "table" then
+    return 0
+  end
+
+  local currentOwner = parsed["ownerToken"]
+  local status = parsed["status"]
+  if currentOwner ~= ownerToken then
+    return 0
+  end
+  if status ~= "processing" then
+    return 0
+  end
+
+  redis.call("set", key, payload, "PX", ttlMs)
+  return 1
+`;
+function createQueuedStateAdapter(base) {
+  const acquireLock = async (threadId, ttlMs) => {
+    const effectiveTtlMs = Math.max(ttlMs, MIN_LOCK_TTL_MS);
+    const lock = await base.acquireLock(threadId, effectiveTtlMs);
+    return lock;
+  };
+  return {
+    connect: () => base.connect(),
+    disconnect: () => base.disconnect(),
+    subscribe: (threadId) => base.subscribe(threadId),
+    unsubscribe: (threadId) => base.unsubscribe(threadId),
+    isSubscribed: (threadId) => base.isSubscribed(threadId),
+    acquireLock,
+    releaseLock: (lock) => base.releaseLock(lock),
+    extendLock: (lock, ttlMs) => base.extendLock(lock, Math.max(ttlMs, MIN_LOCK_TTL_MS)),
+    get: (key) => base.get(key),
+    set: (key, value, ttlMs) => base.set(key, value, ttlMs),
+    setIfNotExists: (key, value, ttlMs) => base.setIfNotExists(key, value, ttlMs),
+    delete: (key) => base.delete(key)
+  };
+}
+function createStateAdapter() {
+  if (process.env.JUNIOR_STATE_ADAPTER?.trim().toLowerCase() === "memory") {
+    _redisStateAdapter = void 0;
+    return createQueuedStateAdapter(createMemoryState());
+  }
+  if (!hasRedisConfig()) {
+    throw new Error("REDIS_URL is required for durable Slack thread state");
+  }
+  const redisState = createRedisState({
+    url: process.env.REDIS_URL
+  });
+  _redisStateAdapter = redisState;
+  return createQueuedStateAdapter(redisState);
+}
+var _stateAdapter;
+var _redisStateAdapter;
+function getRedisStateAdapter() {
+  if (!_redisStateAdapter) {
+    getStateAdapter();
+  }
+  if (!_redisStateAdapter) {
+    throw new Error("Redis state adapter is unavailable for this runtime");
+  }
+  return _redisStateAdapter;
+}
+function queueMessageKey(rawKey) {
+  return `${QUEUE_MESSAGE_PROCESSING_PREFIX}:${rawKey}`;
+}
+function parseQueueMessageState(value) {
+  if (typeof value !== "string") {
+    return void 0;
+  }
+  try {
+    const parsed = JSON.parse(value);
+    if (!parsed || parsed.status !== "processing" && parsed.status !== "completed" && parsed.status !== "failed" || typeof parsed.updatedAtMs !== "number") {
+      return void 0;
+    }
+    return {
+      status: parsed.status,
+      updatedAtMs: parsed.updatedAtMs,
+      ...typeof parsed.ownerToken === "string" ? { ownerToken: parsed.ownerToken } : {},
+      ...typeof parsed.queueMessageId === "string" ? { queueMessageId: parsed.queueMessageId } : {},
+      ...typeof parsed.errorMessage === "string" ? { errorMessage: parsed.errorMessage } : {}
+    };
+  } catch {
+    return void 0;
+  }
+}
+function agentTurnSessionKey(conversationId, sessionId) {
+  return `${AGENT_TURN_SESSION_PREFIX}:${conversationId}:${sessionId}`;
+}
+function isRecord(value) {
+  return typeof value === "object" && value !== null;
+}
+function parseAgentTurnSessionCheckpoint(value) {
+  if (typeof value !== "string") {
+    return void 0;
+  }
+  try {
+    const parsed = JSON.parse(value);
+    if (!isRecord(parsed)) {
+      return void 0;
+    }
+    const status = parsed.state;
+    if (status !== "running" && status !== "awaiting_resume" && status !== "completed" && status !== "failed") {
+      return void 0;
+    }
+    const conversationId = parsed.conversationId;
+    const sessionId = parsed.sessionId;
+    const sliceId = parsed.sliceId;
+    const checkpointVersion = parsed.checkpointVersion;
+    const updatedAtMs = parsed.updatedAtMs;
+    if (typeof conversationId !== "string" || typeof sessionId !== "string" || typeof sliceId !== "number" || typeof checkpointVersion !== "number" || typeof updatedAtMs !== "number") {
+      return void 0;
+    }
+    return {
+      checkpointVersion,
+      conversationId,
+      sessionId,
+      sliceId,
+      state: status,
+      updatedAtMs,
+      piMessages: Array.isArray(parsed.piMessages) ? parsed.piMessages : [],
+      ...typeof parsed.errorMessage === "string" ? { errorMessage: parsed.errorMessage } : {},
+      ...typeof parsed.resumedFromSliceId === "number" ? { resumedFromSliceId: parsed.resumedFromSliceId } : {}
+    };
+  } catch {
+    return void 0;
+  }
+}
+function getStateAdapter() {
+  if (!_stateAdapter) {
+    _stateAdapter = createStateAdapter();
+  }
+  return _stateAdapter;
+}
+async function disconnectStateAdapter() {
+  if (!_stateAdapter) {
+    return;
+  }
+  try {
+    await _stateAdapter.disconnect();
+  } finally {
+    _stateAdapter = void 0;
+    _redisStateAdapter = void 0;
+  }
+}
+async function claimQueueIngressDedup(rawKey, ttlMs) {
+  await getStateAdapter().connect();
+  const key = `${QUEUE_INGRESS_DEDUP_PREFIX}:${rawKey}`;
+  const result = await getRedisStateAdapter().getClient().set(key, "1", {
+    NX: true,
+    PX: ttlMs
+  });
+  return result === "OK";
+}
+async function hasQueueIngressDedup(rawKey) {
+  await getStateAdapter().connect();
+  const key = `${QUEUE_INGRESS_DEDUP_PREFIX}:${rawKey}`;
+  const value = await getRedisStateAdapter().getClient().get(key);
+  return typeof value === "string" && value.length > 0;
+}
+async function getQueueMessageProcessingState(rawKey) {
+  await getStateAdapter().connect();
+  const state = await getStateAdapter().get(queueMessageKey(rawKey));
+  return parseQueueMessageState(state);
+}
+async function acquireQueueMessageProcessingOwnership(args) {
+  await getStateAdapter().connect();
+  const key = queueMessageKey(args.rawKey);
+  const nowMs = Date.now();
+  const payload = JSON.stringify({
+    status: "processing",
+    updatedAtMs: nowMs,
+    ownerToken: args.ownerToken,
+    ...args.queueMessageId ? { queueMessageId: args.queueMessageId } : {}
+  });
+  const result = await getRedisStateAdapter().getClient().eval(CLAIM_OR_RECLAIM_PROCESSING_SCRIPT, {
+    keys: [key],
+    arguments: [String(nowMs), String(QUEUE_MESSAGE_PROCESSING_TTL_MS), payload]
+  });
+  if (result === 1) {
+    return "acquired";
+  }
+  if (result === 2) {
+    return "reclaimed";
+  }
+  if (result === 3) {
+    return "recovered";
+  }
+  return "blocked";
+}
+async function refreshQueueMessageProcessingOwnership(args) {
+  await getStateAdapter().connect();
+  const nowMs = Date.now();
+  const payload = JSON.stringify({
+    status: "processing",
+    updatedAtMs: nowMs,
+    ownerToken: args.ownerToken,
+    ...args.queueMessageId ? { queueMessageId: args.queueMessageId } : {}
+  });
+  const result = await getRedisStateAdapter().getClient().eval(UPDATE_PROCESSING_STATE_IF_OWNER_SCRIPT, {
+    keys: [queueMessageKey(args.rawKey)],
+    arguments: [args.ownerToken, String(QUEUE_MESSAGE_PROCESSING_TTL_MS), payload]
+  });
+  return result === 1;
+}
+async function completeQueueMessageProcessingOwnership(args) {
+  await getStateAdapter().connect();
+  const payload = JSON.stringify({
+    status: "completed",
+    updatedAtMs: Date.now(),
+    ownerToken: args.ownerToken,
+    ...args.queueMessageId ? { queueMessageId: args.queueMessageId } : {}
+  });
+  const result = await getRedisStateAdapter().getClient().eval(UPDATE_PROCESSING_STATE_IF_OWNER_SCRIPT, {
+    keys: [queueMessageKey(args.rawKey)],
+    arguments: [args.ownerToken, String(QUEUE_MESSAGE_COMPLETED_TTL_MS), payload]
+  });
+  return result === 1;
+}
+async function failQueueMessageProcessingOwnership(args) {
+  await getStateAdapter().connect();
+  const payload = JSON.stringify({
+    status: "failed",
+    updatedAtMs: Date.now(),
+    ownerToken: args.ownerToken,
+    errorMessage: args.errorMessage,
+    ...args.queueMessageId ? { queueMessageId: args.queueMessageId } : {}
+  });
+  const result = await getRedisStateAdapter().getClient().eval(UPDATE_PROCESSING_STATE_IF_OWNER_SCRIPT, {
+    keys: [queueMessageKey(args.rawKey)],
+    arguments: [args.ownerToken, String(QUEUE_MESSAGE_FAILED_TTL_MS), payload]
+  });
+  return result === 1;
+}
+async function getAgentTurnSessionCheckpoint(conversationId, sessionId) {
+  await getStateAdapter().connect();
+  const value = await getStateAdapter().get(agentTurnSessionKey(conversationId, sessionId));
+  return parseAgentTurnSessionCheckpoint(value);
+}
+async function upsertAgentTurnSessionCheckpoint(args) {
+  await getStateAdapter().connect();
+  const existing = await getAgentTurnSessionCheckpoint(args.conversationId, args.sessionId);
+  const checkpoint = {
+    checkpointVersion: (existing?.checkpointVersion ?? 0) + 1,
+    conversationId: args.conversationId,
+    sessionId: args.sessionId,
+    sliceId: args.sliceId,
+    state: args.state,
+    updatedAtMs: Date.now(),
+    piMessages: Array.isArray(args.piMessages) ? args.piMessages : [],
+    ...args.errorMessage ? { errorMessage: args.errorMessage } : {},
+    ...typeof args.resumedFromSliceId === "number" ? { resumedFromSliceId: args.resumedFromSliceId } : {}
+  };
+  const ttlMs = Math.max(1, args.ttlMs ?? AGENT_TURN_SESSION_TTL_MS);
+  await getStateAdapter().set(agentTurnSessionKey(args.conversationId, args.sessionId), JSON.stringify(checkpoint), ttlMs);
+  return checkpoint;
+}
+
+// src/chat/sandbox/runtime-dependency-snapshots.ts
+import { createHash } from "crypto";
+import { Sandbox } from "@vercel/sandbox";
+
+// src/chat/plugins/registry.ts
+import { readFileSync, readdirSync, statSync } from "fs";
+import path2 from "path";
+import { parse as parseYaml } from "yaml";
+
+// src/chat/home.ts
+import fs from "fs";
+import path from "path";
+function homeDir() {
+  return resolveHomeDir();
+}
+function unique(values) {
+  return [...new Set(values)];
+}
+function pathExists(targetPath) {
+  try {
+    fs.accessSync(targetPath);
+    return true;
+  } catch {
+    return false;
+  }
+}
+function hasAnyDataMarkers(appDir) {
+  return pathExists(path.join(appDir, "SOUL.md"));
+}
+function scoreAppCandidate(appDir) {
+  let score = 0;
+  if (pathExists(path.join(appDir, "SOUL.md"))) {
+    score += 4;
+  }
+  if (pathExists(path.join(appDir, "ABOUT.md"))) {
+    score += 2;
+  }
+  if (pathExists(path.join(appDir, "skills"))) {
+    score += 1;
+  }
+  if (pathExists(path.join(appDir, "plugins"))) {
+    score += 1;
+  }
+  return score;
+}
+function resolveCandidateAppDirs(cwd, projectRoots) {
+  const roots = projectRoots ?? discoverProjectRoots(cwd);
+  const resolved = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const root of roots) {
+    const appDir = path.resolve(root, "app");
+    if (!pathExists(appDir)) {
+      continue;
+    }
+    if (seen.has(appDir)) {
+      continue;
+    }
+    seen.add(appDir);
+    resolved.push(appDir);
+  }
+  return resolved;
+}
+function resolveHomeDir(cwd = process.cwd(), options) {
+  const resolvedCwd = path.resolve(cwd);
+  const directApp = path.resolve(resolvedCwd, "app");
+  if (pathExists(directApp) && hasAnyDataMarkers(directApp)) {
+    return directApp;
+  }
+  const candidates = resolveCandidateAppDirs(resolvedCwd, options?.projectRoots);
+  if (candidates.length === 0) {
+    return directApp;
+  }
+  candidates.sort((left, right) => {
+    const leftScore = scoreAppCandidate(left);
+    const rightScore = scoreAppCandidate(right);
+    if (leftScore !== rightScore) {
+      return rightScore - leftScore;
+    }
+    const leftDistance = path.relative(resolvedCwd, left).split(path.sep).length;
+    const rightDistance = path.relative(resolvedCwd, right).split(path.sep).length;
+    if (leftDistance !== rightDistance) {
+      return leftDistance - rightDistance;
+    }
+    return left.localeCompare(right);
+  });
+  return candidates[0];
+}
+function resolveContentRoots(subdir) {
+  if (subdir === "data") {
+    return [homeDir()];
+  }
+  if (subdir === "skills") {
+    return [path.join(homeDir(), "skills"), path.resolve(process.cwd(), "skills")];
+  }
+  return [path.join(homeDir(), "plugins")];
+}
+function dataRoots() {
+  return unique(resolveContentRoots("data"));
+}
+function skillRoots() {
+  return unique(resolveContentRoots("skills"));
+}
+function pluginRoots() {
+  return unique(resolveContentRoots("plugins"));
+}
+function soulPathCandidates() {
+  const candidates = dataRoots().map((root) => path.join(root, "SOUL.md"));
+  return unique(candidates);
+}
+
+// src/chat/plugins/github-app-broker.ts
+import { createPrivateKey, createSign, randomUUID } from "crypto";
+
+// src/chat/plugins/auth-token-placeholder.ts
+var DEFAULT_PLACEHOLDERS = {
+  "oauth-bearer": "host_managed_credential",
+  "github-app": "ghp_host_managed_credential"
+};
+function resolveAuthTokenPlaceholder(credentials) {
+  return credentials.authTokenPlaceholder?.trim() || DEFAULT_PLACEHOLDERS[credentials.type];
+}
+
+// src/chat/plugins/github-app-broker.ts
+var MAX_LEASE_MS = 60 * 60 * 1e3;
+function normalizeTargetScope(target) {
+  const owner = target?.owner?.trim().toLowerCase();
+  const repo = target?.repo?.trim().toLowerCase();
+  if (!owner || !repo) {
+    return "all";
+  }
+  return `${owner}/${repo}`;
+}
+function base64Url(input) {
+  return Buffer.from(input).toString("base64").replace(/=/g, "").replace(/\+/g, "-").replace(/\//g, "_");
+}
+function normalizePrivateKey(raw) {
+  let normalized = raw.trim();
+  if (normalized.startsWith('"') && normalized.endsWith('"') || normalized.startsWith("'") && normalized.endsWith("'")) {
+    normalized = normalized.slice(1, -1);
+  }
+  normalized = normalized.replace(/\r\n/g, "\n");
+  if (normalized.includes("\\n")) {
+    normalized = normalized.replace(/\\n/g, "\n");
+  }
+  if (!normalized.includes("-----BEGIN")) {
+    try {
+      const decoded = Buffer.from(normalized, "base64").toString("utf8").trim();
+      if (decoded.includes("-----BEGIN")) {
+        normalized = decoded;
+      }
+    } catch {
+    }
+  }
+  return normalized;
+}
+function getPrivateKey(envName) {
+  const raw = process.env[envName];
+  if (!raw) {
+    throw new Error(`Missing ${envName}`);
+  }
+  const normalized = normalizePrivateKey(raw);
+  let key;
+  try {
+    key = createPrivateKey({ key: normalized, format: "pem" });
+  } catch {
+    throw new Error(
+      `Invalid ${envName}: expected a PEM-encoded RSA private key (raw PEM, escaped newlines, or base64-encoded PEM)`
+    );
+  }
+  if (key.asymmetricKeyType !== "rsa") {
+    throw new Error(`Invalid ${envName}: GitHub App signing requires an RSA private key`);
+  }
+  return key;
+}
+function createAppJwt(appId, privateKeyEnv) {
+  const now = Math.floor(Date.now() / 1e3);
+  const header = { alg: "RS256", typ: "JWT" };
+  const payload = { iat: now - 60, exp: now + 9 * 60, iss: appId };
+  const encodedHeader = base64Url(JSON.stringify(header));
+  const encodedPayload = base64Url(JSON.stringify(payload));
+  const signingInput = `${encodedHeader}.${encodedPayload}`;
+  const signer = createSign("RSA-SHA256");
+  signer.update(signingInput);
+  signer.end();
+  const signature = signer.sign(getPrivateKey(privateKeyEnv)).toString("base64").replace(/=/g, "").replace(/\+/g, "-").replace(/\//g, "_");
+  return `${signingInput}.${signature}`;
+}
+async function githubRequest(apiBase, path3, params) {
+  const response = await fetch(`${apiBase}${path3}`, {
+    method: params.method ?? "GET",
+    headers: {
+      Accept: "application/vnd.github+json",
+      Authorization: `Bearer ${params.token}`,
+      "X-GitHub-Api-Version": "2022-11-28",
+      ...params.body ? { "Content-Type": "application/json" } : {}
+    },
+    ...params.body ? { body: JSON.stringify(params.body) } : {}
+  });
+  const text = await response.text();
+  let parsed = void 0;
+  if (text) {
+    try {
+      parsed = JSON.parse(text);
+    } catch {
+      parsed = void 0;
+    }
+  }
+  if (!response.ok) {
+    const message = parsed && typeof parsed === "object" && "message" in parsed && typeof parsed.message === "string" ? parsed.message : `GitHub API error ${response.status}`;
+    throw new Error(message);
+  }
+  return parsed;
+}
+function capabilityToPermissions(capability, pluginName) {
+  if (capability === `${pluginName}.issues.read`) {
+    return { issues: "read" };
+  }
+  if (capability === `${pluginName}.issues.write` || capability === `${pluginName}.issues.comment` || capability === `${pluginName}.labels.write`) {
+    return { issues: "write" };
+  }
+  throw new Error(`Unsupported GitHub capability: ${capability}`);
+}
+function createGitHubAppBroker(manifest, credentials) {
+  const tokenCache = /* @__PURE__ */ new Map();
+  const provider = manifest.name;
+  const { apiDomains, authTokenEnv, appIdEnv, privateKeyEnv, installationIdEnv } = credentials;
+  const apiBase = `https://${apiDomains[0]}`;
+  const placeholder = resolveAuthTokenPlaceholder(credentials);
+  return {
+    async issue(input) {
+      const permissions = capabilityToPermissions(input.capability, provider);
+      const appId = process.env[appIdEnv];
+      if (!appId) {
+        throw new Error(`Missing ${appIdEnv}`);
+      }
+      const installationIdRaw = process.env[installationIdEnv]?.trim();
+      if (!installationIdRaw) {
+        throw new Error(`Missing ${installationIdEnv}`);
+      }
+      const installationId = Number(installationIdRaw);
+      if (!Number.isFinite(installationId)) {
+        throw new Error(`Invalid ${installationIdEnv}`);
+      }
+      const targetScope = normalizeTargetScope(input.target);
+      const cacheKey = `${installationId}:${input.capability}:${targetScope}`;
+      const cached = tokenCache.get(cacheKey);
+      const now = Date.now();
+      if (cached && cached.expiresAt - now > 2 * 60 * 1e3) {
+        return {
+          id: randomUUID(),
+          provider,
+          capability: input.capability,
+          env: { [authTokenEnv]: placeholder },
+          headerTransforms: apiDomains.map((domain) => ({
+            domain,
+            headers: {
+              Authorization: `Bearer ${cached.token}`
+            }
+          })),
+          expiresAt: new Date(cached.expiresAt).toISOString(),
+          metadata: {
+            installationId: String(cached.installationId),
+            targetScope,
+            reason: input.reason
+          }
+        };
+      }
+      const appJwt = createAppJwt(appId, privateKeyEnv);
+      const repositoryName = input.target?.repo?.trim().toLowerCase();
+      const tokenRequestBody = {
+        permissions
+      };
+      if (repositoryName) {
+        tokenRequestBody.repositories = [repositoryName];
+      }
+      const accessTokenResponse = await githubRequest(
+        apiBase,
+        `/app/installations/${installationId}/access_tokens`,
+        {
+          method: "POST",
+          token: appJwt,
+          body: tokenRequestBody
+        }
+      );
+      const providerExpiresAtMs = Date.parse(accessTokenResponse.expires_at);
+      const expiresAtMs = Math.min(providerExpiresAtMs, Date.now() + MAX_LEASE_MS);
+      tokenCache.set(cacheKey, {
+        installationId,
+        token: accessTokenResponse.token,
+        expiresAt: expiresAtMs
+      });
+      return {
+        id: randomUUID(),
+        provider,
+        capability: input.capability,
+        env: { [authTokenEnv]: placeholder },
+        headerTransforms: apiDomains.map((domain) => ({
+          domain,
+          headers: {
+            Authorization: `Bearer ${accessTokenResponse.token}`
+          }
+        })),
+        expiresAt: new Date(expiresAtMs).toISOString(),
+        metadata: {
+          installationId: String(installationId),
+          targetScope,
+          reason: input.reason
+        }
+      };
+    }
+  };
+}
+
+// src/chat/plugins/oauth-bearer-broker.ts
+import { randomUUID as randomUUID2 } from "crypto";
+
+// src/chat/credentials/broker.ts
+var CredentialUnavailableError = class extends Error {
+  provider;
+  constructor(provider, message) {
+    super(message);
+    this.name = "CredentialUnavailableError";
+    this.provider = provider;
+  }
+};
+
+// src/chat/plugins/oauth-bearer-broker.ts
+var MAX_LEASE_MS2 = 60 * 60 * 1e3;
+var REFRESH_BUFFER_MS = 5 * 60 * 1e3;
+async function refreshAccessToken(refreshToken, oauth) {
+  const clientId = process.env[oauth.clientIdEnv]?.trim();
+  const clientSecret = process.env[oauth.clientSecretEnv]?.trim();
+  if (!clientId || !clientSecret) {
+    throw new Error(`Missing ${oauth.clientIdEnv} or ${oauth.clientSecretEnv} for token refresh`);
+  }
+  const response = await fetch(oauth.tokenEndpoint, {
+    method: "POST",
+    headers: { "Content-Type": "application/x-www-form-urlencoded" },
+    body: new URLSearchParams({
+      grant_type: "refresh_token",
+      refresh_token: refreshToken,
+      client_id: clientId,
+      client_secret: clientSecret
+    })
+  });
+  if (!response.ok) {
+    throw new Error(`Token refresh failed: ${response.status}`);
+  }
+  const data = await response.json();
+  if (!data.access_token || !data.refresh_token || typeof data.expires_in !== "number") {
+    throw new Error("Token refresh returned malformed response");
+  }
+  return {
+    accessToken: data.access_token,
+    refreshToken: data.refresh_token,
+    expiresIn: data.expires_in
+  };
+}
+function createOAuthBearerBroker(manifest, credentials, deps) {
+  const provider = manifest.name;
+  const supportedCapabilities = new Set(manifest.capabilities);
+  const { apiDomains, authTokenEnv } = credentials;
+  const authTokenPlaceholder = resolveAuthTokenPlaceholder(credentials);
+  function buildLease(token, capability, expiresAtMs, reason) {
+    return {
+      id: randomUUID2(),
+      provider,
+      capability,
+      env: { [authTokenEnv]: authTokenPlaceholder },
+      headerTransforms: apiDomains.map((domain) => ({
+        domain,
+        headers: { Authorization: `Bearer ${token}` }
+      })),
+      expiresAt: new Date(expiresAtMs).toISOString(),
+      metadata: { reason }
+    };
+  }
+  return {
+    async issue(input) {
+      if (!supportedCapabilities.has(input.capability)) {
+        throw new Error(`Unsupported ${provider} capability: ${input.capability}`);
+      }
+      if (input.requesterId && deps.userTokenStore) {
+        const stored = await deps.userTokenStore.get(input.requesterId, provider);
+        if (stored) {
+          const now = Date.now();
+          if (stored.expiresAt - now < REFRESH_BUFFER_MS && stored.refreshToken && manifest.oauth) {
+            try {
+              const refreshed = await refreshAccessToken(stored.refreshToken, manifest.oauth);
+              const expiresAt = Date.now() + refreshed.expiresIn * 1e3;
+              await deps.userTokenStore.set(input.requesterId, provider, {
+                accessToken: refreshed.accessToken,
+                refreshToken: refreshed.refreshToken,
+                expiresAt
+              });
+              const leaseExpiry = Math.min(expiresAt, Date.now() + MAX_LEASE_MS2);
+              return buildLease(refreshed.accessToken, input.capability, leaseExpiry, input.reason);
+            } catch {
+              if (stored.expiresAt > Date.now()) {
+                const leaseExpiry = Math.min(stored.expiresAt, Date.now() + MAX_LEASE_MS2);
+                return buildLease(stored.accessToken, input.capability, leaseExpiry, input.reason);
+              }
+              throw new CredentialUnavailableError(
+                provider,
+                `Your ${provider} connection has expired.`
+              );
+            }
+          }
+          if (stored.expiresAt > Date.now()) {
+            const leaseExpiry = Math.min(stored.expiresAt, Date.now() + MAX_LEASE_MS2);
+            return buildLease(stored.accessToken, input.capability, leaseExpiry, input.reason);
+          }
+          throw new CredentialUnavailableError(
+            provider,
+            `Your ${provider} connection has expired.`
+          );
+        }
+        throw new CredentialUnavailableError(
+          provider,
+          `No ${provider} credentials available.`
+        );
+      }
+      const envToken = process.env[authTokenEnv]?.trim();
+      if (envToken) {
+        const expiresAtMs = Date.now() + MAX_LEASE_MS2;
+        return buildLease(envToken, input.capability, expiresAtMs, input.reason);
+      }
+      throw new CredentialUnavailableError(
+        provider,
+        `No ${provider} credentials available.`
+      );
+    }
+  };
+}
+
+// src/chat/plugins/registry.ts
+var PLUGIN_NAME_RE = /^[a-z][a-z0-9-]*$/;
+var SHORT_CAPABILITY_RE = /^[a-z0-9]+(\.[a-z0-9-]+)*$/;
+var SHORT_CONFIG_KEY_RE = /^[a-z0-9]+(\.[a-z0-9-]+)*$/;
+var AUTH_TOKEN_ENV_RE = /^[A-Z][A-Z0-9_]*$/;
+var API_DOMAIN_RE = /^(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/;
+var RUNTIME_POSTINSTALL_CMD_RE = /^[A-Za-z0-9._/-]+$/;
+function toRecord(value, errorMessage) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) {
+    throw new Error(errorMessage);
+  }
+  return value;
+}
+function requireStringField(record, field, errorMessage) {
+  const value = record[field];
+  if (typeof value !== "string" || !value.trim()) {
+    throw new Error(errorMessage);
+  }
+  return value.trim();
+}
+function requireEnvVarField(record, field, pluginName) {
+  const value = requireStringField(record, field, `Plugin ${pluginName} ${field} must be a non-empty string`);
+  if (!AUTH_TOKEN_ENV_RE.test(value)) {
+    throw new Error(`Plugin ${pluginName} ${field} must be an uppercase env var name`);
+  }
+  return value;
+}
+function requireHttpsUrlField(record, field, pluginName) {
+  const value = requireStringField(record, field, `Plugin ${pluginName} oauth.${field} must be a non-empty string`);
+  let parsed;
+  try {
+    parsed = new URL(value);
+  } catch {
+    throw new Error(`Plugin ${pluginName} oauth.${field} must be a valid URL`);
+  }
+  if (parsed.protocol !== "https:") {
+    throw new Error(`Plugin ${pluginName} oauth.${field} must use https`);
+  }
+  return value;
+}
+function normalizeApiDomain(rawDomain, name) {
+  const domain = typeof rawDomain === "string" ? rawDomain.trim().toLowerCase() : "";
+  if (!domain) {
+    throw new Error(`Plugin ${name} credentials.api-domains entries must be non-empty strings`);
+  }
+  if (!API_DOMAIN_RE.test(domain)) {
+    throw new Error(`Plugin ${name} credentials.api-domains entries must be valid domain names`);
+  }
+  return domain;
+}
+function parseBaseCredentialFields(data, name) {
+  const rawDomains = data["api-domains"];
+  if (!Array.isArray(rawDomains) || rawDomains.length === 0) {
+    throw new Error(`Plugin ${name} credentials.api-domains must be a non-empty array of strings`);
+  }
+  const apiDomains = rawDomains.map((rawDomain) => normalizeApiDomain(rawDomain, name));
+  const authTokenEnv = requireEnvVarField(data, "auth-token-env", name);
+  const authTokenPlaceholderRaw = data["auth-token-placeholder"];
+  if (authTokenPlaceholderRaw !== void 0 && (typeof authTokenPlaceholderRaw !== "string" || !authTokenPlaceholderRaw.trim())) {
+    throw new Error(`Plugin ${name} credentials.auth-token-placeholder must be a non-empty string when provided`);
+  }
+  return {
+    apiDomains,
+    authTokenEnv,
+    ...typeof authTokenPlaceholderRaw === "string" ? { authTokenPlaceholder: authTokenPlaceholderRaw.trim() } : {}
+  };
+}
+function parseCredentials(data, name) {
+  const type = data.type;
+  if (type === "oauth-bearer") {
+    const base = parseBaseCredentialFields(data, name);
+    return { type: "oauth-bearer", ...base };
+  }
+  if (type === "github-app") {
+    const base = parseBaseCredentialFields(data, name);
+    const appIdEnv = requireEnvVarField(data, "app-id-env", name);
+    const privateKeyEnv = requireEnvVarField(data, "private-key-env", name);
+    const installationIdEnv = requireEnvVarField(data, "installation-id-env", name);
+    return { type: "github-app", ...base, appIdEnv, privateKeyEnv, installationIdEnv };
+  }
+  throw new Error(`Plugin ${name} has unsupported credentials.type: "${type}"`);
+}
+function parseRuntimeDependencies(data, name) {
+  if (data === void 0) {
+    return void 0;
+  }
+  if (!Array.isArray(data)) {
+    throw new Error(`Plugin ${name} runtime-dependencies must be an array`);
+  }
+  const parsed = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const entry of data) {
+    if (!entry || typeof entry !== "object" || Array.isArray(entry)) {
+      throw new Error(`Plugin ${name} runtime-dependencies entries must be objects`);
+    }
+    const record = entry;
+    const type = record.type;
+    const packageName = record.package;
+    const packageUrl = record.url;
+    const version = record.version;
+    const sha256 = record.sha256;
+    if (typeof type !== "string" || type !== "npm" && type !== "system") {
+      throw new Error(`Plugin ${name} runtime dependency type must be "npm" or "system"`);
+    }
+    const normalizedPackage = typeof packageName === "string" ? packageName.trim() : "";
+    const normalizedUrl = typeof packageUrl === "string" ? packageUrl.trim() : "";
+    if (type === "npm") {
+      if (!normalizedPackage) {
+        throw new Error(`Plugin ${name} runtime dependency package must be a non-empty string`);
+      }
+      if (packageUrl !== void 0 || sha256 !== void 0) {
+        throw new Error(`Plugin ${name} npm runtime dependencies must only include package/version fields`);
+      }
+      const normalizedVersion = typeof version === "string" ? version.trim() : "latest";
+      if (!normalizedVersion) {
+        throw new Error(`Plugin ${name} runtime dependency version must be a non-empty string when provided`);
+      }
+      const dedupeKey2 = `${type}:${normalizedPackage}:${normalizedVersion}`;
+      if (seen.has(dedupeKey2)) {
+        continue;
+      }
+      seen.add(dedupeKey2);
+      parsed.push({
+        type: "npm",
+        package: normalizedPackage,
+        version: normalizedVersion
+      });
+      continue;
+    }
+    if (version !== void 0) {
+      throw new Error(`Plugin ${name} system runtime dependencies must not include a version`);
+    }
+    if (normalizedPackage && normalizedUrl) {
+      throw new Error(`Plugin ${name} system runtime dependencies must specify either package or url, not both`);
+    }
+    if (!normalizedPackage && !normalizedUrl) {
+      throw new Error(`Plugin ${name} system runtime dependencies must specify package or url`);
+    }
+    if (normalizedPackage) {
+      if (sha256 !== void 0) {
+        throw new Error(`Plugin ${name} system runtime dependency package entries must not include sha256`);
+      }
+      const dedupeKey2 = `${type}:package:${normalizedPackage}`;
+      if (seen.has(dedupeKey2)) {
+        continue;
+      }
+      seen.add(dedupeKey2);
+      parsed.push({
+        type: "system",
+        package: normalizedPackage
+      });
+      continue;
+    }
+    if (!/^https:\/\//i.test(normalizedUrl)) {
+      throw new Error(`Plugin ${name} system runtime dependency url must be an https URL`);
+    }
+    const normalizedSha256 = typeof sha256 === "string" ? sha256.trim().toLowerCase() : "";
+    if (!/^[a-f0-9]{64}$/.test(normalizedSha256)) {
+      throw new Error(`Plugin ${name} system runtime dependency url entries must include a valid sha256`);
+    }
+    const dedupeKey = `${type}:url:${normalizedUrl}:${normalizedSha256}`;
+    if (seen.has(dedupeKey)) {
+      continue;
+    }
+    seen.add(dedupeKey);
+    parsed.push({
+      type: "system",
+      url: normalizedUrl,
+      sha256: normalizedSha256
+    });
+  }
+  return parsed.length > 0 ? parsed : void 0;
+}
+function parseRuntimePostinstall(data, name) {
+  if (data === void 0) {
+    return void 0;
+  }
+  if (!Array.isArray(data)) {
+    throw new Error(`Plugin ${name} runtime-postinstall must be an array`);
+  }
+  const parsed = [];
+  for (const entry of data) {
+    if (!entry || typeof entry !== "object" || Array.isArray(entry)) {
+      throw new Error(`Plugin ${name} runtime-postinstall entries must be objects`);
+    }
+    const record = entry;
+    const cmd = typeof record.cmd === "string" ? record.cmd.trim() : "";
+    if (!cmd) {
+      throw new Error(`Plugin ${name} runtime-postinstall cmd must be a non-empty string`);
+    }
+    if (!RUNTIME_POSTINSTALL_CMD_RE.test(cmd)) {
+      throw new Error(
+        `Plugin ${name} runtime-postinstall cmd must be a single executable token (letters, digits, ., _, /, -)`
+      );
+    }
+    const argsRaw = record.args;
+    if (argsRaw !== void 0 && (!Array.isArray(argsRaw) || !argsRaw.every((arg) => typeof arg === "string"))) {
+      throw new Error(`Plugin ${name} runtime-postinstall args must be an array of strings when provided`);
+    }
+    const sudoRaw = record.sudo;
+    if (sudoRaw !== void 0 && typeof sudoRaw !== "boolean") {
+      throw new Error(`Plugin ${name} runtime-postinstall sudo must be a boolean when provided`);
+    }
+    const normalizedArgs = Array.isArray(argsRaw) ? argsRaw.map((arg) => arg.trim()).filter((arg) => arg.length > 0) : void 0;
+    parsed.push({
+      cmd,
+      ...normalizedArgs && normalizedArgs.length > 0 ? { args: normalizedArgs } : {},
+      ...typeof sudoRaw === "boolean" ? { sudo: sudoRaw } : {}
+    });
+  }
+  return parsed.length > 0 ? parsed : void 0;
+}
+function parseManifest(raw, dir) {
+  const data = toRecord(parseYaml(raw), `Invalid plugin manifest in ${dir}: expected an object`);
+  const rawName = data.name;
+  if (typeof rawName !== "string" || !PLUGIN_NAME_RE.test(rawName)) {
+    throw new Error(`Invalid plugin name in ${dir}: "${rawName}"`);
+  }
+  const name = rawName;
+  const rawDescription = data.description;
+  if (typeof rawDescription !== "string" || !rawDescription.trim()) {
+    throw new Error(`Invalid plugin description in ${dir}`);
+  }
+  const description = rawDescription;
+  const rawCapabilities = data.capabilities;
+  if (rawCapabilities !== void 0 && !Array.isArray(rawCapabilities)) {
+    throw new Error(`Plugin ${name} capabilities must be an array when provided`);
+  }
+  const capabilities = [];
+  for (const cap of rawCapabilities ?? []) {
+    if (typeof cap !== "string" || !SHORT_CAPABILITY_RE.test(cap)) {
+      throw new Error(`Invalid capability token "${cap}" in plugin ${name}`);
+    }
+    capabilities.push(`${name}.${cap}`);
+  }
+  const rawConfigKeys = data["config-keys"];
+  if (rawConfigKeys !== void 0 && !Array.isArray(rawConfigKeys)) {
+    throw new Error(`Plugin ${name} config-keys must be an array when provided`);
+  }
+  const configKeys = [];
+  for (const key of rawConfigKeys ?? []) {
+    if (typeof key !== "string" || !SHORT_CONFIG_KEY_RE.test(key)) {
+      throw new Error(`Invalid config key "${key}" in plugin ${name}`);
+    }
+    configKeys.push(`${name}.${key}`);
+  }
+  const credentialsRaw = data.credentials;
+  if (credentialsRaw !== void 0) {
+    toRecord(credentialsRaw, `Plugin ${name} credentials must be an object when provided`);
+  }
+  const credentials = credentialsRaw ? parseCredentials(credentialsRaw, name) : void 0;
+  const runtimeDependencies = parseRuntimeDependencies(data["runtime-dependencies"], name);
+  const runtimePostinstall = parseRuntimePostinstall(data["runtime-postinstall"], name);
+  const manifest = {
+    name,
+    description,
+    capabilities,
+    configKeys,
+    ...credentials ? { credentials } : {},
+    ...runtimeDependencies ? { runtimeDependencies } : {},
+    ...runtimePostinstall ? { runtimePostinstall } : {}
+  };
+  const oauthRaw = data.oauth ? toRecord(data.oauth, `Plugin ${name} oauth must be an object`) : void 0;
+  if (oauthRaw) {
+    if (!credentials) {
+      throw new Error(`Plugin ${name} oauth requires credentials`);
+    }
+    if (credentials.type !== "oauth-bearer") {
+      throw new Error(`Plugin ${name} oauth requires credentials.type "oauth-bearer"`);
+    }
+    manifest.oauth = {
+      clientIdEnv: requireEnvVarField(oauthRaw, "client-id-env", name),
+      clientSecretEnv: requireEnvVarField(oauthRaw, "client-secret-env", name),
+      authorizeEndpoint: requireHttpsUrlField(oauthRaw, "authorize-endpoint", name),
+      tokenEndpoint: requireHttpsUrlField(oauthRaw, "token-endpoint", name),
+      scope: requireStringField(oauthRaw, "scope", `Plugin ${name} oauth.scope must be a non-empty string`)
+    };
+  }
+  const targetRaw = data.target ? toRecord(data.target, `Plugin ${name} target must be an object`) : void 0;
+  if (targetRaw) {
+    if (targetRaw.type !== "repo") {
+      throw new Error(`Plugin ${name} target.type must be "repo"`);
+    }
+    const rawConfigKey = targetRaw["config-key"];
+    if (typeof rawConfigKey !== "string" || !rawConfigKey.trim()) {
+      throw new Error(`Plugin ${name} target.config-key must be a non-empty string`);
+    }
+    if (!SHORT_CONFIG_KEY_RE.test(rawConfigKey)) {
+      throw new Error(`Plugin ${name} target.config-key "${rawConfigKey}" is invalid`);
+    }
+    const qualifiedKey = `${name}.${rawConfigKey}`;
+    if (!configKeys.includes(qualifiedKey)) {
+      throw new Error(`Plugin ${name} target.config-key "${rawConfigKey}" must be listed in config-keys`);
+    }
+    manifest.target = { type: "repo", configKey: qualifiedKey };
+  }
+  return manifest;
+}
+var pluginDefinitions = [];
+var capabilityToPlugin = /* @__PURE__ */ new Map();
+var pluginConfigKeys = /* @__PURE__ */ new Set();
+var pluginsByName = /* @__PURE__ */ new Map();
+var packageSkillRoots = /* @__PURE__ */ new Set();
+var pluginsLoaded = false;
+function registerPluginManifest(raw, pluginDir) {
+  const manifest = parseManifest(raw, pluginDir);
+  if (pluginsByName.has(manifest.name)) {
+    return;
+  }
+  for (const cap of manifest.capabilities) {
+    if (capabilityToPlugin.has(cap)) {
+      throw new Error(`Duplicate capability "${cap}" in plugin "${manifest.name}"`);
+    }
+  }
+  const definition = {
+    manifest,
+    dir: pluginDir,
+    skillsDir: path2.join(pluginDir, "skills")
+  };
+  pluginDefinitions.push(definition);
+  pluginsByName.set(manifest.name, definition);
+  for (const cap of manifest.capabilities) {
+    capabilityToPlugin.set(cap, definition);
+  }
+  for (const key of manifest.configKeys) {
+    pluginConfigKeys.add(key);
+  }
+}
+function loadPlugins() {
+  if (pluginsLoaded) return;
+  pluginsLoaded = true;
+  const packagedContent = discoverInstalledPluginPackageContent();
+  const localRoots = pluginRoots();
+  const roots = [...localRoots, ...packagedContent.manifestRoots];
+  for (const pluginsRoot of roots) {
+    let entries;
+    let rootStat;
+    try {
+      rootStat = statSync(pluginsRoot);
+    } catch (error) {
+      logWarn("plugin_root_read_failed", {}, {
+        "file.directory": pluginsRoot,
+        "error.message": error instanceof Error ? error.message : String(error)
+      }, "Failed to read plugin root");
+      continue;
+    }
+    if (rootStat.isDirectory()) {
+      const manifestPath = path2.join(pluginsRoot, "plugin.yaml");
+      let hasRootManifest = false;
+      try {
+        hasRootManifest = statSync(manifestPath).isFile();
+      } catch {
+        hasRootManifest = false;
+      }
+      if (hasRootManifest) {
+        const rawRootManifest = readFileSync(manifestPath, "utf8");
+        registerPluginManifest(rawRootManifest, pluginsRoot);
+        continue;
+      }
+    }
+    try {
+      entries = readdirSync(pluginsRoot);
+    } catch (error) {
+      logWarn("plugin_root_read_failed", {}, {
+        "file.directory": pluginsRoot,
+        "error.message": error instanceof Error ? error.message : String(error)
+      }, "Failed to read plugin root");
+      continue;
+    }
+    for (const entry of entries.sort()) {
+      const pluginDir = path2.join(pluginsRoot, entry);
+      try {
+        const stat = statSync(pluginDir);
+        if (!stat.isDirectory()) continue;
+      } catch {
+        continue;
+      }
+      const manifestPath = path2.join(pluginDir, "plugin.yaml");
+      let raw;
+      try {
+        raw = readFileSync(manifestPath, "utf8");
+      } catch {
+        continue;
+      }
+      registerPluginManifest(raw, pluginDir);
+    }
+  }
+  for (const skillRoot of packagedContent.skillRoots) {
+    packageSkillRoots.add(skillRoot);
+  }
+  logInfo(
+    "plugins_loaded",
+    {},
+    {
+      "file.directories": [...localRoots, ...packagedContent.manifestRoots],
+      "app.plugin.count": pluginDefinitions.length,
+      "app.plugin.names": pluginDefinitions.map((plugin) => plugin.manifest.name).sort(),
+      "app.plugin.package_skill_roots": [...packageSkillRoots].sort()
+    },
+    "Loaded plugins"
+  );
+}
+loadPlugins();
+function getPluginCapabilityProviders() {
+  return pluginDefinitions.map((plugin) => ({
+    provider: plugin.manifest.name,
+    capabilities: [...plugin.manifest.capabilities],
+    configKeys: [...plugin.manifest.configKeys],
+    ...plugin.manifest.target ? { target: { ...plugin.manifest.target } } : {}
+  }));
+}
+function getPluginProviders() {
+  return [...pluginDefinitions];
+}
+function getPluginRuntimeDependencies() {
+  const seen = /* @__PURE__ */ new Set();
+  const deps = [];
+  for (const plugin of pluginDefinitions) {
+    for (const dep of plugin.manifest.runtimeDependencies ?? []) {
+      const key = dep.type === "npm" ? `${dep.type}:${dep.package}:${dep.version}` : "package" in dep ? `${dep.type}:package:${dep.package}` : `${dep.type}:url:${dep.url}:${dep.sha256}`;
+      if (seen.has(key)) {
+        continue;
+      }
+      seen.add(key);
+      deps.push(dep);
+    }
+  }
+  return deps.sort((left, right) => {
+    if (left.type !== right.type) {
+      return left.type.localeCompare(right.type);
+    }
+    const leftIdentity = "package" in left ? `package:${left.package}` : `url:${left.url}:${left.sha256}`;
+    const rightIdentity = "package" in right ? `package:${right.package}` : `url:${right.url}:${right.sha256}`;
+    if (leftIdentity !== rightIdentity) {
+      return leftIdentity.localeCompare(rightIdentity);
+    }
+    if (left.type === "npm" && right.type === "npm") {
+      return left.version.localeCompare(right.version);
+    }
+    return 0;
+  });
+}
+function getPluginRuntimePostinstall() {
+  const commands = [];
+  for (const plugin of pluginDefinitions) {
+    for (const command of plugin.manifest.runtimePostinstall ?? []) {
+      commands.push({
+        cmd: command.cmd,
+        ...command.args ? { args: [...command.args] } : {},
+        ...command.sudo !== void 0 ? { sudo: command.sudo } : {}
+      });
+    }
+  }
+  return commands;
+}
+function getPluginOAuthConfig(provider) {
+  const plugin = pluginsByName.get(provider);
+  if (!plugin?.manifest.oauth) return void 0;
+  const oauth = plugin.manifest.oauth;
+  return {
+    clientIdEnv: oauth.clientIdEnv,
+    clientSecretEnv: oauth.clientSecretEnv,
+    authorizeEndpoint: oauth.authorizeEndpoint,
+    tokenEndpoint: oauth.tokenEndpoint,
+    scope: oauth.scope,
+    callbackPath: `/api/oauth/callback/${plugin.manifest.name}`
+  };
+}
+function getPluginSkillRoots() {
+  return [.../* @__PURE__ */ new Set([...pluginDefinitions.map((plugin) => plugin.skillsDir), ...packageSkillRoots])];
+}
+function isPluginProvider(provider) {
+  return pluginsByName.has(provider);
+}
+function createPluginBroker(provider, deps) {
+  const plugin = pluginsByName.get(provider);
+  if (!plugin) {
+    throw new Error(`Unknown plugin provider: "${provider}"`);
+  }
+  const { credentials, name } = plugin.manifest;
+  if (!credentials) {
+    throw new Error(`Provider "${name}" has no credentials configured`);
+  }
+  let broker;
+  if (credentials.type === "oauth-bearer") {
+    broker = createOAuthBearerBroker(plugin.manifest, credentials, deps);
+  } else if (credentials.type === "github-app") {
+    broker = createGitHubAppBroker(plugin.manifest, credentials);
+  } else {
+    throw new Error(`Unsupported credentials type for plugin "${name}"`);
+  }
+  setSpanAttributes({
+    "app.plugin.name": name,
+    "app.plugin.capabilities": plugin.manifest.capabilities,
+    "app.plugin.has_oauth": Boolean(plugin.manifest.oauth)
+  });
+  return broker;
+}
+
+// src/chat/sandbox/paths.ts
+function normalizeWorkspaceRoot(input) {
+  const candidate = (input ?? "").trim();
+  if (!candidate) {
+    return "/vercel/sandbox";
+  }
+  const normalized = candidate.replace(/\/+$/, "");
+  return normalized.startsWith("/") ? normalized : `/${normalized}`;
+}
+var SANDBOX_WORKSPACE_ROOT = normalizeWorkspaceRoot(process.env.VERCEL_SANDBOX_WORKSPACE_DIR);
+var SANDBOX_SKILLS_ROOT = `${SANDBOX_WORKSPACE_ROOT}/skills`;
+function sandboxSkillDir(skillName) {
+  return `${SANDBOX_SKILLS_ROOT}/${skillName}`;
+}
+
+// src/chat/sandbox/runtime-dependency-snapshots.ts
+var SNAPSHOT_CACHE_PREFIX = "junior:sandbox_snapshot_profile";
+var SNAPSHOT_LOCK_PREFIX = "junior:sandbox_snapshot_lock";
+var SNAPSHOT_PROFILE_VERSION = 1;
+var SNAPSHOT_CACHE_TTL_MS = 30 * 24 * 60 * 60 * 1e3;
+var SNAPSHOT_BUILD_LOCK_TTL_MS = 10 * 60 * 1e3;
+var SNAPSHOT_WAIT_FOR_LOCK_MS = SNAPSHOT_BUILD_LOCK_TTL_MS + 30 * 1e3;
+var DEFAULT_FLOATING_DEP_MAX_AGE_MS = 7 * 24 * 60 * 60 * 1e3;
+function sleep(ms) {
+  return new Promise((resolve) => {
+    setTimeout(resolve, ms);
+  });
+}
+function profileCacheKey(profileHash) {
+  return `${SNAPSHOT_CACHE_PREFIX}:${profileHash}`;
+}
+function profileLockKey(profileHash) {
+  return `${SNAPSHOT_LOCK_PREFIX}:${profileHash}`;
+}
+function isExactNpmVersion(version) {
+  return /^\d+\.\d+\.\d+(?:[-+][a-z0-9.]+)?$/i.test(version.trim());
+}
+function hasFloatingSelector(dep) {
+  return dep.type === "npm" && !isExactNpmVersion(dep.version);
+}
+function parseFloatingDepMaxAgeMs() {
+  const raw = process.env.SANDBOX_SNAPSHOT_FLOATING_MAX_AGE_MS;
+  if (!raw?.trim()) {
+    return DEFAULT_FLOATING_DEP_MAX_AGE_MS;
+  }
+  const parsed = Number.parseInt(raw, 10);
+  if (!Number.isFinite(parsed) || parsed < 0) {
+    return DEFAULT_FLOATING_DEP_MAX_AGE_MS;
+  }
+  return parsed;
+}
+function buildDependencyProfile(runtime) {
+  const dependencies = getPluginRuntimeDependencies();
+  const postinstall = getPluginRuntimePostinstall();
+  if (dependencies.length === 0 && postinstall.length === 0) {
+    return null;
+  }
+  const rebuildEpoch = process.env.SANDBOX_SNAPSHOT_REBUILD_EPOCH?.trim() ?? "";
+  const hasFloatingVersions = dependencies.some((dep) => hasFloatingSelector(dep)) || postinstall.length > 0;
+  const hashInput = JSON.stringify({
+    version: SNAPSHOT_PROFILE_VERSION,
+    runtime,
+    rebuildEpoch,
+    dependencies,
+    postinstall
+  });
+  const profileHash = createHash("sha256").update(hashInput).digest("hex");
+  return {
+    profileHash,
+    dependencyCount: dependencies.length,
+    hasFloatingVersions,
+    dependencies,
+    postinstall
+  };
+}
+function shouldRebuildCachedSnapshot(profile, cached) {
+  if (!profile.hasFloatingVersions) {
+    return false;
+  }
+  const maxAgeMs = parseFloatingDepMaxAgeMs();
+  if (maxAgeMs === 0) {
+    return true;
+  }
+  return Date.now() - cached.createdAtMs > maxAgeMs;
+}
+async function getCachedSnapshot(profileHash) {
+  try {
+    const state = getStateAdapter();
+    await state.connect();
+    const raw = await state.get(profileCacheKey(profileHash));
+    if (typeof raw !== "string") {
+      return null;
+    }
+    const parsed = JSON.parse(raw);
+    if (!parsed || typeof parsed !== "object" || typeof parsed.profileHash !== "string" || typeof parsed.snapshotId !== "string" || typeof parsed.runtime !== "string" || typeof parsed.createdAtMs !== "number" || typeof parsed.dependencyCount !== "number") {
+      return null;
+    }
+    return parsed;
+  } catch {
+    return null;
+  }
+}
+async function setCachedSnapshot(entry) {
+  const state = getStateAdapter();
+  await state.connect();
+  await state.set(profileCacheKey(entry.profileHash), JSON.stringify(entry), SNAPSHOT_CACHE_TTL_MS);
+}
+async function withSnapshotSpan(name, op, attributes, callback) {
+  return await withSpan(name, op, {}, callback, attributes);
+}
+async function runOrThrow(sandbox, params, label) {
+  const result = await sandbox.runCommand(params);
+  if (result.exitCode === 0) {
+    return;
+  }
+  const stderr = (await result.stderr()).trim();
+  const stdout = (await result.stdout()).trim();
+  const detail = stderr || stdout || "command failed";
+  throw new Error(`${label} failed: ${detail}`);
+}
+async function tryRun(sandbox, params) {
+  const result = await sandbox.runCommand(params);
+  if (result.exitCode === 0) {
+    return { ok: true };
+  }
+  const stderr = (await result.stderr()).trim();
+  const stdout = (await result.stdout()).trim();
+  return { ok: false, detail: stderr || stdout || "command failed" };
+}
+async function installGhCliViaDnf(sandbox) {
+  const direct = await tryRun(sandbox, {
+    cmd: "dnf",
+    args: ["install", "-y", "gh"],
+    sudo: true
+  });
+  if (direct.ok) {
+    return;
+  }
+  const dnf5Repo = await tryRun(sandbox, {
+    cmd: "dnf",
+    args: ["config-manager", "addrepo", "--from-repofile=https://cli.github.com/packages/rpm/gh-cli.repo"],
+    sudo: true
+  });
+  if (!dnf5Repo.ok) {
+    await runOrThrow(
+      sandbox,
+      {
+        cmd: "dnf",
+        args: ["install", "-y", "dnf-command(config-manager)"],
+        sudo: true
+      },
+      "dnf install dnf-command(config-manager)"
+    );
+    await runOrThrow(
+      sandbox,
+      {
+        cmd: "dnf",
+        args: ["config-manager", "--add-repo", "https://cli.github.com/packages/rpm/gh-cli.repo"],
+        sudo: true
+      },
+      "dnf config-manager --add-repo gh-cli.repo"
+    );
+  }
+  await runOrThrow(
+    sandbox,
+    {
+      cmd: "dnf",
+      args: ["install", "-y", "gh", "--repo", "gh-cli"],
+      sudo: true
+    },
+    "dnf install gh --repo gh-cli"
+  );
+}
+function runtimeDependencyFilePath(url, sha256) {
+  let urlBasename = "package.rpm";
+  try {
+    const pathname = new URL(url).pathname;
+    const segments = pathname.split("/").filter(Boolean);
+    const candidate = segments[segments.length - 1];
+    if (candidate) {
+      urlBasename = candidate;
+    }
+  } catch {
+  }
+  const sanitizedBasename = urlBasename.replace(/[^a-zA-Z0-9._-]/g, "_");
+  return `/tmp/junior-runtime-${sha256.slice(0, 12)}-${sanitizedBasename}`;
+}
+async function installRuntimeDependencies(sandbox, deps) {
+  const systemDeps = deps.filter((dep) => dep.type === "system");
+  const npmPackages = deps.filter((dep) => dep.type === "npm").map((dep) => `${dep.package}@${dep.version}`);
+  if (systemDeps.length > 0) {
+    await withSnapshotSpan(
+      "sandbox.snapshot.install_system",
+      "sandbox.snapshot.install.system",
+      {
+        "app.sandbox.snapshot.install.system_count": systemDeps.length
+      },
+      async () => {
+        for (const dep of systemDeps) {
+          if ("url" in dep) {
+            const rpmPath = runtimeDependencyFilePath(dep.url, dep.sha256);
+            await runOrThrow(
+              sandbox,
+              {
+                cmd: "curl",
+                args: ["-fsSL", dep.url, "-o", rpmPath]
+              },
+              `curl download ${dep.url}`
+            );
+            const checksumResult = await sandbox.runCommand({
+              cmd: "sha256sum",
+              args: [rpmPath]
+            });
+            const checksumStdout = (await checksumResult.stdout()).trim();
+            const checksumStderr = (await checksumResult.stderr()).trim();
+            if (checksumResult.exitCode !== 0) {
+              throw new Error(`sha256sum failed: ${checksumStderr || checksumStdout || "command failed"}`);
+            }
+            const actualChecksum = checksumStdout.split(/\s+/)[0]?.toLowerCase();
+            if (!actualChecksum) {
+              throw new Error("sha256sum produced empty output");
+            }
+            if (actualChecksum !== dep.sha256) {
+              throw new Error(
+                `checksum mismatch for ${dep.url}: expected ${dep.sha256}, got ${actualChecksum}`
+              );
+            }
+            await runOrThrow(
+              sandbox,
+              {
+                cmd: "dnf",
+                args: ["install", "-y", rpmPath],
+                sudo: true
+              },
+              `dnf install ${dep.url}`
+            );
+            continue;
+          }
+          if (dep.package === "gh") {
+            await installGhCliViaDnf(sandbox);
+            continue;
+          }
+          await runOrThrow(
+            sandbox,
+            {
+              cmd: "dnf",
+              args: ["install", "-y", dep.package],
+              sudo: true
+            },
+            `dnf install ${dep.package}`
+          );
+        }
+      }
+    );
+  }
+  if (npmPackages.length > 0) {
+    await withSnapshotSpan(
+      "sandbox.snapshot.install_npm",
+      "sandbox.snapshot.install.npm",
+      {
+        "app.sandbox.snapshot.install.npm_count": npmPackages.length
+      },
+      async () => {
+        await runOrThrow(
+          sandbox,
+          {
+            cmd: "npm",
+            args: [
+              "install",
+              "--global",
+              "--prefix",
+              `${SANDBOX_WORKSPACE_ROOT}/.junior`,
+              ...npmPackages
+            ]
+          },
+          "npm install"
+        );
+      }
+    );
+  }
+}
+async function runRuntimePostinstall(sandbox, commands) {
+  if (commands.length === 0) {
+    return;
+  }
+  await withSnapshotSpan(
+    "sandbox.snapshot.runtime_postinstall",
+    "sandbox.snapshot.runtime_postinstall",
+    {
+      "app.sandbox.snapshot.runtime_postinstall.count": commands.length
+    },
+    async () => {
+      for (const command of commands) {
+        const invocation = [JSON.stringify(command.cmd), ...(command.args ?? []).map((arg) => JSON.stringify(arg))].join(" ");
+        const pathPrefix = `${SANDBOX_WORKSPACE_ROOT}/.junior/bin:$PATH`;
+        await runOrThrow(
+          sandbox,
+          {
+            cmd: "bash",
+            args: ["-lc", `export PATH="${pathPrefix}" && ${invocation}`],
+            ...command.sudo !== void 0 ? { sudo: command.sudo } : {}
+          },
+          `runtime-postinstall ${command.cmd}`
+        );
+      }
+    }
+  );
+}
+async function createDependencySnapshot(profile, runtime, timeoutMs) {
+  return await withSnapshotSpan(
+    "sandbox.snapshot.build",
+    "sandbox.snapshot.build",
+    {
+      "app.sandbox.runtime": runtime,
+      "app.sandbox.snapshot.dependency_count": profile.dependencyCount
+    },
+    async () => {
+      const sandbox = await Sandbox.create({
+        timeout: timeoutMs,
+        runtime
+      });
+      try {
+        await installRuntimeDependencies(sandbox, profile.dependencies);
+        await runRuntimePostinstall(sandbox, profile.postinstall);
+        return await withSnapshotSpan(
+          "sandbox.snapshot.capture",
+          "sandbox.snapshot.capture",
+          {
+            "app.sandbox.snapshot.dependency_count": profile.dependencyCount
+          },
+          async () => {
+            const snapshot = await sandbox.snapshot();
+            return snapshot.snapshotId;
+          }
+        );
+      } finally {
+        try {
+          await sandbox.stop({ blocking: true });
+        } catch {
+        }
+      }
+    }
+  );
+}
+async function withBuildLock(profileHash, callback, canUseCachedSnapshot, hooks) {
+  const state = getStateAdapter();
+  await state.connect();
+  const lockKey = profileLockKey(profileHash);
+  const tryAcquireLock = async () => await state.acquireLock(lockKey, SNAPSHOT_BUILD_LOCK_TTL_MS);
+  let lock = await tryAcquireLock();
+  if (lock) {
+    try {
+      const result = await callback();
+      return {
+        snapshotId: result.snapshotId,
+        source: result.source,
+        waitedForLock: false
+      };
+    } finally {
+      await state.releaseLock(lock);
+    }
+  }
+  return await withSnapshotSpan(
+    "sandbox.snapshot.lock_wait",
+    "sandbox.snapshot.lock_wait",
+    {
+      "app.sandbox.snapshot.profile_hash": profileHash
+    },
+    async () => {
+      await hooks?.onWaitingForLock?.();
+      const waitUntil = Date.now() + SNAPSHOT_WAIT_FOR_LOCK_MS;
+      while (Date.now() < waitUntil) {
+        const cached2 = await getCachedSnapshot(profileHash);
+        if (cached2?.snapshotId && canUseCachedSnapshot(cached2)) {
+          return {
+            snapshotId: cached2.snapshotId,
+            source: "wait_cache",
+            waitedForLock: true
+          };
+        }
+        lock = await tryAcquireLock();
+        if (lock) {
+          try {
+            const result = await callback();
+            return {
+              snapshotId: result.snapshotId,
+              source: result.source,
+              waitedForLock: true
+            };
+          } finally {
+            await state.releaseLock(lock);
+          }
+        }
+        await sleep(500);
+      }
+      const cached = await getCachedSnapshot(profileHash);
+      if (cached?.snapshotId && canUseCachedSnapshot(cached)) {
+        return {
+          snapshotId: cached.snapshotId,
+          source: "wait_cache",
+          waitedForLock: true
+        };
+      }
+      throw new Error("Timed out waiting for snapshot build lock");
+    }
+  );
+}
+function toResolveOutcome(forceRebuild, source, waitedForLock) {
+  if (source === "built") {
+    return forceRebuild ? "forced_rebuild" : "rebuilt";
+  }
+  if (waitedForLock || source === "wait_cache") {
+    return "cache_hit_after_lock_wait";
+  }
+  return "cache_hit";
+}
+function getRebuildReason(params) {
+  if (params.forceRebuild) {
+    return params.staleSnapshotId ? "snapshot_missing" : "force_rebuild";
+  }
+  if (params.cached?.snapshotId && params.shouldRebuildCached) {
+    return "floating_stale";
+  }
+  if (!params.cached?.snapshotId) {
+    return "cache_miss";
+  }
+  return void 0;
+}
+async function resolveRuntimeDependencySnapshot(params) {
+  return await withSnapshotSpan(
+    "sandbox.snapshot.resolve",
+    "sandbox.snapshot.resolve",
+    {
+      "app.sandbox.runtime": params.runtime,
+      "app.sandbox.snapshot.force_rebuild": Boolean(params.forceRebuild)
+    },
+    async () => {
+      await params.onProgress?.("resolve_start");
+      const resolveStartedAtMs = Date.now();
+      const profile = buildDependencyProfile(params.runtime);
+      if (!profile) {
+        return {
+          dependencyCount: 0,
+          cacheHit: false,
+          resolveOutcome: "no_profile"
+        };
+      }
+      const cached = await getCachedSnapshot(profile.profileHash);
+      const cachedNeedsRebuild = Boolean(cached?.snapshotId && shouldRebuildCachedSnapshot(profile, cached));
+      if (!params.forceRebuild && cached?.snapshotId && !cachedNeedsRebuild) {
+        await params.onProgress?.("cache_hit");
+        return {
+          snapshotId: cached.snapshotId,
+          profileHash: profile.profileHash,
+          dependencyCount: profile.dependencyCount,
+          cacheHit: true,
+          resolveOutcome: "cache_hit"
+        };
+      }
+      const rebuildReason = getRebuildReason({
+        forceRebuild: params.forceRebuild,
+        staleSnapshotId: params.staleSnapshotId,
+        cached,
+        shouldRebuildCached: cachedNeedsRebuild
+      });
+      const canUseCachedSnapshot = (candidate) => {
+        if (params.forceRebuild) {
+          if (params.staleSnapshotId) {
+            return candidate.snapshotId !== params.staleSnapshotId;
+          }
+          return candidate.createdAtMs > resolveStartedAtMs;
+        }
+        return !shouldRebuildCachedSnapshot(profile, candidate);
+      };
+      const lockResult = await withBuildLock(profile.profileHash, async () => {
+        const latest = await getCachedSnapshot(profile.profileHash);
+        if (latest?.snapshotId && canUseCachedSnapshot(latest)) {
+          await params.onProgress?.("cache_hit");
+          return { snapshotId: latest.snapshotId, source: "callback_cache" };
+        }
+        await params.onProgress?.("building_snapshot");
+        const nextSnapshotId = await createDependencySnapshot(profile, params.runtime, params.timeoutMs);
+        await setCachedSnapshot({
+          profileHash: profile.profileHash,
+          snapshotId: nextSnapshotId,
+          runtime: params.runtime,
+          createdAtMs: Date.now(),
+          dependencyCount: profile.dependencyCount
+        });
+        await params.onProgress?.("build_complete");
+        return { snapshotId: nextSnapshotId, source: "built" };
+      }, canUseCachedSnapshot, {
+        onWaitingForLock: async () => {
+          await params.onProgress?.("waiting_for_lock");
+        }
+      });
+      return {
+        snapshotId: lockResult.snapshotId,
+        profileHash: profile.profileHash,
+        dependencyCount: profile.dependencyCount,
+        cacheHit: lockResult.source !== "built",
+        resolveOutcome: toResolveOutcome(Boolean(params.forceRebuild), lockResult.source, lockResult.waitedForLock),
+        ...rebuildReason ? { rebuildReason } : {}
+      };
+    }
+  );
+}
+function isSnapshotMissingError(error) {
+  const searchable = error instanceof Error ? error.message.toLowerCase() : String(error).toLowerCase();
+  return searchable.includes("snapshot") && (searchable.includes("not found") || searchable.includes("unknown") || searchable.includes("404"));
+}
+
+export {
+  homeDir,
+  skillRoots,
+  soulPathCandidates,
+  resolveAuthTokenPlaceholder,
+  CredentialUnavailableError,
+  getPluginCapabilityProviders,
+  getPluginProviders,
+  getPluginOAuthConfig,
+  getPluginSkillRoots,
+  isPluginProvider,
+  createPluginBroker,
+  botConfig,
+  getSlackBotToken,
+  getSlackSigningSecret,
+  getSlackClientId,
+  getSlackClientSecret,
+  getStateAdapter,
+  disconnectStateAdapter,
+  claimQueueIngressDedup,
+  hasQueueIngressDedup,
+  getQueueMessageProcessingState,
+  acquireQueueMessageProcessingOwnership,
+  refreshQueueMessageProcessingOwnership,
+  completeQueueMessageProcessingOwnership,
+  failQueueMessageProcessingOwnership,
+  getAgentTurnSessionCheckpoint,
+  upsertAgentTurnSessionCheckpoint,
+  SANDBOX_WORKSPACE_ROOT,
+  SANDBOX_SKILLS_ROOT,
+  sandboxSkillDir,
+  resolveRuntimeDependencySnapshot,
+  isSnapshotMissingError
+};