@sentry/junior 0.114.0 → 0.116.0

package/dist/instrumentation.js

@@ -3,8 +3,9 @@ import {
 } from "./chunk-UIE3R5XU.js";
 import {
   getCurrentConversationPrivacy
-} from "./chunk-6Y5L4BOM.js";
-import "./chunk-42WRQLJ6.js";
+} from "./chunk-FXOYURO4.js";
+import "./chunk-OB42YVAE.js";
+import "./chunk-F3B2YJ76.js";
 import {
   getClient,
   getGlobalScope,
@@ -15,8 +16,8 @@ import {
 import {
   getDeploymentServiceVersion,
   getDeploymentTelemetryAttributes
-} from "./chunk-5CZ7RETL.js";
-import "./chunk-PM3PX42K.js";
+} from "./chunk-N7TMYLF2.js";
+import "./chunk-MGH5ADQS.js";
 import "./chunk-MLKGABMK.js";
 
 // src/chat/sentry-payload-filter.ts
@@ -29,6 +30,69 @@ var PAYLOAD_ATTRIBUTE_KEYS = /* @__PURE__ */ new Set([
   "gen_ai.tool.call.arguments",
   "gen_ai.tool.call.result"
 ]);
+var URL_ATTRIBUTE_KEYS = /* @__PURE__ */ new Set([
+  "http.target",
+  "http.url",
+  "url.full",
+  "url.path"
+]);
+var OAUTH_CALLBACK_PATH = "/api/oauth/callback/";
+var LOCAL_CREDENTIAL_PATH = "/api/internal/local-oauth-credentials";
+var SECRET_HEADER_NAMES = /* @__PURE__ */ new Set([
+  "x-junior-local-credential-signature",
+  "x-junior-sandbox-egress-token"
+]);
+function stripQuery(value) {
+  const queryIndex = value.indexOf("?");
+  return queryIndex >= 0 ? value.slice(0, queryIndex) : value;
+}
+function isSecretHeaderAttribute(key) {
+  const normalized = key.toLowerCase().replace(/[^a-z0-9]/g, "");
+  return normalized.endsWith("xjuniorlocalcredentialsignature") || normalized.endsWith("xjuniorsandboxegresstoken");
+}
+function scrubSensitiveUrlAttributes(attributes) {
+  if (!attributes) {
+    return;
+  }
+  delete attributes["url.query"];
+  const hasLocalCredentialUrl = [...URL_ATTRIBUTE_KEYS].some((key) => {
+    const value = attributes[key];
+    return typeof value === "string" && value.includes(LOCAL_CREDENTIAL_PATH);
+  });
+  for (const key of Object.keys(attributes)) {
+    if (isSecretHeaderAttribute(key) || hasLocalCredentialUrl && key === "http.request.body.data") {
+      delete attributes[key];
+    }
+  }
+  for (const key of URL_ATTRIBUTE_KEYS) {
+    const value = attributes[key];
+    if (typeof value !== "string" || !value.includes(OAUTH_CALLBACK_PATH)) {
+      continue;
+    }
+    attributes[key] = stripQuery(value);
+  }
+}
+function scrubSensitiveRequest(request) {
+  if (!request) {
+    return;
+  }
+  const url = request.url;
+  if (url?.includes(OAUTH_CALLBACK_PATH)) {
+    request.url = stripQuery(url);
+    delete request.query_string;
+  }
+  if (url?.includes(LOCAL_CREDENTIAL_PATH)) {
+    delete request.data;
+  }
+  if (!request.headers) {
+    return;
+  }
+  for (const key of Object.keys(request.headers)) {
+    if (SECRET_HEADER_NAMES.has(key.toLowerCase())) {
+      delete request.headers[key];
+    }
+  }
+}
 function hasPayloadAttributes(attributes) {
   return Object.keys(attributes).some((key) => PAYLOAD_ATTRIBUTE_KEYS.has(key));
 }
@@ -66,10 +130,13 @@ function scrubContainer(container) {
   }
   scrubPayloadAttributes(container.data);
   scrubPayloadAttributes(container.attributes);
+  scrubSensitiveUrlAttributes(container.data);
+  scrubSensitiveUrlAttributes(container.attributes);
 }
 function scrubPrivateSentryEvent(event) {
   const eventRecord = event;
   scrubContainer(eventRecord);
+  scrubSensitiveRequest(event.request);
   scrubContainer(event.contexts?.trace);
   for (const breadcrumb of event.breadcrumbs ?? []) {
     scrubContainer(breadcrumb);
@@ -79,6 +146,7 @@ function scrubPrivateSentryEvent(event) {
 function scrubPrivateSentryTransaction(event) {
   const eventRecord = event;
   scrubContainer(eventRecord);
+  scrubSensitiveRequest(event.request);
   scrubContainer(event.contexts?.trace);
   for (const span of event.spans ?? []) {
     scrubContainer(span);

package/dist/nitro.js

@@ -1,13 +1,13 @@
 import {
   resolveConversationWorkQueueTopic
-} from "./chunk-MIAKQNYX.js";
+} from "./chunk-6ZK6FZIV.js";
 import {
   PLUGIN_TASK_QUEUE_TOPIC
-} from "./chunk-KNFROR7R.js";
+} from "./chunk-5I6ORJUY.js";
 import {
   pluginCatalogConfigFromPluginSet,
   pluginRuntimeRegistrationsFromPluginSet
-} from "./chunk-SG5WAA7H.js";
+} from "./chunk-WKU7TY22.js";
 import {
   loadPluginSetFromModule,
   resolvePluginModule
@@ -25,8 +25,8 @@ import {
   JUNIOR_PLUGIN_TASK_CALLBACK_ROUTE,
   JUNIOR_RETENTION_CRON_SCHEDULE,
   JUNIOR_RETENTION_ROUTE
-} from "./chunk-5CZ7RETL.js";
-import "./chunk-PM3PX42K.js";
+} from "./chunk-N7TMYLF2.js";
+import "./chunk-MGH5ADQS.js";
 import "./chunk-MLKGABMK.js";
 
 // src/nitro.ts

package/dist/oauth-callback-server-PAQRPXZX.js

@@ -0,0 +1,231 @@
+import {
+  GET,
+  GET2,
+  syncLocalOAuthCredential
+} from "./chunk-VKZ6WVAY.js";
+import "./chunk-FA6POGLH.js";
+import "./chunk-UEVLIYK5.js";
+import "./chunk-4CODA7P5.js";
+import "./chunk-6ZK6FZIV.js";
+import "./chunk-5I6ORJUY.js";
+import {
+  createUserTokenStore
+} from "./chunk-PGKWXHYJ.js";
+import "./chunk-OF5FODBL.js";
+import "./chunk-MU6HHZEN.js";
+import "./chunk-PDO5BLNM.js";
+import "./chunk-VZCSLYCE.js";
+import "./chunk-53ZKTQO6.js";
+import "./chunk-CI3VK7X5.js";
+import "./chunk-KBNDFU6J.js";
+import "./chunk-RXRQJF7Y.js";
+import "./chunk-4ZNGQH7C.js";
+import "./chunk-PZGPCOSD.js";
+import "./chunk-VFUK3X5B.js";
+import "./chunk-FXOYURO4.js";
+import "./chunk-6RQ5GCWH.js";
+import "./chunk-25GU5B5E.js";
+import "./chunk-JZPQ5K4V.js";
+import "./chunk-W3U3YQYI.js";
+import "./chunk-HZF5P5UN.js";
+import "./chunk-3JOGUT46.js";
+import "./chunk-OB42YVAE.js";
+import "./chunk-F3B2YJ76.js";
+import "./chunk-6GWA276C.js";
+import "./chunk-B3IT5END.js";
+import "./chunk-3V7OFJZC.js";
+import "./chunk-N7TMYLF2.js";
+import "./chunk-MGH5ADQS.js";
+import "./chunk-MLKGABMK.js";
+
+// src/chat/local/oauth-callback-server.ts
+import { createServer } from "http";
+var LOCAL_OAUTH_TIMEOUT_MS = 10 * 60 * 1e3;
+var LOCAL_OAUTH_CALLBACK_TIMEOUT_MS = 60 * 1e3;
+function decodeProvider(value) {
+  if (!value) {
+    return void 0;
+  }
+  try {
+    const provider = decodeURIComponent(value);
+    return /^[a-z][a-z0-9-]*$/.test(provider) ? provider : void 0;
+  } catch {
+    return void 0;
+  }
+}
+async function startLocalOAuthCallbackServer(agentRunner) {
+  let pendingAuthorization;
+  const completeAuthorization = (authorization, result) => {
+    if (authorization.settled) {
+      return;
+    }
+    authorization.settled = true;
+    clearTimeout(authorization.timeout);
+    authorization.finish(result);
+  };
+  const cancelAuthorization = () => {
+    const authorization = pendingAuthorization;
+    if (!authorization) {
+      return;
+    }
+    pendingAuthorization = void 0;
+    completeAuthorization(
+      authorization,
+      new Error("Local OAuth authorization canceled")
+    );
+  };
+  const server = createServer(async (incoming, outgoing) => {
+    const host = incoming.headers.host ?? "127.0.0.1";
+    let requestUrl;
+    try {
+      requestUrl = new URL(incoming.url ?? "/", `http://${host}`);
+    } catch {
+      outgoing.writeHead(400).end("Invalid callback request");
+      return;
+    }
+    const mcpMatch = requestUrl.pathname.match(
+      /^\/api\/oauth\/callback\/mcp\/([^/]+)$/
+    );
+    const pluginMatch = requestUrl.pathname.match(
+      /^\/api\/oauth\/callback\/([^/]+)$/
+    );
+    const provider = decodeProvider(mcpMatch?.[1] ?? pluginMatch?.[1]);
+    if (!provider) {
+      outgoing.writeHead(404).end("Not found");
+      return;
+    }
+    const authorization = pendingAuthorization;
+    if (!authorization || authorization.callbackStarted || authorization.settled || requestUrl.searchParams.get("state") !== authorization.state) {
+      outgoing.writeHead(409).end("No matching authorization request");
+      return;
+    }
+    authorization.callbackStarted = true;
+    clearTimeout(authorization.timeout);
+    authorization.timeout = setTimeout(() => {
+      if (!outgoing.headersSent) {
+        outgoing.writeHead(504).end("Authorization callback timed out");
+      }
+      completeAuthorization(
+        authorization,
+        new Error("Timed out completing OAuth authorization")
+      );
+    }, LOCAL_OAUTH_CALLBACK_TIMEOUT_MS);
+    const backgroundTasks = [];
+    const waitUntil = (task) => {
+      backgroundTasks.push(
+        typeof task === "function" ? Promise.resolve().then(task) : task
+      );
+    };
+    try {
+      const request = new Request(requestUrl, { method: "GET" });
+      const response = mcpMatch ? await GET(request, provider, waitUntil, {
+        agentRunner
+      }) : await GET2(request, provider, waitUntil, {
+        agentRunner
+      });
+      const body = Buffer.from(await response.arrayBuffer());
+      await Promise.all(backgroundTasks);
+      if (response.ok) {
+        if (!mcpMatch) {
+          const tokens = await createUserTokenStore().get(
+            "local-cli",
+            provider
+          );
+          if (!tokens) {
+            throw new Error(
+              `${provider} authorization completed without a stored credential`
+            );
+          }
+          await syncLocalOAuthCredential(provider, tokens);
+        }
+      }
+      if (authorization.settled) {
+        return;
+      }
+      if (response.ok) {
+        completeAuthorization(authorization, true);
+      } else {
+        completeAuthorization(
+          authorization,
+          new Error(
+            `${provider} authorization callback failed with HTTP ${response.status}`
+          )
+        );
+      }
+      outgoing.writeHead(
+        response.status,
+        Object.fromEntries(response.headers.entries())
+      );
+      outgoing.end(body);
+    } catch (error) {
+      if (!outgoing.headersSent) {
+        outgoing.writeHead(500).end("Authorization callback failed");
+      }
+      completeAuthorization(
+        authorization,
+        error instanceof Error ? error : new Error(String(error))
+      );
+    }
+  });
+  await new Promise((resolve, reject) => {
+    server.once("error", reject);
+    server.listen(0, "127.0.0.1", () => {
+      server.off("error", reject);
+      resolve();
+    });
+  });
+  const address = server.address();
+  return {
+    beginAuthorization: (authorizationUrl) => {
+      if (pendingAuthorization) {
+        throw new Error("Local OAuth already has an active authorization");
+      }
+      const state = new URL(authorizationUrl).searchParams.get("state");
+      if (!state) {
+        throw new Error("Local OAuth authorization URL is missing state");
+      }
+      let finish = () => void 0;
+      const result = new Promise((resolve) => {
+        finish = resolve;
+      });
+      const authorization = {
+        callbackStarted: false,
+        finish,
+        result,
+        settled: false,
+        state,
+        timeout: setTimeout(() => {
+          completeAuthorization(
+            authorization,
+            new Error("Timed out waiting for OAuth authorization")
+          );
+        }, LOCAL_OAUTH_TIMEOUT_MS)
+      };
+      pendingAuthorization = authorization;
+    },
+    cancelAuthorization,
+    port: address.port,
+    waitForAuthorization: async () => {
+      const authorization = pendingAuthorization;
+      if (!authorization) {
+        throw new Error("Local OAuth has no active authorization");
+      }
+      const result = await authorization.result;
+      if (pendingAuthorization === authorization) {
+        pendingAuthorization = void 0;
+      }
+      if (result instanceof Error) {
+        throw result;
+      }
+    },
+    close: async () => {
+      cancelAuthorization();
+      await new Promise((resolve, reject) => {
+        server.close((error) => error ? reject(error) : resolve());
+      });
+    }
+  };
+}
+export {
+  startLocalOAuthCallbackServer
+};

package/dist/oauth-relay-3ZU72UGL.js

@@ -0,0 +1,9 @@
+import {
+  createLocalOAuthState,
+  relayLocalOAuthCallback
+} from "./chunk-FA6POGLH.js";
+import "./chunk-MLKGABMK.js";
+export {
+  createLocalOAuthState,
+  relayLocalOAuthCallback
+};

package/dist/personal-tokens/store.d.ts

@@ -0,0 +1,27 @@
+export interface PersonalTokenMetadata {
+    id: string;
+    name: string;
+    tokenSuffix: string;
+    createdAt: string;
+    expiresAt: string;
+    lastUsedAt: string | null;
+}
+export interface CreatedPersonalToken extends PersonalTokenMetadata {
+    token: string;
+}
+/** Create a personal token and return its plaintext value exactly once. */
+export declare function createPersonalToken(args: {
+    email: string;
+    name: string;
+    now?: Date;
+}): Promise<CreatedPersonalToken>;
+/** List active personal tokens owned by one verified user. */
+export declare function listPersonalTokens(email: string, now?: Date): Promise<PersonalTokenMetadata[]>;
+/** Revoke a personal token owned by one verified user. */
+export declare function revokePersonalToken(args: {
+    email: string;
+    id: string;
+    now?: Date;
+}): Promise<boolean>;
+/** Resolve an active personal bearer token to its verified owner email. */
+export declare function authenticatePersonalToken(token: string, now?: Date): Promise<string | undefined>;

package/dist/{plugins-PZMDS7AT.js → plugins-IUJA4VBU.js}

@@ -4,7 +4,7 @@ import {
   pluginCatalogConfigFromPluginSet,
   pluginCliRegistrationsFromPluginSet,
   pluginRuntimeRegistrationsFromPluginSet
-} from "./chunk-SG5WAA7H.js";
+} from "./chunk-WKU7TY22.js";
 import "./chunk-MLKGABMK.js";
 export {
   defineJuniorPlugins,

package/dist/reporting-schema.d.ts

@@ -4,10 +4,16 @@ export declare const healthReportSchema: z.ZodObject<{
     service: z.ZodString;
     timestamp: z.ZodString;
 }, z.core.$strict>;
-export declare const pluginReportSchema: z.ZodObject<{
+export declare const pluginSchema: z.ZodObject<{
+    configKeys: z.ZodArray<z.ZodString>;
+    description: z.ZodString;
+    displayName: z.ZodString;
     name: z.ZodString;
 }, z.core.$strict>;
-export declare const pluginReportsSchema: z.ZodArray<z.ZodObject<{
+export declare const pluginsSchema: z.ZodArray<z.ZodObject<{
+    configKeys: z.ZodArray<z.ZodString>;
+    description: z.ZodString;
+    displayName: z.ZodString;
     name: z.ZodString;
 }, z.core.$strict>>;
 export declare const skillReportSchema: z.ZodObject<{
@@ -175,8 +181,8 @@ export declare const pluginOperationalReportFeedSchema: z.ZodObject<{
     source: z.ZodLiteral<"plugins">;
 }, z.core.$strict>;
 export type HealthReport = z.infer<typeof healthReportSchema>;
-export type PluginReport = z.infer<typeof pluginReportSchema>;
-export type PluginReports = z.infer<typeof pluginReportsSchema>;
+export type Plugin = z.infer<typeof pluginSchema>;
+export type Plugins = z.infer<typeof pluginsSchema>;
 export type SkillReport = z.infer<typeof skillReportSchema>;
 export type SkillReports = z.infer<typeof skillReportsSchema>;
 export type RuntimeInfoReport = z.infer<typeof runtimeInfoReportSchema>;

package/dist/reporting.d.ts

@@ -1,11 +1,11 @@
-import type { PluginOperationalReportFeed, PluginReport, RuntimeInfoReport, SkillReport } from "./reporting-schema";
-export { healthReportSchema, pluginOperationalReportFeedSchema, pluginOperationalReportSchema, pluginPackageContentItemReportSchema, pluginPackageContentReportSchema, pluginReportSchema, pluginReportsSchema, runtimeInfoReportSchema, skillReportSchema, skillReportsSchema, } from "./reporting-schema";
+import type { PluginOperationalReportFeed, Plugin, RuntimeInfoReport, SkillReport } from "./reporting-schema";
+export { healthReportSchema, pluginOperationalReportFeedSchema, pluginOperationalReportSchema, pluginPackageContentItemReportSchema, pluginPackageContentReportSchema, pluginSchema, pluginsSchema, runtimeInfoReportSchema, skillReportSchema, skillReportsSchema, } from "./reporting-schema";
 export { readHealthReport } from "./handlers/health";
-export type { HealthReport, PluginOperationalReport, PluginOperationalReportFeed, PluginPackageContentItemReport, PluginPackageContentReport, PluginReport, PluginReports, RuntimeInfoReport, SkillReport, SkillReports, } from "./reporting-schema";
+export type { HealthReport, PluginOperationalReport, PluginOperationalReportFeed, PluginPackageContentItemReport, PluginPackageContentReport, Plugin, Plugins, RuntimeInfoReport, SkillReport, SkillReports, } from "./reporting-schema";
 /** Read discovered skill names for authenticated runtime diagnostics. */
 export declare function readSkillReports(): Promise<SkillReport[]>;
-/** Read configured plugin names for authenticated runtime diagnostics. */
-export declare function readPluginReports(): Promise<PluginReport[]>;
+/** Read safe configured plugin metadata for authenticated runtime diagnostics. */
+export declare function readPlugins(): Promise<Plugin[]>;
 /** Read authenticated runtime discovery data. */
 export declare function readRuntimeInfoReport(): Promise<RuntimeInfoReport>;
 /** Read sanitized operational summaries contributed by plugins. */