@sentry/junior 0.136.1 → 0.137.0

package/dist/{chunk-OTJMQYVP.js → chunk-KJ4HGRHN.js}

@@ -30,7 +30,7 @@ import {
   toMcpProviderError,
   toolInvocationDestination,
   uploadFilesToConversation
-} from "./chunk-G66RYKRS.js";
+} from "./chunk-EWDSB24B.js";
 import {
   AGENTS_REMOVAL_NOTICE,
   AGENTS_REPLACEMENT_NOTICE,
@@ -98,7 +98,7 @@ import {
   trimTrailingAssistantMessages,
   truncateText,
   updateConversationStats
-} from "./chunk-NVVBEJUB.js";
+} from "./chunk-POBSY47Q.js";
 import {
   parseSandboxEgressAuthRequiredSignal,
   parseSandboxEgressPermissionDeniedSignal,
@@ -110,6 +110,7 @@ import {
   buildCommandScript,
   buildNonInteractiveShellScript,
   createSandboxSession,
+  ensureDockerDaemon,
   getSandboxResources,
   getVercelSandboxCredentials,
   hash,
@@ -123,7 +124,7 @@ import {
   runNonInteractiveCommand,
   throwSandboxOperationError,
   wrapSandboxSetupError
-} from "./chunk-CZZDCH3Q.js";
+} from "./chunk-UOXATPSI.js";
 import {
   SCHEDULED_TASK_SYSTEM_ACTOR,
   compactEventTask,
@@ -154,10 +155,10 @@ import {
   resolveLocalScheduleAtMs,
   saveEventTask,
   writableEventTask
-} from "./chunk-UX2TNH5D.js";
+} from "./chunk-K2NCQJKH.js";
 import {
   parseSlackThreadId
-} from "./chunk-TYNMSQKA.js";
+} from "./chunk-YRPC6MJY.js";
 import {
   ToolInputError,
   addAgentTurnUsage,
@@ -181,7 +182,7 @@ import {
   readActorIdentity,
   resolveChannelCapabilities,
   withSlackRetries
-} from "./chunk-KLBYCSLJ.js";
+} from "./chunk-WPPXIAFB.js";
 import {
   KNOWN_CONVERSATION_EVENT_TYPES,
   contextProvenance,
@@ -192,7 +193,7 @@ import {
   instructionActors,
   instructionProvenanceFor,
   sameActorIdentity
-} from "./chunk-HIRIWTWD.js";
+} from "./chunk-ZFS67WIR.js";
 import {
   SANDBOX_DATA_ROOT,
   SANDBOX_SKILLS_ROOT,
@@ -202,7 +203,7 @@ import {
   sandboxSkillFile,
   sandboxSkillPathResolution,
   sleep
-} from "./chunk-4YQ6I6VF.js";
+} from "./chunk-5G34IEK2.js";
 import {
   ACTIVE_TURN_COMPACTION_SUMMARY_PREFIX,
   COMPACTION_SUMMARY_PREFIX,
@@ -223,7 +224,6 @@ import {
   escapeXml,
   findProviderError,
   getGatewayApiKey,
-  getPiGatewayApiKey,
   getProviderErrorAttributes,
   hasCompactedConversationContext,
   isCompactionSummaryText,
@@ -234,9 +234,10 @@ import {
   parseTurnReasoningLevel,
   profileConfig,
   renderCurrentInstruction,
+  resolveGatewayCredential,
   resolveGatewayModel,
   unwrapCurrentInstruction
-} from "./chunk-XCZ6COFO.js";
+} from "./chunk-UG6ZYPBI.js";
 import {
   canExposeConversationPayload,
   resolveConversationPrivacy,
@@ -246,16 +247,16 @@ import {
   toGenAiMessagesTraceAttributes,
   toGenAiPayloadMetadata,
   toGenAiPayloadTraceAttributes
-} from "./chunk-22Z6MGMK.js";
+} from "./chunk-YNFERGKP.js";
 import {
   discoverSkills,
   findSkillByName,
   loadSkillsByName,
   parseSkillInvocation
-} from "./chunk-FSYXYBWU.js";
+} from "./chunk-3Q342EJJ.js";
 import {
   pluginCatalogRuntime
-} from "./chunk-3QNJOHKG.js";
+} from "./chunk-36EG34YI.js";
 import {
   CredentialUnavailableError,
   OAuthProviderError,
@@ -263,7 +264,7 @@ import {
   getOAuthProviderErrorAttributes,
   resolveAuthTokenPlaceholder,
   resolvePluginCommandEnv
-} from "./chunk-VH6MI4L7.js";
+} from "./chunk-BZAMASJP.js";
 import {
   credentialUserSubjectId
 } from "./chunk-77VDLF3Z.js";
@@ -292,7 +293,7 @@ import {
   summarizeMessageText,
   withLogContext,
   withSpan
-} from "./chunk-XWPA5KZF.js";
+} from "./chunk-T6Z5S6PQ.js";
 import {
   startInactiveSpan,
   withActiveSpan
@@ -321,13 +322,6 @@ function setConfigDefaults(defaults) {
       "configDefaults must be an object keyed by plugin config key"
     );
   }
-  for (const key of Object.keys(defaults)) {
-    if (!pluginCatalogRuntime.isConfigKey(key)) {
-      throw new Error(
-        `configDefaults: "${key}" is not a registered plugin config key`
-      );
-    }
-  }
   installDefaults = cloneDefaults(defaults);
 }
 function getConfigDefaults() {
@@ -3424,6 +3418,7 @@ function createSandboxRuntime(options) {
   };
   const prepareSandbox = async (targetSandbox) => {
     await syncSkills(targetSandbox);
+    await ensureDockerDaemon(targetSandbox);
     await options.onSandboxPrepare?.(targetSandbox);
   };
   const applyNetworkPolicy = async (targetSandbox, traceHeaders) => {
@@ -7003,7 +6998,7 @@ function createImageGenerateTool(hooks, options, deps = {}) {
     outputSchema: imageGenerateOutputSchema,
     execute: async ({ prompt }) => {
       const fetchImpl = deps.fetch ?? fetch;
-      const apiKey = getGatewayApiKey();
+      const apiKey = await getGatewayApiKey();
       if (!apiKey) {
         throw new Error(MISSING_GATEWAY_CREDENTIALS_ERROR);
       }
@@ -12532,7 +12527,10 @@ function createWebSearchTool(modelId, override) {
       }
       const maxResults = max_results ?? 3;
       const controller = new AbortController();
-      const provider = createGatewayProvider();
+      const credential = await resolveGatewayCredential();
+      const provider = createGatewayProvider(
+        credential ? { apiKey: credential.token } : {}
+      );
       const response = await withTimeout(
         generateText({
           model: provider.chat(modelId),
@@ -16948,9 +16946,9 @@ async function executeAgentRunInPrivacyContext(request, conversationPrivacy, run
       }
       return acceptedMessages;
     };
-    const apiKeyOverride = getPiGatewayApiKey();
     agent = new Agent({
-      ...apiKeyOverride ? { getApiKey: () => apiKeyOverride } : {},
+      // Resolve on every provider call so runtime OIDC tokens stay fresh.
+      getApiKey: getGatewayApiKey,
       streamFn: createTracedStreamFn({
         conversationPrivacy,
         ...streamFn ? { base: streamFn } : {}

package/dist/{chunk-NVVBEJUB.js → chunk-POBSY47Q.js}

@@ -18,18 +18,18 @@ import {
   instructionProvenanceFor,
   sanitizePostgresJson,
   withConversationEventLock
-} from "./chunk-HIRIWTWD.js";
+} from "./chunk-ZFS67WIR.js";
 import {
   SANDBOX_WORKSPACE_ROOT,
   getStateAdapter,
   sleep
-} from "./chunk-4YQ6I6VF.js";
+} from "./chunk-5G34IEK2.js";
 import {
   botConfig,
   escapeXml,
   resolveGatewayModel,
   unwrapCurrentInstruction
-} from "./chunk-XCZ6COFO.js";
+} from "./chunk-UG6ZYPBI.js";
 import {
   toStoredSlackActor
 } from "./chunk-HZF5P5UN.js";
@@ -44,7 +44,7 @@ import {
   setSpanAttributes,
   toOptionalNumber,
   toOptionalString
-} from "./chunk-XWPA5KZF.js";
+} from "./chunk-T6Z5S6PQ.js";
 
 // src/chat/turn-context-tag.ts
 var TURN_CONTEXT_TAG = "runtime-turn-context";
@@ -1811,6 +1811,8 @@ var agentTurnSessionSummarySchema = z2.object({
   conversationId: z2.string().min(1),
   cumulativeDurationMs: nonNegativeNumberSchema,
   cumulativeUsage: agentTurnUsageSchema.optional(),
+  // TODO(#1267): Remove destination/source and their Redis write paths once
+  // SQL-only readers are deployed; existing records do not need to expire.
   destination: destinationSchema.optional(),
   dispatchId: z2.string().min(1).optional(),
   dispatchOutcome: z2.enum(["blocked", "completed", "failed"]).optional(),

package/dist/{chunk-MW2QRPGW.js → chunk-RB4NJKEX.js}

@@ -1,6 +1,6 @@
 import {
   DEFAULT_SQL_STATEMENT_TIMEOUT_MS
-} from "./chunk-XCZ6COFO.js";
+} from "./chunk-UG6ZYPBI.js";
 import {
   juniorDestinations,
   timestamptz

package/dist/{chunk-Y6JNHTRD.js → chunk-SYCX4DOK.js}

@@ -22,7 +22,7 @@ import {
   persistThreadStateById,
   stripRuntimeTurnContext,
   updateConversationStats
-} from "./chunk-NVVBEJUB.js";
+} from "./chunk-POBSY47Q.js";
 import {
   createPluginConversationEvents,
   createPluginEmbedder,
@@ -30,26 +30,26 @@ import {
   createPluginModel,
   createPluginState,
   getPlugins
-} from "./chunk-KLBYCSLJ.js";
+} from "./chunk-WPPXIAFB.js";
 import {
   getDb,
   sameActorIdentity
-} from "./chunk-HIRIWTWD.js";
+} from "./chunk-ZFS67WIR.js";
 import {
   getStateAdapter
-} from "./chunk-4YQ6I6VF.js";
+} from "./chunk-5G34IEK2.js";
 import {
   ProviderError,
   findProviderError,
   getProviderErrorAttributes,
   getProviderErrorUserMessage
-} from "./chunk-XCZ6COFO.js";
+} from "./chunk-UG6ZYPBI.js";
 import {
   parseSlackMessageTs
 } from "./chunk-F3B2YJ76.js";
 import {
   buildTurnFailureResponse
-} from "./chunk-XWPA5KZF.js";
+} from "./chunk-T6Z5S6PQ.js";
 
 // src/chat/runtime/delivered-turn-state.ts
 function buildDeliveredTurnStatePatch(args) {
@@ -82,6 +82,25 @@ import {
   isPrivateSource,
   pluginRunContextSchema
 } from "@sentry/junior-plugin-api";
+
+// src/chat/services/turn-session-routing.ts
+async function resolveTurnSessionRouting(args) {
+  const conversationStore = args.conversationStore ?? (await import("./db-66E7VDNC.js")).getConversationStore();
+  const conversation = await conversationStore.get({
+    conversationId: args.conversationId
+  });
+  if (!conversation?.destination || !conversation.sessionSource) {
+    throw new Error(
+      `Conversation ${args.conversationId} is missing durable routing metadata`
+    );
+  }
+  return {
+    destination: conversation.destination,
+    source: conversation.sessionSource
+  };
+}
+
+// src/chat/plugins/task-runner.ts
 var PLUGIN_TASK_LOCK_TTL_MS = 5 * 60 * 1e3;
 function isRecord(value) {
   return Boolean(value && typeof value === "object" && !Array.isArray(value));
@@ -210,9 +229,8 @@ function messageExistedAtRunCompletion(message, completedAtMs) {
   const messageTimestampMs = conversationMessageTimestampMs(message);
   return messageTimestampMs !== void 0 && messageTimestampMs <= completedAtMs;
 }
-async function loadConversationContextTranscriptEntries(record) {
-  const source = record.source;
-  if (source?.platform !== "slack" || isPrivateSource(source)) {
+async function loadConversationContextTranscriptEntries(record, source) {
+  if (source.platform !== "slack" || isPrivateSource(source)) {
     return [];
   }
   const state = await getPersistedThreadState(record.conversationId);
@@ -274,30 +292,28 @@ async function loadPluginRun(params) {
   if (record.state !== "completed") {
     throw new Error("Completed plugin task session record is not completed");
   }
-  if (!record.source || !record.destination) {
-    throw new Error(
-      "Completed plugin task session record is missing source or destination"
-    );
-  }
+  const routing = await resolveTurnSessionRouting({
+    conversationId: params.conversationId
+  });
   const runEntries = turnMessagesWithProvenance(record).map(
     ({ message, provenance }) => runTranscriptEntry(message, provenance, record.actor)
   ).filter((entry) => Boolean(entry));
   const runMessageTexts = new Set(
     runEntries.filter((entry) => entry.type === "message").map((entry) => entry.text)
   );
-  const contextEntries = (await loadConversationContextTranscriptEntries(record)).filter(
+  const contextEntries = (await loadConversationContextTranscriptEntries(record, routing.source)).filter(
     (entry) => entry.type !== "message" || !runMessageTexts.has(entry.text)
   );
   return pluginRunContextSchema.parse({
     completedAtMs: record.updatedAtMs,
     conversationId: record.conversationId,
-    destination: record.destination,
+    destination: routing.destination,
     // Derived from the full run provenance on the record, not the sliced or
     // stripped transcript, so it reflects every committed instruction actor.
     actors: record.actors,
     ...record.actor ? { actor: record.actor } : {},
     runId: record.sessionId,
-    source: record.source,
+    source: routing.source,
     transcript: [...contextEntries, ...runEntries]
   });
 }
@@ -589,6 +605,7 @@ export {
   getTurnUserMessageId,
   getTurnUserSlackMessageTs,
   getTurnUserReplyAttachmentContext,
+  resolveTurnSessionRouting,
   scheduleSessionCompletedPluginTasks,
   processPluginTask,
   getInterruptionMarker,

package/dist/{chunk-XWPA5KZF.js → chunk-T6Z5S6PQ.js}

@@ -9,7 +9,7 @@ import {
 } from "./chunk-6GWA276C.js";
 import {
   getDeploymentTelemetryAttributes
-} from "./chunk-BG3KWWDJ.js";
+} from "./chunk-5PNJMOY5.js";
 
 // src/chat/logging.ts
 import path from "path";

package/dist/{chunk-XCZ6COFO.js → chunk-UG6ZYPBI.js}

@@ -3,7 +3,7 @@ import {
   toCanonicalInputMessage,
   toCanonicalOutputMessage,
   toGenAiMessagesTraceAttributes
-} from "./chunk-22Z6MGMK.js";
+} from "./chunk-YNFERGKP.js";
 import {
   extractGenAiUsageAttributes,
   logException,
@@ -11,7 +11,7 @@ import {
   normalizeGenAiFinishReason,
   serializeGenAiAttribute,
   withSpan
-} from "./chunk-XWPA5KZF.js";
+} from "./chunk-T6Z5S6PQ.js";
 
 // src/chat/config.ts
 import { getModel as getModel2 } from "@earendil-works/pi-ai/compat";
@@ -42,6 +42,29 @@ import {
 
 // src/chat/pi/client.ts
 import { createGatewayProvider } from "@ai-sdk/gateway";
+
+// src/chat/pi/gateway-auth.ts
+import { getVercelOidcToken } from "@vercel/oidc";
+var MISSING_GATEWAY_CREDENTIALS_ERROR = "Missing AI gateway credentials (enable Vercel OIDC or set AI_GATEWAY_API_KEY)";
+async function resolveGatewayCredential() {
+  try {
+    const oidcToken = toOptionalTrimmed(await getVercelOidcToken());
+    if (oidcToken) {
+      return { mode: "oidc", token: oidcToken };
+    }
+  } catch {
+  }
+  const apiKey = toOptionalTrimmed(getEnvApiKey("vercel-ai-gateway"));
+  if (apiKey) {
+    return { mode: "api_key", token: apiKey };
+  }
+  return void 0;
+}
+async function getGatewayApiKey() {
+  return (await resolveGatewayCredential())?.token;
+}
+
+// src/chat/pi/client.ts
 import {
   embedMany,
   generateObject,
@@ -332,17 +355,10 @@ var EMBEDDING_INPUT_COST_USD_PER_MILLION_TOKENS = {
   "voyage/voyage-3.5": 0.06,
   "voyage/voyage-3.5-lite": 0.02
 };
-var MISSING_GATEWAY_CREDENTIALS_ERROR = "Missing AI gateway credentials (AI_GATEWAY_API_KEY or VERCEL_OIDC_TOKEN)";
 function embeddingCostUsd(modelId, inputTokens) {
   const costPerMillionTokens = EMBEDDING_INPUT_COST_USD_PER_MILLION_TOKENS[modelId];
   return costPerMillionTokens === void 0 ? void 0 : inputTokens * costPerMillionTokens / 1e6;
 }
-function getGatewayApiKey() {
-  return toOptionalTrimmed(getEnvApiKey("vercel-ai-gateway")) ?? toOptionalTrimmed(process.env.VERCEL_OIDC_TOKEN);
-}
-function getPiGatewayApiKey() {
-  return getGatewayApiKey();
-}
 function extractText(message) {
   return (message.content ?? []).filter((part) => part.type === "text" && typeof part.text === "string").map((part) => part.text ?? "").join("").trim();
 }
@@ -357,8 +373,9 @@ function resolveGatewayModel(modelId) {
 }
 async function completeText(params) {
   const model = resolveGatewayModel(params.modelId);
-  const apiKey = getPiGatewayApiKey();
-  const authMode = toOptionalTrimmed(process.env.AI_GATEWAY_API_KEY) ? "api_key" : toOptionalTrimmed(process.env.VERCEL_OIDC_TOKEN) ? "oidc" : "api_key";
+  const credential = await resolveGatewayCredential();
+  const apiKey = credential?.token;
+  const authMode = credential?.mode ?? "api_key";
   const effectivePrivacy = getCurrentConversationPrivacy() ?? "private";
   const messageAttributeMode = params.messageAttributeMode ?? (effectivePrivacy === "public" ? "content" : "metadata");
   const requestMessagesAttribute = messageAttributeMode === "content" ? serializeGenAiAttribute(params.messages.map(toCanonicalInputMessage)) : void 0;
@@ -490,8 +507,10 @@ function bestEffortObjectCompletionCost(modelId, usage) {
   }
 }
 async function completeObject(params) {
-  const apiKey = getGatewayApiKey();
-  const provider = createGatewayProvider(apiKey ? { apiKey } : {});
+  const credential = await resolveGatewayCredential();
+  const provider = createGatewayProvider(
+    credential ? { apiKey: credential.token } : {}
+  );
   let result;
   try {
     result = await withSpan(
@@ -528,6 +547,7 @@ async function completeObject(params) {
         "gen_ai.output.type": "json",
         "server.address": GEN_AI_SERVER_ADDRESS,
         "server.port": GEN_AI_SERVER_PORT,
+        "gen_ai.provider.auth_mode": credential?.mode ?? "api_key",
         ...params.thinkingLevel ? { "gen_ai.request.reasoning.level": params.thinkingLevel } : {},
         ...params.temperature !== void 0 ? { "gen_ai.request.temperature": params.temperature } : {},
         ...params.maxTokens !== void 0 ? { "gen_ai.request.max_tokens": params.maxTokens } : {}
@@ -551,8 +571,10 @@ async function embedTexts(params) {
   if (texts.length === 0 || texts.some((text) => text.length === 0)) {
     throw new Error("Embedding text is required.");
   }
-  const apiKey = getGatewayApiKey();
-  const provider = createGatewayProvider(apiKey ? { apiKey } : {});
+  const credential = await resolveGatewayCredential();
+  const provider = createGatewayProvider(
+    credential ? { apiKey: credential.token } : {}
+  );
   try {
     const result = await withSpan(
       `${GEN_AI_OPERATION_EMBEDDINGS} ${params.modelId}`,
@@ -591,7 +613,8 @@ async function embedTexts(params) {
         "gen_ai.operation.name": GEN_AI_OPERATION_EMBEDDINGS,
         "gen_ai.request.model": params.modelId,
         "server.address": GEN_AI_SERVER_ADDRESS,
-        "server.port": GEN_AI_SERVER_PORT
+        "server.port": GEN_AI_SERVER_PORT,
+        "gen_ai.provider.auth_mode": credential?.mode ?? "api_key"
       }
     );
     return {
@@ -1008,6 +1031,9 @@ function setSlackReactionConfig(overrides) {
 
 export {
   toOptionalTrimmed,
+  MISSING_GATEWAY_CREDENTIALS_ERROR,
+  resolveGatewayCredential,
+  getGatewayApiKey,
   ProviderError,
   createProviderError,
   isProviderRetryError,
@@ -1025,9 +1051,6 @@ export {
   GEN_AI_PROVIDER_NAME,
   GEN_AI_SERVER_ADDRESS,
   GEN_AI_SERVER_PORT,
-  MISSING_GATEWAY_CREDENTIALS_ERROR,
-  getGatewayApiKey,
-  getPiGatewayApiKey,
   resolveGatewayModel,
   completeText,
   completeObject,