@sentry/junior 0.177.0 → 0.179.0

package/dist/{chunk-2IMQLZHS.js → chunk-RZRYOLCE.js}

@@ -7,7 +7,7 @@ import {
   PluginCredentialFailureError,
   agentNameSchema,
   createPluginAuthOrchestration
-} from "./chunk-ZCYABD7N.js";
+} from "./chunk-3AFVR5UC.js";
 import {
   authorizationId
 } from "./chunk-DIB4GX3G.js";
@@ -32,7 +32,10 @@ import {
   searchSlackUsers,
   selectPluginGrant,
   toMcpProviderError
-} from "./chunk-QLLOX7JY.js";
+} from "./chunk-Q5B3WTGG.js";
+import {
+  getTurnRequestDeadline
+} from "./chunk-4GWXAILB.js";
 import {
   RetryableDeliveryError,
   actorFromRun,
@@ -48,7 +51,7 @@ import {
   getSlackMessagePermalink,
   resolveBaseUrl,
   uploadFilesToConversation
-} from "./chunk-CAWBLVBY.js";
+} from "./chunk-2HIPYNQI.js";
 import {
   parseSandboxEgressAuthRequiredSignal,
   parseSandboxEgressPermissionDeniedSignal,
@@ -59,7 +62,7 @@ import {
   SCHEDULED_TASK_SYSTEM_ACTOR,
   compactEventTask,
   createEventTask,
-  createSchedulerSqlStore,
+  createScheduledTask,
   deleteEventTask,
   eventNamespaceSchema,
   eventTaskListToolResultSchema,
@@ -67,30 +70,29 @@ import {
   eventTaskSuccess,
   eventTaskToolResultSchema,
   getEventTask,
-  getFirstRunAtMs,
   getResourceEventCatalog,
-  getZonedDateTimeParts,
   incrementStat,
   injectContinuationToolName,
   juniorToolOutputSchema,
   listEventTasksForTeam,
+  listScheduledTasksForTeam,
   makeStructuredToolOutput,
   normalizeEventIdentifier,
   pluginSupportsEvent,
+  readScheduledTask,
   registeredEventTaskTriggerSchema,
   registeredEventTypeSchema,
   registeredResourceTypeSchema,
   requireEventTaskSlackContext,
   requireSupportedEventTaskTrigger,
-  resolveLocalScheduleAtMs,
   saveEventTask,
-  scheduledTaskAttributes,
+  saveScheduledTask,
   storeAttachments,
   writableEventTask
-} from "./chunk-4TRHPYTL.js";
+} from "./chunk-XZY6G5YZ.js";
 import {
   parseSlackThreadId
-} from "./chunk-3FWXQZJJ.js";
+} from "./chunk-FAS6AIMF.js";
 import {
   AGENTS_REMOVAL_NOTICE,
   AGENTS_REPLACEMENT_NOTICE,
@@ -160,23 +162,18 @@ import {
   stripRuntimeTurnContext,
   trimTrailingAssistantMessages,
   truncateText
-} from "./chunk-I7PKGMKI.js";
+} from "./chunk-FIDMHAO6.js";
 import {
   bindSandboxFileSystem,
   createSandboxSession,
+  dependencies,
   getSandboxResources,
-  getVercelSandboxCredentials,
-  isAlreadyExistsError,
   isMissingError,
-  isSandboxCommandStreamInterruptedError,
-  isSandboxMissingError,
-  isSandboxUnavailableError,
-  isSnapshottingError,
+  postinstall,
   resolve,
-  stopSession,
-  throwSandboxOperationError,
-  wrapSandboxSetupError
-} from "./chunk-N4YEVOEC.js";
+  setSnapshotSpanAttributes,
+  stopSession
+} from "./chunk-B6ECUSVX.js";
 import {
   privateTraceResultAttributes
 } from "./chunk-UIE3R5XU.js";
@@ -196,6 +193,7 @@ import {
   createResourceEventSubscription,
   createWorkspace,
   deleteWorkspace,
+  deleteWorkspaceSnapshotBuilders,
   downloadPrivateSlackFile,
   getDashboardTaskLink,
   getFilePermalink,
@@ -207,19 +205,23 @@ import {
   getSlackToolContext,
   getWorkspace,
   getWorkspaceByName,
+  getWorkspaceSnapshotBuilder,
+  invalidateReadySnapshot,
   isConversationScopedChannel,
   listResourceEventSubscriptions,
   listWorkspaces,
+  loadSnapshotsForProfile,
   normalizeSlackConversationId,
   readActorIdentity,
-  recordResolvedWorkspaceSnapshot,
   requireResourceWatchConversation,
   resolveChannelCapabilities,
+  setWorkspaceSnapshot,
+  setWorkspaceSnapshotBuild,
   tryWorkspaceRepoCheckoutPath,
   updateWorkspace,
   withSlackRetries,
   workspaceRepoCheckoutPath
-} from "./chunk-PA7QDS7P.js";
+} from "./chunk-3I7XE3PA.js";
 import {
   KNOWN_CONVERSATION_EVENT_TYPES,
   contextProvenance,
@@ -231,29 +233,48 @@ import {
   instructionActors,
   instructionProvenanceFor,
   sameActorIdentity
-} from "./chunk-LPMLAJYR.js";
+} from "./chunk-VP4OVRDD.js";
 import {
   juniorArtifacts,
-  juniorIdentities
-} from "./chunk-WCQUKX74.js";
+  juniorIdentities,
+  juniorSchedulerRuns
+} from "./chunk-R6U7N4FS.js";
 import {
   SANDBOX_DATA_ROOT,
   SANDBOX_REPOS_ROOT,
   SANDBOX_SKILLS_ROOT,
   SANDBOX_WORKSPACE_ROOT,
+  WorkspaceSnapshotWaitingError,
   buildCommandScript,
   buildNonInteractiveShellScript,
+  create,
   ensureDockerDaemon,
+  getVercelSandboxCredentials,
   hash,
+  isAbortError,
+  isAlreadyExistsError,
+  isSandboxApiTransientError,
+  isSandboxCommandStreamInterruptedError,
+  isSandboxMissingError,
+  isSandboxUnavailableError,
+  isSnapshottingError,
+  isStale,
+  isWorkspaceSnapshotWaitingError,
+  isWorkspaceSnapshotWaitingResult,
   runNonInteractiveCommand,
   sandboxSkillDir,
   sandboxSkillFile,
   sandboxSkillPathResolution,
-  sleep
-} from "./chunk-Q362TECJ.js";
+  sleep,
+  throwSandboxOperationError,
+  workspaceNameFromWaitingResult,
+  wrapSandboxSetupError
+} from "./chunk-JMJNFEDC.js";
 import {
-  getStateAdapter
-} from "./chunk-VGDOEKO2.js";
+  fenceLock,
+  getStateAdapter,
+  withLock
+} from "./chunk-3TM3FYLQ.js";
 import {
   ACTIVE_TURN_COMPACTION_SUMMARY_PREFIX,
   COMPACTION_SUMMARY_PREFIX,
@@ -286,7 +307,7 @@ import {
   resolveGatewayCredential,
   resolveGatewayModel,
   unwrapCurrentInstruction
-} from "./chunk-DLTP6TUJ.js";
+} from "./chunk-GENV6KF2.js";
 import {
   canExposeConversationPayload,
   resolveConversationPrivacy,
@@ -296,16 +317,16 @@ import {
   toGenAiMessagesTraceAttributes,
   toGenAiPayloadMetadata,
   toGenAiPayloadTraceAttributes
-} from "./chunk-7PZDAXIK.js";
+} from "./chunk-XSPSCWLH.js";
 import {
   discoverSkills,
   findSkillByName,
   loadSkillsByName,
   parseSkillInvocation
-} from "./chunk-6KGMMVHF.js";
+} from "./chunk-ZQMG3CL5.js";
 import {
   pluginCatalogRuntime
-} from "./chunk-J2EWL6GJ.js";
+} from "./chunk-YFNAMRGE.js";
 import {
   CredentialUnavailableError,
   OAuthProviderError,
@@ -313,7 +334,7 @@ import {
   getOAuthProviderErrorAttributes,
   resolveAuthTokenPlaceholder,
   resolvePluginCommandEnv
-} from "./chunk-7B6NW4P7.js";
+} from "./chunk-SLGGOASN.js";
 import {
   credentialUserSubjectId
 } from "./chunk-CGA4ERJ5.js";
@@ -343,7 +364,7 @@ import {
   summarizeMessageText,
   withLogContext,
   withSpan
-} from "./chunk-7CVYXUOJ.js";
+} from "./chunk-HQNE5APD.js";
 import {
   startInactiveSpan,
   withActiveSpan
@@ -987,6 +1008,97 @@ function nextEmptyOutputContinuation(args) {
   return isContinuablePiBoundary(messages) ? { kind: "retry", messages } : { kind: "exhausted" };
 }
 
+// src/chat/services/workspace-snapshot-wait.ts
+import { randomUUID } from "crypto";
+var SWITCH_WORKSPACE_TOOL = "switchWorkspace";
+function pendingWorkspaceSnapshotWait(messages) {
+  for (let index = messages.length - 1; index >= 0; index -= 1) {
+    const message = messages[index];
+    if (!isToolResultMessage(message)) break;
+    if (message.toolName !== SWITCH_WORKSPACE_TOOL) continue;
+    const name = workspaceNameFromWaitingResult(message.details);
+    return name ? { name } : null;
+  }
+  return null;
+}
+async function continueWorkspaceSnapshotWait(args) {
+  if (!isContinuablePiBoundary(args.messages)) return { kind: "none" };
+  const pending = pendingWorkspaceSnapshotWait(args.messages);
+  if (!pending) return { kind: "none" };
+  const tool = args.tools.find((entry) => entry.name === SWITCH_WORKSPACE_TOOL);
+  if (!tool) return { kind: "none" };
+  const toolCallId = randomUUID();
+  const assistantMessage = {
+    role: "assistant",
+    api: "openai-responses",
+    provider: "openai",
+    model: "host-continue",
+    content: [
+      {
+        type: "toolCall",
+        id: toolCallId,
+        name: SWITCH_WORKSPACE_TOOL,
+        arguments: { name: pending.name }
+      }
+    ],
+    usage: {
+      input: 0,
+      output: 0,
+      cacheRead: 0,
+      cacheWrite: 0,
+      totalTokens: 0,
+      cost: {
+        input: 0,
+        output: 0,
+        cacheRead: 0,
+        cacheWrite: 0,
+        total: 0
+      }
+    },
+    timestamp: Date.now(),
+    stopReason: "toolUse"
+  };
+  let result;
+  try {
+    result = await tool.execute(
+      toolCallId,
+      { name: pending.name },
+      args.signal
+    );
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    const toolResultMessage2 = {
+      role: "toolResult",
+      toolCallId,
+      toolName: SWITCH_WORKSPACE_TOOL,
+      content: [{ type: "text", text: message }],
+      details: { error: message },
+      isError: true,
+      timestamp: Date.now()
+    };
+    return {
+      kind: "failed",
+      error,
+      messages: [...args.messages, assistantMessage, toolResultMessage2]
+    };
+  }
+  const toolResultMessage = {
+    role: "toolResult",
+    toolCallId,
+    toolName: SWITCH_WORKSPACE_TOOL,
+    content: result.content,
+    details: result.details,
+    isError: false,
+    timestamp: Date.now()
+  };
+  const messages = [
+    ...args.messages,
+    assistantMessage,
+    toolResultMessage
+  ];
+  return isWorkspaceSnapshotWaitingResult(result.details) ? { kind: "waiting", messages } : { kind: "ready", messages };
+}
+
 // src/chat/agent/retry-usage.ts
 function getDiscardedRetryUsage(messages, retryMessages) {
   const keepsExactPrefix = retryMessages.length <= messages.length && retryMessages.every((message, index) => message === messages[index]);
@@ -2671,7 +2783,7 @@ function formatSandboxCommandResult(params) {
 import fs4 from "fs/promises";
 
 // src/chat/sandbox/egress/session.ts
-import { createHmac, randomUUID, timingSafeEqual } from "crypto";
+import { createHmac, randomUUID as randomUUID2, timingSafeEqual } from "crypto";
 var SANDBOX_EGRESS_PROXY_PATH = "/api/internal/sandbox-egress";
 var SANDBOX_EGRESS_TOKEN_VERSION = "v1";
 var SANDBOX_EGRESS_HMAC_CONTEXT = "junior.sandbox_egress.v1";
@@ -2743,7 +2855,7 @@ function createSandboxEgressCredentialToken(input) {
     credentials: input.credentials,
     egressId: input.egressId,
     expiresAtMs: now + ttlMs2,
-    contextId: randomUUID()
+    contextId: randomUUID2()
   };
   const payload = `${SANDBOX_EGRESS_TOKEN_VERSION}.${base64Url(
     JSON.stringify(context)
@@ -2960,11 +3072,11 @@ async function resolveSandboxCommandEnvironment() {
 }
 
 // src/chat/sandbox/session.ts
-import { randomUUID as randomUUID2 } from "crypto";
-import { Sandbox } from "@vercel/sandbox";
+import { randomUUID as randomUUID4 } from "crypto";
+import { Sandbox as Sandbox2 } from "@vercel/sandbox";
 
 // src/chat/sandbox/prepare-workspace.ts
-async function prepareWorkspaceSnapshot(params) {
+async function prepareWorkspaceRepositories(params) {
   const { sandbox, workspace, signal } = params;
   signal?.throwIfAborted();
   await params.applyNetworkPolicy(sandbox);
@@ -2972,15 +3084,54 @@ async function prepareWorkspaceSnapshot(params) {
   if (params.removeCredentialRoute) {
     await sandbox.update({ networkPolicy: "allow-all" });
   }
-  if (!workspace.setupScript.trim()) return;
-  const result = await sandbox.runCommand({
+}
+function workspaceSetupCommand(workspace) {
+  return {
     cmd: "bash",
     args: ["-euo", "pipefail", "-c", workspace.setupScript],
     cwd: SANDBOX_WORKSPACE_ROOT,
     env: {
       JUNIOR_REPOS_ROOT: SANDBOX_REPOS_ROOT,
       JUNIOR_WORKSPACE_ROOT: SANDBOX_WORKSPACE_ROOT
-    },
+    }
+  };
+}
+function workspaceSnapshotSetupCommand(workspace, buildId) {
+  const stateRoot = `/tmp/junior-snapshot-build-${buildId}`;
+  const wrapper = [
+    `mkdir -p "${stateRoot}"`,
+    `exec 9>"${stateRoot}/lock"`,
+    "flock 9",
+    `if test -f "${stateRoot}/exit"; then exit "$(cat "${stateRoot}/exit")"; fi`,
+    "set +e",
+    'bash -euo pipefail -c "$1"',
+    "status=$?",
+    `printf '%s\\n' "$status" > "${stateRoot}/exit"`,
+    'exit "$status"'
+  ].join("\n");
+  return {
+    cmd: "bash",
+    args: [
+      "-euo",
+      "pipefail",
+      "-c",
+      wrapper,
+      "junior-setup",
+      workspace.setupScript
+    ],
+    cwd: SANDBOX_WORKSPACE_ROOT,
+    env: {
+      JUNIOR_REPOS_ROOT: SANDBOX_REPOS_ROOT,
+      JUNIOR_WORKSPACE_ROOT: SANDBOX_WORKSPACE_ROOT
+    }
+  };
+}
+async function prepareWorkspaceSnapshot(params) {
+  const { sandbox, workspace, signal } = params;
+  await prepareWorkspaceRepositories(params);
+  if (!workspace.setupScript.trim()) return;
+  const result = await sandbox.runCommand({
+    ...workspaceSetupCommand(workspace),
     signal
   });
   if (result.exitCode !== 0) {
@@ -2990,6 +3141,486 @@ async function prepareWorkspaceSnapshot(params) {
   }
 }
 
+// src/chat/sandbox/snapshot/workspace.ts
+import { randomUUID as randomUUID3 } from "crypto";
+import { Sandbox } from "@vercel/sandbox";
+var BUILD_TIMEOUT_MS = 60 * 60 * 1e3;
+var BUILD_TIMEOUT_ERROR = "Workspace snapshot build timed out after 1 hour";
+var BUILD_LOCK_TTL_MS = 2 * 60 * 1e3;
+var BUILD_LOCK_PREFIX = "junior:workspace_snapshot_start";
+var WAIT_POLL_MS = 5e3;
+var TRANSIENT_API_RETRY_MS = 2e3;
+var BUILD_COMMAND_TIMEOUT_MS = 10 * 60 * 1e3;
+var BUILD_COMMAND_TIMEOUT_ERROR = "Workspace snapshot build phase timed out after 10 minutes";
+var COMMAND_STATUS_POLL_TIMEOUT_MS = 1e3;
+var WAIT_YIELD_BUFFER_MS = 4e4;
+function isCancelOrTransient(error) {
+  return isAbortError(error) || isSandboxApiTransientError(error);
+}
+function buildLockKey(profileHash) {
+  return `${BUILD_LOCK_PREFIX}:${profileHash}`;
+}
+function builderName() {
+  return `junior-ws-${randomUUID3()}`;
+}
+async function snapshotFromSql(workspaceId, value, staleSnapshotId) {
+  const { ready } = await loadSnapshotsForProfile(
+    getDb(),
+    workspaceId,
+    value.hash
+  );
+  if (!ready) return null;
+  if (ready.id === staleSnapshotId || isStale(value, ready.generatedAt.getTime())) {
+    const ownerName = await invalidateReadySnapshot({
+      workspaceId,
+      profileHash: value.hash,
+      snapshotId: ready.id
+    });
+    try {
+      await deleteBuilder(ownerName);
+    } catch (error) {
+      logException(error, "sandbox.workspace_snapshot.builder.delete_failed", {
+        "app.workspace.id": workspaceId
+      });
+    }
+    return null;
+  }
+  return {
+    snapshotId: ready.id,
+    profileHash: ready.profileHash,
+    dependencyCount: value.dependencyCount,
+    cacheHit: true,
+    resolveOutcome: "cache_hit",
+    createdAtMs: ready.generatedAt.getTime(),
+    buildDurationMs: ready.buildDurationMs
+  };
+}
+function activeBuild(build) {
+  if (!build || build.status !== "building" || !build.sandboxName) return null;
+  return build;
+}
+async function deleteBuilder(sandboxName) {
+  if (!sandboxName) return;
+  await deleteWorkspaceSnapshotBuilders([sandboxName]);
+}
+function workspaceDeletedError(workspace) {
+  return new Error(
+    `Workspace ${workspace.name} was deleted while its snapshot was building`
+  );
+}
+function requireBuildWrite(written, workspace) {
+  if (!written) {
+    throw new Error(
+      `Workspace ${workspace.name} snapshot build lost SQL ownership`
+    );
+  }
+}
+async function markFailed(workspace, build, error, beforeWrite) {
+  try {
+    await beforeWrite();
+    const written = await setWorkspaceSnapshotBuild(workspace.id, {
+      ...build,
+      status: "failed",
+      error: error instanceof Error ? error.message : String(error)
+    });
+    requireBuildWrite(written, workspace);
+  } catch (persistError) {
+    logException(
+      persistError,
+      "sandbox.workspace_snapshot.failure_persist_failed",
+      { "app.workspace.id": workspace.id }
+    );
+    return;
+  }
+  try {
+    await deleteBuilder(build.sandboxName);
+  } catch (cleanupError) {
+    logException(
+      cleanupError,
+      "sandbox.workspace_snapshot.builder.delete_failed",
+      { "app.workspace.id": workspace.id }
+    );
+  }
+}
+async function requireRemainingBuildTime(workspace, build, beforeWrite) {
+  const remainingMs = build.startedAt.getTime() + BUILD_TIMEOUT_MS - Date.now();
+  if (remainingMs > 0) return remainingMs;
+  await markFailed(workspace, build, BUILD_TIMEOUT_ERROR, beforeWrite);
+  throw new Error(BUILD_TIMEOUT_ERROR);
+}
+async function finishBuild(workspace, value, signal, beforeWrite) {
+  const { build: loaded } = await loadSnapshotsForProfile(
+    getDb(),
+    workspace.id,
+    value.hash
+  );
+  const build = activeBuild(loaded);
+  if (!build?.commandId || !build.sandboxName) return null;
+  try {
+    await requireRemainingBuildTime(workspace, build, beforeWrite);
+    const sandbox = await getWorkspaceSnapshotBuilder(
+      build.sandboxName,
+      signal
+    );
+    const command = await sandbox.getCommand(build.commandId, { signal });
+    const pollSignal = AbortSignal.timeout(COMMAND_STATUS_POLL_TIMEOUT_MS);
+    const waitSignal = signal ? AbortSignal.any([signal, pollSignal]) : pollSignal;
+    let finished;
+    try {
+      finished = await command.wait({ signal: waitSignal });
+    } catch (error) {
+      if (pollSignal.aborted && !signal?.aborted) return null;
+      throw error;
+    }
+    if (finished.exitCode !== 0) {
+      const error = (await finished.stderr({ signal })).trim() || `exit ${finished.exitCode}`;
+      throw new Error(
+        `Workspace ${workspace.name} snapshot setup failed: ${error}`
+      );
+    }
+    await requireRemainingBuildTime(workspace, build, beforeWrite);
+    const snapshot = await sandbox.snapshot({ signal });
+    await requireRemainingBuildTime(workspace, build, beforeWrite);
+    const createdAtMs = Date.now();
+    const buildDurationMs = Math.max(
+      0,
+      createdAtMs - build.startedAt.getTime()
+    );
+    await beforeWrite();
+    const result = await setWorkspaceSnapshot(
+      workspace.id,
+      {
+        id: snapshot.snapshotId,
+        generatedAt: new Date(createdAtMs),
+        buildDurationMs,
+        profileHash: value.hash
+      },
+      { buildId: build.id }
+    );
+    requireBuildWrite(result.written, workspace);
+    try {
+      await deleteWorkspaceSnapshotBuilders(result.replacedBuilderNames);
+    } catch (error) {
+      logException(error, "sandbox.workspace_snapshot.builder.delete_failed", {
+        "app.workspace.id": workspace.id,
+        "app.sandbox.snapshot.builder_count": result.replacedBuilderNames.length
+      });
+    }
+    return {
+      snapshotId: snapshot.snapshotId,
+      profileHash: value.hash,
+      dependencyCount: value.dependencyCount,
+      cacheHit: false,
+      resolveOutcome: "rebuilt",
+      rebuildReason: "cache_miss",
+      createdAtMs,
+      buildDurationMs
+    };
+  } catch (error) {
+    if (error instanceof Error && error.message === BUILD_TIMEOUT_ERROR) {
+      throw error;
+    }
+    if (isCancelOrTransient(error)) throw error;
+    await markFailed(workspace, build, error, beforeWrite);
+    throw error;
+  }
+}
+async function startBuild(params) {
+  const { workspace, value, signal } = params;
+  const credentials = getVercelSandboxCredentials();
+  const resources = getSandboxResources();
+  const name = builderName();
+  const buildId = randomUUID3();
+  const startedAt = /* @__PURE__ */ new Date();
+  try {
+    await Sandbox.create({
+      name,
+      persistent: true,
+      timeout: BUILD_TIMEOUT_MS,
+      runtime: params.runtime,
+      signal,
+      ...credentials ?? {},
+      ...resources ? { resources } : {}
+    });
+    await params.beforeWrite();
+    const written = await setWorkspaceSnapshotBuild(
+      workspace.id,
+      {
+        id: buildId,
+        status: "building",
+        phase: "created",
+        profileHash: value.hash,
+        startedAt,
+        sandboxName: name,
+        commandId: null,
+        error: null
+      },
+      { insertIfMissing: true, expectedRecipe: workspace }
+    );
+    if (!written) {
+      try {
+        await deleteBuilder(name);
+      } catch (cleanupError) {
+        logException(
+          cleanupError,
+          "sandbox.workspace_snapshot.builder.delete_failed",
+          { "app.workspace.id": workspace.id }
+        );
+      }
+      return;
+    }
+  } catch (error) {
+    try {
+      if (!isCancelOrTransient(error)) {
+        try {
+          await params.beforeWrite();
+          await setWorkspaceSnapshotBuild(
+            workspace.id,
+            {
+              id: buildId,
+              status: "failed",
+              phase: "created",
+              profileHash: value.hash,
+              startedAt,
+              sandboxName: name,
+              commandId: null,
+              error: error instanceof Error ? error.message : String(error)
+            },
+            { insertIfMissing: true, expectedRecipe: workspace }
+          );
+        } catch {
+        }
+      }
+    } finally {
+      try {
+        await deleteBuilder(name);
+      } catch (cleanupError) {
+        logException(
+          cleanupError,
+          "sandbox.workspace_snapshot.builder.delete_failed",
+          { "app.workspace.id": workspace.id }
+        );
+      }
+    }
+    throw error;
+  }
+}
+async function continueBuild(params) {
+  const { build: loaded } = await loadSnapshotsForProfile(
+    getDb(),
+    params.workspace.id,
+    params.value.hash
+  );
+  const build = activeBuild(loaded);
+  if (!build?.sandboxName || build.commandId) return;
+  const remainingMs = await requireRemainingBuildTime(
+    params.workspace,
+    build,
+    params.beforeWrite
+  );
+  const commandTimeoutMs = Math.min(remainingMs, BUILD_COMMAND_TIMEOUT_MS);
+  const phaseTimeoutSignal = AbortSignal.timeout(commandTimeoutMs);
+  const phaseSignal = params.signal ? AbortSignal.any([params.signal, phaseTimeoutSignal]) : phaseTimeoutSignal;
+  try {
+    const sandbox = await getWorkspaceSnapshotBuilder(
+      build.sandboxName,
+      phaseSignal
+    );
+    const session = createSandboxSession(sandbox);
+    if (build.phase === "created") {
+      await dependencies(
+        session,
+        params.value.dependencies,
+        phaseSignal,
+        commandTimeoutMs
+      );
+      await postinstall(
+        session,
+        params.value.postinstall,
+        phaseSignal,
+        commandTimeoutMs
+      );
+      await requireRemainingBuildTime(
+        params.workspace,
+        build,
+        params.beforeWrite
+      );
+      await params.beforeWrite();
+      const written2 = await setWorkspaceSnapshotBuild(params.workspace.id, {
+        ...build,
+        phase: "dependencies_installed"
+      });
+      requireBuildWrite(written2, params.workspace);
+      return;
+    }
+    if (build.phase === "dependencies_installed") {
+      await prepareWorkspaceRepositories({
+        sandbox: session,
+        workspace: params.workspace,
+        signal: phaseSignal,
+        applyNetworkPolicy: params.applyNetworkPolicy,
+        prepareRepositories: params.prepareRepositories,
+        removeCredentialRoute: params.removeCredentialRoute
+      });
+      await requireRemainingBuildTime(
+        params.workspace,
+        build,
+        params.beforeWrite
+      );
+      await params.beforeWrite();
+      const written2 = await setWorkspaceSnapshotBuild(params.workspace.id, {
+        ...build,
+        phase: "repositories_prepared"
+      });
+      requireBuildWrite(written2, params.workspace);
+      return;
+    }
+    await params.beforeWrite();
+    const command = await sandbox.runCommand({
+      ...workspaceSnapshotSetupCommand(params.workspace, build.id),
+      detached: true,
+      timeoutMs: remainingMs,
+      signal: phaseSignal
+    });
+    await params.beforeWrite();
+    const written = await setWorkspaceSnapshotBuild(params.workspace.id, {
+      ...build,
+      commandId: command.cmdId,
+      error: null
+    });
+    requireBuildWrite(written, params.workspace);
+  } catch (error) {
+    if (phaseTimeoutSignal.aborted && !params.signal?.aborted) {
+      const timeoutError = new Error(BUILD_COMMAND_TIMEOUT_ERROR, {
+        cause: error
+      });
+      await markFailed(
+        params.workspace,
+        build,
+        timeoutError,
+        params.beforeWrite
+      );
+      throw timeoutError;
+    }
+    if (error instanceof Error && error.message === BUILD_TIMEOUT_ERROR) {
+      throw error;
+    }
+    if (isCancelOrTransient(error)) throw error;
+    await markFailed(params.workspace, build, error, params.beforeWrite);
+    throw error;
+  }
+}
+async function advanceWorkspaceSnapshot(params) {
+  const value = create(params.runtime, params.workspace);
+  if (!value) {
+    throw new Error(
+      `Workspace ${params.workspace.name} has no snapshot profile`
+    );
+  }
+  const sqlCached = await snapshotFromSql(
+    params.workspace.id,
+    value,
+    params.staleSnapshotId
+  );
+  if (sqlCached) return sqlCached;
+  const state = getStateAdapter();
+  await state.connect();
+  const locked = await withLock(
+    state,
+    buildLockKey(value.hash),
+    async (lock) => {
+      const workspace = await getWorkspace(getDb(), params.workspace.id);
+      if (!workspace) throw workspaceDeletedError(params.workspace);
+      const lockedValue = create(params.runtime, workspace) ?? value;
+      if (lockedValue.hash !== value.hash) return null;
+      const beforeWrite = async () => {
+        await fenceLock(state, lock, BUILD_LOCK_TTL_MS);
+      };
+      const sqlInsideLock = await snapshotFromSql(
+        workspace.id,
+        lockedValue,
+        params.staleSnapshotId
+      );
+      if (sqlInsideLock) return sqlInsideLock;
+      const finished = await finishBuild(
+        workspace,
+        lockedValue,
+        params.signal,
+        beforeWrite
+      );
+      if (finished) return finished;
+      const { build: loaded } = await loadSnapshotsForProfile(
+        getDb(),
+        workspace.id,
+        lockedValue.hash
+      );
+      const build = activeBuild(loaded);
+      if (build && !build.commandId) {
+        await continueBuild({
+          ...params,
+          workspace,
+          value: lockedValue,
+          beforeWrite
+        });
+      } else if (!build) {
+        if (loaded?.sandboxName) {
+          try {
+            await deleteBuilder(loaded.sandboxName);
+          } catch (cleanupError) {
+            logException(
+              cleanupError,
+              "sandbox.workspace_snapshot.builder.delete_failed",
+              { "app.workspace.id": workspace.id }
+            );
+          }
+        }
+        await startBuild({
+          workspace,
+          value: lockedValue,
+          runtime: params.runtime,
+          signal: params.signal,
+          beforeWrite
+        });
+      }
+      return null;
+    },
+    { ttlMs: BUILD_LOCK_TTL_MS, keepAlive: true }
+  );
+  return locked.acquired ? locked.value ?? null : null;
+}
+function shouldYieldWait(shouldYield) {
+  if (shouldYield?.()) return true;
+  const deadlineAtMs = getTurnRequestDeadline()?.deadlineAtMs;
+  return deadlineAtMs !== void 0 && Date.now() >= deadlineAtMs - WAIT_YIELD_BUFFER_MS;
+}
+async function resolveWorkspaceSnapshot(params) {
+  for (; ; ) {
+    params.signal?.throwIfAborted();
+    const workspace = await getWorkspace(getDb(), params.workspace.id);
+    if (!workspace) throw workspaceDeletedError(params.workspace);
+    const slice = { ...params, workspace };
+    if (shouldYieldWait(slice.shouldYield)) {
+      throw new WorkspaceSnapshotWaitingError(workspace.name);
+    }
+    let snapshot;
+    try {
+      snapshot = await advanceWorkspaceSnapshot(slice);
+    } catch (error) {
+      if (!isSandboxApiTransientError(error)) throw error;
+      if (shouldYieldWait(slice.shouldYield)) {
+        throw new WorkspaceSnapshotWaitingError(workspace.name);
+      }
+      await sleep(TRANSIENT_API_RETRY_MS, params.signal);
+      continue;
+    }
+    if (shouldYieldWait(slice.shouldYield)) {
+      throw new WorkspaceSnapshotWaitingError(workspace.name);
+    }
+    if (snapshot) return snapshot;
+    await sleep(WAIT_POLL_MS, params.signal);
+  }
+}
+
 // src/chat/sandbox/skill-sync.ts
 import fs3 from "fs/promises";
 import path3 from "path";
@@ -3247,7 +3878,7 @@ function createSandboxRuntime(options) {
   const adaptSandbox = (vercelSandbox) => createSandboxSession(vercelSandbox, {
     onUnavailable: invalidateSession
   });
-  const createSandboxName = () => `${SANDBOX_NAME_PREFIX}${randomUUID2()}`;
+  const createSandboxName = () => `${SANDBOX_NAME_PREFIX}${randomUUID4()}`;
   const preflightNetworkPolicy = (sandboxName) => options.createNetworkPolicy?.(sandboxName);
   const persistSandboxRef = async (nextRef) => {
     if (reportedSandboxRef?.id === nextRef.id && reportedSandboxRef.profileHash === nextRef.profileHash && reportedSandboxRef.workspaceId === nextRef.workspaceId) {
@@ -3339,7 +3970,7 @@ function createSandboxRuntime(options) {
       const networkPolicy = preflightNetworkPolicy(sandboxName);
       try {
         return adaptSandbox(
-          await Sandbox.create({
+          await Sandbox2.create({
             timeout: timeoutMs,
             ...networkPolicy ? { name: sandboxName, persistent: false, networkPolicy } : {},
             source: {
@@ -3360,20 +3991,6 @@ function createSandboxRuntime(options) {
     }
     throw new Error(`Failed to boot sandbox from snapshot ${snapshotId}`);
   };
-  const setSnapshotAttributes = (snapshot) => {
-    setSpanAttributes({
-      "app.sandbox.source": snapshot.snapshotId ? "snapshot" : "created",
-      "app.sandbox.snapshot.cache_hit": snapshot.cacheHit,
-      "app.sandbox.snapshot.resolve_outcome": snapshot.resolveOutcome,
-      ...snapshot.profileHash ? {
-        "app.sandbox.snapshot.profile_hash": snapshot.profileHash
-      } : {},
-      "app.sandbox.snapshot.dependency_count": snapshot.dependencyCount,
-      ...snapshot.rebuildReason ? {
-        "app.sandbox.snapshot.rebuild_reason": snapshot.rebuildReason
-      } : {}
-    });
-  };
   const createSandboxFromResolvedSnapshot = async (params) => {
     const { runtime, snapshot, sandboxCredentials, sandboxName, signal } = params;
     signal?.throwIfAborted();
@@ -3381,7 +3998,7 @@ function createSandboxRuntime(options) {
       const networkPolicy = preflightNetworkPolicy(sandboxName);
       const resources = getSandboxResources();
       const session = adaptSandbox(
-        await Sandbox.create({
+        await Sandbox2.create({
           timeout: timeoutMs,
           runtime,
           ...networkPolicy ? { name: sandboxName, persistent: false, networkPolicy } : {},
@@ -3403,13 +4020,21 @@ function createSandboxRuntime(options) {
     } catch (error) {
       if (!isMissingError(error)) throw error;
       setSpanAttributes({ "app.sandbox.snapshot.rebuild_after_missing": true });
-      const rebuilt = await resolve({
+      const rebuilt = params.workspace ? await resolveWorkspaceSnapshot({
+        workspace: params.workspace,
+        runtime,
+        staleSnapshotId: snapshot.snapshotId,
+        signal,
+        shouldYield: options.shouldYield,
+        applyNetworkPolicy,
+        prepareRepositories: options.onWorkspacePrepare,
+        removeCredentialRoute: Boolean(options.createNetworkPolicy)
+      }) : await resolve({
         runtime,
         timeoutMs,
         forceRebuild: true,
         staleSnapshotId: snapshot.snapshotId,
         signal,
-        workspace: params.workspace,
         prepareWorkspace: params.prepareWorkspace
       });
       if (!rebuilt.snapshotId) throw error;
@@ -3446,15 +4071,22 @@ function createSandboxRuntime(options) {
           "app.sandbox.runtime": runtime
         },
         async () => {
-          const snapshot = await resolve({
+          const snapshot = workspace ? await resolveWorkspaceSnapshot({
+            workspace,
+            runtime,
+            signal,
+            shouldYield: options.shouldYield,
+            applyNetworkPolicy,
+            prepareRepositories: options.onWorkspacePrepare,
+            removeCredentialRoute: Boolean(options.createNetworkPolicy)
+          }) : await resolve({
             runtime,
             timeoutMs,
             signal,
-            workspace,
             prepareWorkspace
           });
           signal?.throwIfAborted();
-          setSnapshotAttributes(snapshot);
+          setSnapshotSpanAttributes(snapshot);
           const created = await createSandboxFromResolvedSnapshot({
             runtime,
             snapshot,
@@ -3464,12 +4096,6 @@ function createSandboxRuntime(options) {
             workspace,
             prepareWorkspace
           });
-          if (workspace) {
-            await recordResolvedWorkspaceSnapshot(
-              workspace.id,
-              created.snapshot
-            );
-          }
           return created.session;
         }
       );
@@ -3488,6 +4114,9 @@ function createSandboxRuntime(options) {
     let networkPolicyKey;
     try {
       networkPolicyKey = await applyNetworkPolicy(createdSandbox);
+      if (workspace) {
+        await options.onWorkspacePrepare?.(createdSandbox, workspace, signal);
+      }
       await prepareSandbox(createdSandbox);
     } catch (error) {
       if (workspace) await stopSession(createdSandbox);
@@ -3551,7 +4180,7 @@ function createSandboxRuntime(options) {
           "app.sandbox.source": "id_hint"
         },
         async () => adaptSandbox(
-          await Sandbox.get({
+          await Sandbox2.get({
             name: ref.id,
             resume: true,
             ...sandboxCredentials ?? {},
@@ -4636,6 +5265,11 @@ async function grepFilesWithRipgrep(params) {
   });
   if (result.exitCode !== 0 && result.exitCode !== 1) {
     const detail = result.stderr.trim() || result.stdout.trim() || "command failed";
+    if (/error parsing glob/i.test(detail)) {
+      throw new ToolInputError(`Invalid glob: ${params.glob ?? ""}`, {
+        cause: new Error(detail)
+      });
+    }
     if (/regex parse error|error parsing regex/i.test(detail)) {
       throw new ToolInputError(`Invalid regex pattern: ${params.pattern}`, {
         cause: new Error(detail)
@@ -5090,6 +5724,7 @@ function createSandbox(options) {
     skills: options.skills,
     referenceFiles: options.referenceFiles,
     timeoutMs: options.timeoutMs,
+    shouldYield: options.shouldYield,
     traceContext,
     commandEnv: credentialEgress ? resolveSandboxCommandEnvironment : void 0,
     createNetworkPolicy: credentialEgress || hasTracePropagationDomains ? (sessionId, traceHeaders) => buildSandboxEgressNetworkPolicy({
@@ -5543,9 +6178,9 @@ function createSandbox(options) {
         return void 0;
       }
       const { fs: fs5 } = await runtime.tools();
-      const workspaceDirectories = activeWorkspace?.repos.map((repo) => tryWorkspaceRepoCheckoutPath(repo.repo)).filter((checkoutPath) => Boolean(checkoutPath)).map(
-        (checkoutPath) => `${SANDBOX_WORKSPACE_ROOT}/${checkoutPath}`
-      ) ?? [];
+      const workspaceDirectories = activeWorkspace?.repos.map((repo) => tryWorkspaceRepoCheckoutPath(repo.repo)).filter(
+        (checkoutPath) => Boolean(checkoutPath)
+      ).map((checkoutPath) => `${SANDBOX_WORKSPACE_ROOT}/${checkoutPath}`) ?? [];
       const directories = workspaceDirectories.length > 0 ? workspaceDirectories : await listRepositoryDirectories(fs5);
       return await resolveRepositoryInstructionsForDirectories({
         directories,
@@ -5985,6 +6620,7 @@ function createAgentSandbox(options) {
     tracePropagation: options.tracePropagation,
     egressSignals: options.egressSignals,
     credentialEgress: options.credentialEgress,
+    shouldYield: options.shouldYield,
     prepare: options.prepareSandbox,
     prepareWorkspace: options.prepareWorkspace,
     onSandboxRefChanged: async (sandboxRef) => {
@@ -8173,6 +8809,296 @@ import { z as z28 } from "zod";
 
 // src/chat/scheduled-tasks/schedule-intent.ts
 import { z as z26 } from "zod";
+
+// src/chat/scheduled-tasks/cadence.ts
+var FORMATTERS = /* @__PURE__ */ new Map();
+function getFormatter(timezone) {
+  const existing = FORMATTERS.get(timezone);
+  if (existing) {
+    return existing;
+  }
+  const formatter = new Intl.DateTimeFormat("en-US", {
+    timeZone: timezone,
+    hour12: false,
+    year: "numeric",
+    month: "2-digit",
+    day: "2-digit",
+    hour: "2-digit",
+    minute: "2-digit",
+    second: "2-digit"
+  });
+  FORMATTERS.set(timezone, formatter);
+  return formatter;
+}
+function normalizeHour(hour) {
+  return hour === 24 ? 0 : hour;
+}
+function getLocalDateWeekday(date) {
+  return new Date(Date.UTC(date.year, date.month - 1, date.day)).getUTCDay();
+}
+function getWeekStart(date) {
+  return addDays(date, -((getLocalDateWeekday(date) + 6) % 7));
+}
+function getZonedDateTimeParts(timestampMs, timezone) {
+  const parts = getFormatter(timezone).formatToParts(new Date(timestampMs));
+  const values = new Map(parts.map((part) => [part.type, part.value]));
+  const year = Number(values.get("year"));
+  const month = Number(values.get("month"));
+  const day = Number(values.get("day"));
+  const hour = normalizeHour(Number(values.get("hour")));
+  const minute = Number(values.get("minute"));
+  const second = Number(values.get("second"));
+  return {
+    year,
+    month,
+    day,
+    hour,
+    minute,
+    second,
+    weekday: getLocalDateWeekday({ year, month, day })
+  };
+}
+function getTimeZoneOffsetMs(timestampMs, timezone) {
+  const parts = getZonedDateTimeParts(timestampMs, timezone);
+  return Date.UTC(
+    parts.year,
+    parts.month - 1,
+    parts.day,
+    parts.hour,
+    parts.minute,
+    parts.second
+  ) - timestampMs;
+}
+function localDateTimeToTimestampMs(args) {
+  const localAsUtcMs = Date.UTC(
+    args.date.year,
+    args.date.month - 1,
+    args.date.day,
+    args.time.hour,
+    args.time.minute,
+    0
+  );
+  const offsets = /* @__PURE__ */ new Set();
+  for (const probeDeltaMs of [
+    -36 * 60 * 60 * 1e3,
+    -12 * 60 * 60 * 1e3,
+    0,
+    12 * 60 * 60 * 1e3,
+    36 * 60 * 60 * 1e3
+  ]) {
+    offsets.add(
+      getTimeZoneOffsetMs(localAsUtcMs + probeDeltaMs, args.timezone)
+    );
+  }
+  const matches = [...offsets].map((offsetMs) => localAsUtcMs - offsetMs).filter((timestampMs) => {
+    const parts = getZonedDateTimeParts(timestampMs, args.timezone);
+    return parts.year === args.date.year && parts.month === args.date.month && parts.day === args.date.day && parts.hour === args.time.hour && parts.minute === args.time.minute;
+  });
+  if (matches.length === 0) {
+    return void 0;
+  }
+  return Math.min(...matches);
+}
+function resolveLocalScheduleAtMs(args) {
+  const date = parseLocalDate(args.date);
+  if (!date) {
+    return void 0;
+  }
+  return localDateTimeToTimestampMs({
+    date,
+    time: args.time,
+    timezone: args.timezone
+  });
+}
+function daysBetween(left, right) {
+  return Math.floor(
+    (Date.UTC(right.year, right.month - 1, right.day) - Date.UTC(left.year, left.month - 1, left.day)) / (24 * 60 * 60 * 1e3)
+  );
+}
+function weeklyRecurrenceMatchesDate(date, start, recurrence) {
+  if (compareDate(date, start) < 0) {
+    return false;
+  }
+  return normalizeWeekdays(recurrence.weekdays).includes(
+    getLocalDateWeekday(date)
+  ) && Math.floor(daysBetween(getWeekStart(start), getWeekStart(date)) / 7) % recurrence.interval === 0;
+}
+function greatestCommonDivisor(left, right) {
+  let a = Math.abs(left);
+  let b = Math.abs(right);
+  while (b !== 0) {
+    [a, b] = [b, a % b];
+  }
+  return a;
+}
+function findNextRunAtMs(args) {
+  const start = parseLocalDate(args.recurrence.startDate);
+  const interval = args.recurrence.interval;
+  if (!start || !Number.isInteger(interval) || interval <= 0) {
+    return void 0;
+  }
+  const searchFrom = compareDate(args.searchFrom, start) < 0 ? start : args.searchFrom;
+  if (args.recurrence.frequency === "daily") {
+    const offsetDays = daysBetween(start, searchFrom);
+    let candidateDate = addDays(
+      start,
+      Math.ceil(offsetDays / interval) * interval
+    );
+    const gregorianCycleDays = 146097;
+    const candidateCount2 = gregorianCycleDays / greatestCommonDivisor(gregorianCycleDays, interval);
+    for (let attempts = 0; attempts < candidateCount2; attempts += 1) {
+      const candidate = buildCandidate({
+        date: candidateDate,
+        recurrence: args.recurrence,
+        timezone: args.timezone
+      });
+      if (candidate !== void 0 && candidate > args.afterMs) {
+        return candidate;
+      }
+      candidateDate = addDays(candidateDate, interval);
+    }
+    return void 0;
+  }
+  if (args.recurrence.frequency === "weekly") {
+    if (normalizeWeekdays(args.recurrence.weekdays).length === 0) {
+      return void 0;
+    }
+    let candidateDate = searchFrom;
+    const gregorianCycleDays = 146097;
+    const cadenceDays = interval * 7;
+    const searchDays = gregorianCycleDays * cadenceDays / greatestCommonDivisor(gregorianCycleDays, cadenceDays);
+    for (let attempts = 0; attempts < searchDays; attempts += 1) {
+      if (weeklyRecurrenceMatchesDate(candidateDate, start, args.recurrence)) {
+        const candidate = buildCandidate({
+          date: candidateDate,
+          recurrence: args.recurrence,
+          timezone: args.timezone
+        });
+        if (candidate !== void 0 && candidate > args.afterMs) {
+          return candidate;
+        }
+      }
+      candidateDate = addDays(candidateDate, 1);
+    }
+    return void 0;
+  }
+  if (args.recurrence.frequency === "monthly") {
+    const startMonth = start.year * 12 + start.month - 1;
+    const searchMonth = searchFrom.year * 12 + searchFrom.month - 1;
+    let candidateMonth = startMonth + Math.ceil((searchMonth - startMonth) / interval) * interval;
+    const gregorianCycleMonths = 4800;
+    const candidateCount2 = gregorianCycleMonths / greatestCommonDivisor(gregorianCycleMonths, interval);
+    for (let attempts = 0; attempts < candidateCount2; attempts += 1) {
+      const candidateDate = {
+        year: Math.floor(candidateMonth / 12),
+        month: candidateMonth % 12 + 1,
+        day: args.recurrence.dayOfMonth ?? 0
+      };
+      if (compareDate(candidateDate, searchFrom) >= 0) {
+        const candidate = buildCandidate({
+          date: candidateDate,
+          recurrence: args.recurrence,
+          timezone: args.timezone
+        });
+        if (candidate !== void 0 && candidate > args.afterMs) {
+          return candidate;
+        }
+      }
+      candidateMonth += interval;
+    }
+    return void 0;
+  }
+  let candidateYear = start.year + Math.ceil((searchFrom.year - start.year) / interval) * interval;
+  const candidateCount = 400 / greatestCommonDivisor(400, interval);
+  for (let attempts = 0; attempts < candidateCount; attempts += 1) {
+    const candidateDate = {
+      year: candidateYear,
+      month: args.recurrence.month ?? 0,
+      day: args.recurrence.dayOfMonth ?? 0
+    };
+    if (compareDate(candidateDate, searchFrom) >= 0) {
+      const candidate = buildCandidate({
+        date: candidateDate,
+        recurrence: args.recurrence,
+        timezone: args.timezone
+      });
+      if (candidate !== void 0 && candidate > args.afterMs) {
+        return candidate;
+      }
+    }
+    candidateYear += interval;
+  }
+  return void 0;
+}
+function getFirstRunAtMs(args) {
+  return findNextRunAtMs({
+    ...args,
+    searchFrom: getLocalDate(args.afterMs, args.timezone)
+  });
+}
+function compareDate(left, right) {
+  return Date.UTC(left.year, left.month - 1, left.day) - Date.UTC(right.year, right.month - 1, right.day);
+}
+function addDays(date, days) {
+  const next = new Date(Date.UTC(date.year, date.month - 1, date.day + days));
+  return {
+    year: next.getUTCFullYear(),
+    month: next.getUTCMonth() + 1,
+    day: next.getUTCDate()
+  };
+}
+function daysInMonth(year, month) {
+  return new Date(Date.UTC(year, month, 0)).getUTCDate();
+}
+function parseLocalDate(value) {
+  const match = /^(\d{4})-(\d{2})-(\d{2})$/.exec(value);
+  if (!match) {
+    return void 0;
+  }
+  const year = Number(match[1]);
+  const month = Number(match[2]);
+  const day = Number(match[3]);
+  if (!Number.isInteger(year) || !Number.isInteger(month) || !Number.isInteger(day) || month < 1 || month > 12 || day < 1 || day > daysInMonth(year, month)) {
+    return void 0;
+  }
+  return { year, month, day };
+}
+function getLocalDate(timestampMs, timezone) {
+  const parts = getZonedDateTimeParts(timestampMs, timezone);
+  return { year: parts.year, month: parts.month, day: parts.day };
+}
+function normalizeWeekdays(values) {
+  return [
+    ...new Set((values ?? []).filter((value) => value >= 0 && value <= 6))
+  ].sort((a, b) => a - b);
+}
+function buildCandidate(args) {
+  return localDateTimeToTimestampMs({
+    date: args.date,
+    time: args.recurrence.time,
+    timezone: args.timezone
+  });
+}
+function getNextRunAtMs(task, scheduledForMs, afterMs = scheduledForMs) {
+  if (task.schedule.kind !== "recurring") {
+    return void 0;
+  }
+  const recurrence = task.schedule.recurrence;
+  if (!recurrence || !Number.isFinite(recurrence.interval) || recurrence.interval <= 0) {
+    return void 0;
+  }
+  const timezone = task.schedule.timezone;
+  const afterDate = getLocalDate(afterMs, timezone);
+  const nextScheduledDate = addDays(getLocalDate(scheduledForMs, timezone), 1);
+  return findNextRunAtMs({
+    afterMs,
+    recurrence,
+    searchFrom: compareDate(afterDate, nextScheduledDate) < 0 ? nextScheduledDate : afterDate,
+    timezone
+  });
+}
+
+// src/chat/scheduled-tasks/schedule-intent.ts
 var localDateSchema = z26.string().regex(/^\d{4}-\d{2}-\d{2}$/, "Use a local date in YYYY-MM-DD format.");
 var localTimeSchema = z26.string().regex(/^([01]\d|2[0-3]):[0-5]\d$/, "Use local time in HH:MM format.");
 var timezoneSchema = z26.string().min(1).max(80).describe(
@@ -8420,6 +9346,41 @@ function compileScheduleIntent(args) {
   };
 }
 
+// src/chat/scheduled-tasks/telemetry.ts
+function scheduledTaskAttributes(task, extras = {}) {
+  return {
+    "app.task.id": task.id,
+    "app.task.type": "scheduled",
+    "app.task.status": task.status,
+    "app.task.schedule.kind": task.schedule.kind,
+    "app.task.schedule.timezone": task.schedule.timezone,
+    "app.task.credential_mode": task.credentialMode,
+    "app.task.destination.channel_id": task.destination.channelId,
+    "app.task.destination.team_id": task.destination.teamId,
+    "app.task.destination.visibility": task.conversationAccess.visibility,
+    "app.task.destination.audience": task.conversationAccess.audience,
+    "messaging.destination.name": task.destination.channelId,
+    ...typeof task.nextRunAtMs === "number" ? { "app.task.next_run_at": new Date(task.nextRunAtMs).toISOString() } : {},
+    ...extras
+  };
+}
+function scheduledTaskRunAttributes(task, run, extras = {}) {
+  return scheduledTaskAttributes(task, {
+    "app.task.run.id": run.id,
+    "app.task.run.status": run.status,
+    "app.task.run.scheduled_for": new Date(run.scheduledForMs).toISOString(),
+    ...run.dispatchId ? { "app.dispatch.id": run.dispatchId } : {},
+    ...run.resultMessageTs ? { "app.task.result_message_ts": run.resultMessageTs } : {},
+    ...extras
+  });
+}
+function logScheduledTaskRunSkipped(task, run, extras = {}) {
+  logInfo(
+    "scheduled_task.run.skipped",
+    scheduledTaskRunAttributes(task, run, extras)
+  );
+}
+
 // src/chat/scheduled-tasks/tool-support.ts
 import { createHash as createHash2 } from "crypto";
 import {
@@ -8561,7 +9522,7 @@ function sameDestination(task, destination) {
 }
 async function getWritableTask(args) {
   const destination = requireActiveConversation(args.context);
-  const task = await schedulerStore(args.context).getTask(args.taskId);
+  const task = await readScheduledTask(getDb(), args.taskId);
   if (!task || task.status === "deleted") {
     throwToolInputError(
       "Scheduled task was not found in the active Slack conversation."
@@ -8632,9 +9593,6 @@ function buildTaskId(args) {
   ).digest("hex").slice(0, 32);
   return `${TASK_ID_PREFIX}_${digest}`;
 }
-function schedulerStore(context) {
-  return context.store;
-}
 function normalizeStatus(value) {
   if (value === "active" || value === "blocked") {
     return value;
@@ -8684,13 +9642,13 @@ function createSlackScheduleCreateTaskTool(context) {
     execute: async (input, options) => {
       const destination = requireActiveConversation(context);
       const actor = requireActor(context, destination);
-      const store = schedulerStore(context);
       const id = buildTaskId({
         actor,
         destination,
         toolCallId: options.toolCallId
       });
-      const existing = await store.getTask(id);
+      const db = getDb();
+      const existing = await readScheduledTask(db, id);
       if (existing) {
         if (!sameDestination(existing, destination) || existing.createdBy.slackUserId !== actor.slackUserId) {
           throwToolInputError("Scheduled task operation identity is invalid.");
@@ -8747,7 +9705,7 @@ function createSlackScheduleCreateTaskTool(context) {
         },
         ...title ? { title } : {}
       };
-      const committed = await store.createTask(task);
+      const committed = await createScheduledTask(db, task);
       if (!sameDestination(committed, destination) || committed.createdBy.slackUserId !== actor.slackUserId) {
         throwToolInputError("Scheduled task operation identity is invalid.");
       }
@@ -8791,7 +9749,7 @@ function createSlackScheduleDeleteTaskTool(context) {
         nextRunAtMs: void 0,
         runNowAtMs: void 0
       };
-      await schedulerStore(context).saveTask(next);
+      await saveScheduledTask(getDb(), next);
       return scheduleTaskToolResult(
         "slackScheduleDeleteTask",
         compactTask(next)
@@ -8873,7 +9831,7 @@ function createSlackScheduleListTasksTool(context) {
       }
       const query = input.query?.trim() || void 0;
       const crossConversation = Boolean(query) || channelId !== void 0 && channelId !== destination.channelId;
-      const matching = (await schedulerStore(context).listTasksForTeam(destination.teamId)).filter((task) => {
+      const matching = (await listScheduledTasksForTeam(getDb(), destination.teamId)).filter((task) => {
         if (task.destination.platform !== "slack") return false;
         if (task.destination.teamId !== destination.teamId) return false;
         if (task.status === "completed") return false;
@@ -8933,7 +9891,7 @@ function createSlackScheduleRunTaskNowTool(context) {
         updatedAtMs: nowMs,
         runNowAtMs: nowMs
       };
-      await schedulerStore(context).saveTask(next);
+      await saveScheduledTask(getDb(), next);
       return scheduleTaskToolResult(
         "slackScheduleRunTaskNow",
         compactTask(next)
@@ -8944,6 +9902,7 @@ function createSlackScheduleRunTaskNowTool(context) {
 
 // src/chat/scheduled-tasks/tools/update.ts
 import { z as z33 } from "zod";
+import { and, eq, inArray } from "drizzle-orm";
 function createSlackScheduleUpdateTaskTool(context) {
   return zodTool({
     approvalMode: "review",
@@ -8973,8 +9932,8 @@ function createSlackScheduleUpdateTaskTool(context) {
     execute: async (input) => {
       const activeDestination = requireActiveConversation(context);
       const actor = requireActor(context, activeDestination);
-      const store = schedulerStore(context);
-      const lookup = await store.getTask(input.task_id);
+      const db = getDb();
+      const lookup = await readScheduledTask(db, input.task_id);
       if (!lookup || lookup.status === "deleted") {
         throwToolInputError("Scheduled task was not found.");
       }
@@ -9011,7 +9970,12 @@ function createSlackScheduleUpdateTaskTool(context) {
       }
       const changingDestination = moveHere && !alreadyHere;
       if (changingDestination) {
-        const incompleteRuns = await store.listIncompleteRunsForTasks([lookup]);
+        const incompleteRuns = await db.select({ id: juniorSchedulerRuns.id }).from(juniorSchedulerRuns).where(
+          and(
+            eq(juniorSchedulerRuns.taskId, lookup.id),
+            inArray(juniorSchedulerRuns.status, ["pending", "running"])
+          )
+        ).limit(1);
         if (incompleteRuns.length > 0) {
           throwToolInputError(
             "Scheduled task cannot be moved while an occurrence is already running. Try again after the current run finishes."
@@ -9077,15 +10041,8 @@ function createSlackScheduleUpdateTaskTool(context) {
           compactTask(lookup)
         );
       }
-      await store.saveTask(next);
-      const committed = await store.getTask(input.task_id);
-      if (!committed) {
-        throwToolInputError("Scheduled task update did not complete.");
-      }
+      const committed = await saveScheduledTask(db, next);
       if (changingDestination) {
-        if (!sameDestination(committed, activeDestination)) {
-          throwToolInputError("Scheduled task move did not complete.");
-        }
         logInfo(
           "scheduled_task.move.completed",
           scheduledTaskAttributes(committed)
@@ -9107,7 +10064,6 @@ function scheduledTaskToolContext(context) {
   return {
     actor: context.actor,
     source: context.source,
-    store: createSchedulerSqlStore(getDb()),
     users: { resolveActor: context.resolveActorIdentity },
     ...context.userText ? { userText: context.userText } : {}
   };
@@ -11730,7 +12686,7 @@ function createSlackThreadReadTool(context) {
 }
 
 // src/chat/tools/user-lookup.ts
-import { and, eq, or, sql } from "drizzle-orm";
+import { and as and2, eq as eq2, or, sql } from "drizzle-orm";
 import { alias } from "drizzle-orm/pg-core";
 import { z as z53 } from "zod";
 var linkedSlackIdentity = alias(juniorIdentities, "user_lookup_slack_identity");
@@ -11796,12 +12752,12 @@ async function storedSlackUserByEmail(teamId, email) {
   const emailNormalized = normalizeIdentityEmail(email);
   if (!emailNormalized) return void 0;
   const identities = await getSqlExecutor().db().select().from(juniorIdentities).where(
-    and(
-      eq(juniorIdentities.provider, "slack"),
-      eq(juniorIdentities.providerTenantId, teamId),
-      eq(juniorIdentities.kind, "user"),
-      eq(juniorIdentities.emailVerified, true),
-      eq(juniorIdentities.emailNormalized, emailNormalized)
+    and2(
+      eq2(juniorIdentities.provider, "slack"),
+      eq2(juniorIdentities.providerTenantId, teamId),
+      eq2(juniorIdentities.kind, "user"),
+      eq2(juniorIdentities.emailVerified, true),
+      eq2(juniorIdentities.emailNormalized, emailNormalized)
     )
   ).limit(2);
   if (identities.length > 1) {
@@ -11853,18 +12809,18 @@ async function resolveSlack(teamId, query) {
 async function resolveStoredProvider(teamId, provider, query) {
   const rows = await getSqlExecutor().db().select({ slack: linkedSlackIdentity }).from(juniorIdentities).innerJoin(
     linkedSlackIdentity,
-    and(
-      eq(linkedSlackIdentity.userId, juniorIdentities.userId),
-      eq(linkedSlackIdentity.kind, "user"),
-      eq(linkedSlackIdentity.provider, "slack"),
-      eq(linkedSlackIdentity.providerTenantId, teamId)
+    and2(
+      eq2(linkedSlackIdentity.userId, juniorIdentities.userId),
+      eq2(linkedSlackIdentity.kind, "user"),
+      eq2(linkedSlackIdentity.provider, "slack"),
+      eq2(linkedSlackIdentity.providerTenantId, teamId)
     )
   ).where(
-    and(
-      eq(juniorIdentities.kind, "user"),
-      eq(juniorIdentities.provider, provider),
+    and2(
+      eq2(juniorIdentities.kind, "user"),
+      eq2(juniorIdentities.provider, provider),
       or(
-        eq(juniorIdentities.providerSubjectId, query),
+        eq2(juniorIdentities.providerSubjectId, query),
         sql`lower(${juniorIdentities.handle}) = lower(${query})`
       )
     )
@@ -11997,8 +12953,8 @@ function getTimeZoneOffsetMinutes(timestampMs, timezone) {
 import { z as z55 } from "zod";
 
 // src/chat/artifacts/store.ts
-import { createHash as createHash4, randomUUID as randomUUID3 } from "crypto";
-import { and as and2, eq as eq2, isNull } from "drizzle-orm";
+import { createHash as createHash4, randomUUID as randomUUID5 } from "crypto";
+import { and as and3, eq as eq3, isNull } from "drizzle-orm";
 var MAX_IMAGE_BYTES = 10 * 1024 * 1024;
 var IMAGE_TYPES = {
   gif: "image/gif",
@@ -12085,12 +13041,12 @@ async function publishImage(args) {
   const [existing] = await args.db.db().select({
     id: juniorArtifacts.id
   }).from(juniorArtifacts).where(
-    and2(
-      eq2(juniorArtifacts.conversationId, args.conversationId),
-      eq2(juniorArtifacts.sha256, sha256)
+    and3(
+      eq3(juniorArtifacts.conversationId, args.conversationId),
+      eq3(juniorArtifacts.sha256, sha256)
     )
   );
-  const id = existing?.id ?? randomUUID3();
+  const id = existing?.id ?? randomUUID5();
   const filename = `${id}.${imageType.extension}`;
   const storageKey = artifactKey(filename);
   await args.storage.put({
@@ -12148,9 +13104,9 @@ async function unpublishArtifact(args) {
   }
   const now = args.now ?? /* @__PURE__ */ new Date();
   const updated = await args.db.db().update(juniorArtifacts).set({ deleteRequestedAt: now }).where(
-    and2(
-      eq2(juniorArtifacts.id, parsed.id),
-      eq2(juniorArtifacts.conversationId, args.conversationId)
+    and3(
+      eq3(juniorArtifacts.id, parsed.id),
+      eq3(juniorArtifacts.conversationId, args.conversationId)
     )
   ).returning({ id: juniorArtifacts.id });
   if (updated.length === 0) {
@@ -12167,9 +13123,9 @@ async function readPublicArtifact(args) {
     contentType: juniorArtifacts.contentType,
     storageKey: juniorArtifacts.storageKey
   }).from(juniorArtifacts).where(
-    and2(
-      eq2(juniorArtifacts.id, parsed.id),
-      eq2(juniorArtifacts.public, true),
+    and3(
+      eq3(juniorArtifacts.id, parsed.id),
+      eq3(juniorArtifacts.public, true),
       isNull(juniorArtifacts.deleteRequestedAt)
     )
   );
@@ -13443,7 +14399,18 @@ function createWorkspaceTools(context) {
         const workspace = await getWorkspaceByName(getDb(), name);
         if (!workspace)
           throw new ToolInputError(`Workspace not found: ${name}`);
-        await context.workspaces.switch(workspace, options.signal);
+        try {
+          await context.workspaces.switch(workspace, options.signal);
+        } catch (error) {
+          if (isWorkspaceSnapshotWaitingError(error)) {
+            return {
+              workspace: view(workspace),
+              waiting: "workspace_snapshot",
+              timed_out: true
+            };
+          }
+          throw error;
+        }
         await tryRecordWorkspaceSwitchStat(workspace);
         return { workspace: view(workspace) };
       }
@@ -14963,7 +15930,7 @@ function createMcpAuthOrchestration(input) {
 }
 
 // src/chat/egress/plugin.ts
-import { randomUUID as randomUUID4 } from "crypto";
+import { randomUUID as randomUUID6 } from "crypto";
 
 // src/chat/sandbox/egress/credentials.ts
 var HTTP_READ_METHODS = /* @__PURE__ */ new Set(["GET", "HEAD", "OPTIONS"]);
@@ -15717,8 +16684,8 @@ async function executeCredentialedEgressRequest(input) {
 function credentialContextForPluginEgress(credentialContext) {
   return {
     credentials: credentialContext,
-    contextId: randomUUID4(),
-    egressId: `plugin-egress:${randomUUID4()}`,
+    contextId: randomUUID6(),
+    egressId: `plugin-egress:${randomUUID6()}`,
     expiresAtMs: Date.now() + 30 * 60 * 1e3
   };
 }
@@ -16151,6 +17118,7 @@ async function wireAgentTools(args) {
     actor: args.currentActor,
     locationConfiguration: args.run.environment?.locationConfiguration,
     configurationValues: args.configurationValues,
+    shouldYield: args.durability.shouldYield,
     getActiveSkill: () => args.skillSandbox.getActiveSkill(),
     prepareSandbox: pluginHooks.prepareSandbox,
     prepareWorkspace: async (sandbox, recipe, signal) => await pluginHooks.prepareWorkspace(sandbox, recipe.repos, signal),
@@ -17470,7 +18438,10 @@ async function executeAgentRunInPrivacyContext(run, conversationPrivacy, runLogC
       history: run.history
     });
     const preAgentPromptMessages = () => existingSessionRecord?.piMessages ?? [...input.piMessages ?? []];
-    const handoffEnabled = !isAgentRunFeatureDisabled(policy.disabledFeatures, "handoff");
+    const handoffEnabled = !isAgentRunFeatureDisabled(
+      policy.disabledFeatures,
+      "handoff"
+    );
     const storedTurnRoute = await loadTurnRoute({ conversationId, turnId });
     if (storedTurnRoute) {
       const resumedAfterHandoff = handoffEnabled && activeModelProfile !== STANDARD_MODEL_PROFILE && activeModelProfile !== storedTurnRoute.modelProfile;
@@ -17943,10 +18914,14 @@ async function executeAgentRunInPrivacyContext(run, conversationPrivacy, runLogC
         const containsHandoff = toolCalls2.some(
           (call) => call.name === HANDOFF_TOOL_NAME
         );
-        if (containsHandoff && toolCalls2.length !== 1) {
+        const containsWorkspaceSwitch = toolCalls2.some(
+          (call) => call.name === "switchWorkspace"
+        );
+        const exclusiveTool = containsHandoff ? HANDOFF_TOOL_NAME : containsWorkspaceSwitch ? "switchWorkspace" : void 0;
+        if (exclusiveTool && toolCalls2.length !== 1) {
           return {
             block: true,
-            reason: "handoff must be the only tool call in its assistant message; reissue it alone"
+            reason: `${exclusiveTool} must be the only tool call in its assistant message; reissue it alone`
           };
         }
         return void 0;
@@ -17962,15 +18937,46 @@ async function executeAgentRunInPrivacyContext(run, conversationPrivacy, runLogC
       },
       prepareNextTurnWithContext: async (nextTurn, hookSignal) => {
         try {
+          let continuedSnapshotWait = false;
+          for (; ; ) {
+            const snapshotWait = await continueWorkspaceSnapshotWait({
+              messages: currentAgentMessages(),
+              tools: toolsForActiveProfile(),
+              signal: hookSignal
+            });
+            if (snapshotWait.kind === "none") break;
+            if (snapshotWait.kind === "failed") {
+              agent.state.messages = snapshotWait.messages;
+              await runResume.persistSafeBoundary(snapshotWait.messages);
+              throw snapshotWait.error;
+            }
+            continuedSnapshotWait = true;
+            agent.state.messages = snapshotWait.messages;
+            await runResume.persistSafeBoundary(snapshotWait.messages);
+            if (snapshotWait.kind === "ready") break;
+            const yieldError2 = runResume.prepareYieldIfDue(
+              snapshotWait.messages
+            );
+            if (yieldError2) throw yieldError2;
+            await sleep(5e3, hookSignal);
+          }
           const handoffUpdate = applyPendingHandoff();
+          const snapshotWaitUpdate = continuedSnapshotWait ? {
+            context: {
+              ...nextTurn.context,
+              messages: currentAgentMessages(),
+              tools: agent.state.tools
+            }
+          } : void 0;
           const pendingMessages = await drainSteeringMessages();
           const capacityUpdate = await applyActiveContextCompaction(
-            handoffUpdate ? currentAgentMessages() : nextTurn.context.messages,
+            handoffUpdate || continuedSnapshotWait ? currentAgentMessages() : nextTurn.context.messages,
             hookSignal,
             pendingMessages,
             true
           );
-          const combinedUpdate = capacityUpdate && handoffUpdate ? { ...handoffUpdate, ...capacityUpdate } : capacityUpdate ?? handoffUpdate;
+          const handoffOrWaitUpdate = handoffUpdate ? { ...snapshotWaitUpdate, ...handoffUpdate } : snapshotWaitUpdate;
+          const combinedUpdate = capacityUpdate ? { ...handoffOrWaitUpdate, ...capacityUpdate } : handoffOrWaitUpdate;
           const repositoryInstructionsUpdate = await repositoryInstructionsContext.applyUpdate(
             combinedUpdate,
             nextTurn.context
@@ -18450,7 +19456,9 @@ export {
   normalizeSandboxEgressTracePropagationDomains,
   shouldPropagateSandboxEgressTrace,
   resolveSandboxEgressProviderForHost,
-  sanitizeScheduledTaskPrincipal,
+  getNextRunAtMs,
+  scheduledTaskRunAttributes,
+  logScheduledTaskRunSkipped,
   listThreadReplies,
   renderBlockText,
   renderAttachmentText,