@sentry/junior 0.2.0 → 0.4.0

package/dist/{chunk-QHDDCUTN.js → chunk-OZFXD5IG.js}

@@ -4,6 +4,10 @@ import {
   setSpanAttributes,
   withSpan
 } from "./chunk-PY4AI2GZ.js";
+import {
+  discoverInstalledPluginPackageContent,
+  discoverProjectRoots
+} from "./chunk-Z5E25LRN.js";
 
 // src/chat/config.ts
 var MIN_AGENT_TURN_TIMEOUT_MS = 10 * 1e3;
@@ -385,15 +389,15 @@ import { createHash } from "crypto";
 import { Sandbox } from "@vercel/sandbox";
 
 // src/chat/plugins/registry.ts
-import { readFileSync as readFileSync2, readdirSync, statSync as statSync2 } from "fs";
-import path3 from "path";
+import { readFileSync, readdirSync, statSync } from "fs";
+import path2 from "path";
 import { parse as parseYaml } from "yaml";
 
 // src/chat/home.ts
 import fs from "fs";
 import path from "path";
 function homeDir() {
-  return detectAppDir();
+  return resolveHomeDir();
 }
 function unique(values) {
   return [...new Set(values)];
@@ -409,46 +413,60 @@ function pathExists(targetPath) {
 function hasAnyDataMarkers(appDir) {
   return pathExists(path.join(appDir, "SOUL.md"));
 }
-function detectAppDir() {
-  const cwd = process.cwd();
-  const directApp = path.resolve(cwd, "app");
-  if (pathExists(directApp)) {
-    return directApp;
+function scoreAppCandidate(appDir) {
+  let score = 0;
+  if (pathExists(path.join(appDir, "SOUL.md"))) {
+    score += 4;
   }
-  const candidates = [];
-  const packageRoots = [];
-  const localPackagesDir = path.join(cwd, "packages");
-  if (pathExists(localPackagesDir)) {
-    for (const entry of fs.readdirSync(localPackagesDir)) {
-      packageRoots.push(path.join(localPackagesDir, entry));
-    }
+  if (pathExists(path.join(appDir, "ABOUT.md"))) {
+    score += 2;
   }
-  for (const entry of fs.readdirSync(cwd)) {
-    const child = path.join(cwd, entry);
-    const nestedPackages = path.join(child, "packages");
-    if (!pathExists(nestedPackages)) {
-      continue;
-    }
-    for (const nestedEntry of fs.readdirSync(nestedPackages)) {
-      packageRoots.push(path.join(nestedPackages, nestedEntry));
-    }
+  if (pathExists(path.join(appDir, "skills"))) {
+    score += 1;
   }
-  for (const root of packageRoots) {
-    const appDir = path.join(root, "app");
+  if (pathExists(path.join(appDir, "plugins"))) {
+    score += 1;
+  }
+  return score;
+}
+function resolveCandidateAppDirs(cwd, projectRoots) {
+  const roots = projectRoots ?? discoverProjectRoots(cwd);
+  const resolved = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const root of roots) {
+    const appDir = path.resolve(root, "app");
     if (!pathExists(appDir)) {
       continue;
     }
-    candidates.push(appDir);
+    if (seen.has(appDir)) {
+      continue;
+    }
+    seen.add(appDir);
+    resolved.push(appDir);
   }
+  return resolved;
+}
+function resolveHomeDir(cwd = process.cwd(), options) {
+  const resolvedCwd = path.resolve(cwd);
+  const directApp = path.resolve(resolvedCwd, "app");
+  if (pathExists(directApp) && hasAnyDataMarkers(directApp)) {
+    return directApp;
+  }
+  const candidates = resolveCandidateAppDirs(resolvedCwd, options?.projectRoots);
   if (candidates.length === 0) {
     return directApp;
   }
   candidates.sort((left, right) => {
-    const leftScore = Number(hasAnyDataMarkers(left));
-    const rightScore = Number(hasAnyDataMarkers(right));
+    const leftScore = scoreAppCandidate(left);
+    const rightScore = scoreAppCandidate(right);
     if (leftScore !== rightScore) {
       return rightScore - leftScore;
     }
+    const leftDistance = path.relative(resolvedCwd, left).split(path.sep).length;
+    const rightDistance = path.relative(resolvedCwd, right).split(path.sep).length;
+    if (leftDistance !== rightDistance) {
+      return leftDistance - rightDistance;
+    }
     return left.localeCompare(right);
   });
   return candidates[0];
@@ -536,7 +554,9 @@ function getPrivateKey(envName) {
     );
   }
   if (key.asymmetricKeyType !== "rsa") {
-    throw new Error(`Invalid ${envName}: GitHub App signing requires an RSA private key`);
+    throw new Error(
+      `Invalid ${envName}: GitHub App signing requires an RSA private key`
+    );
   }
   return key;
 }
@@ -553,8 +573,8 @@ function createAppJwt(appId, privateKeyEnv) {
   const signature = signer.sign(getPrivateKey(privateKeyEnv)).toString("base64").replace(/=/g, "").replace(/\+/g, "-").replace(/\//g, "_");
   return `${signingInput}.${signature}`;
 }
-async function githubRequest(apiBase, path4, params) {
-  const response = await fetch(`${apiBase}${path4}`, {
+async function githubRequest(apiBase, path3, params) {
+  const response = await fetch(`${apiBase}${path3}`, {
     method: params.method ?? "GET",
     headers: {
       Accept: "application/vnd.github+json",
@@ -591,7 +611,14 @@ function capabilityToPermissions(capability, pluginName) {
 function createGitHubAppBroker(manifest, credentials) {
   const tokenCache = /* @__PURE__ */ new Map();
   const provider = manifest.name;
-  const { apiDomains, authTokenEnv, appIdEnv, privateKeyEnv, installationIdEnv } = credentials;
+  const {
+    apiDomains,
+    apiHeaders,
+    authTokenEnv,
+    appIdEnv,
+    privateKeyEnv,
+    installationIdEnv
+  } = credentials;
   const apiBase = `https://${apiDomains[0]}`;
   const placeholder = resolveAuthTokenPlaceholder(credentials);
   return {
@@ -622,6 +649,7 @@ function createGitHubAppBroker(manifest, credentials) {
           headerTransforms: apiDomains.map((domain) => ({
             domain,
             headers: {
+              ...apiHeaders ?? {},
               Authorization: `Bearer ${cached.token}`
             }
           })),
@@ -641,17 +669,16 @@ function createGitHubAppBroker(manifest, credentials) {
       if (repositoryName) {
         tokenRequestBody.repositories = [repositoryName];
       }
-      const accessTokenResponse = await githubRequest(
-        apiBase,
-        `/app/installations/${installationId}/access_tokens`,
-        {
-          method: "POST",
-          token: appJwt,
-          body: tokenRequestBody
-        }
-      );
+      const accessTokenResponse = await githubRequest(apiBase, `/app/installations/${installationId}/access_tokens`, {
+        method: "POST",
+        token: appJwt,
+        body: tokenRequestBody
+      });
       const providerExpiresAtMs = Date.parse(accessTokenResponse.expires_at);
-      const expiresAtMs = Math.min(providerExpiresAtMs, Date.now() + MAX_LEASE_MS);
+      const expiresAtMs = Math.min(
+        providerExpiresAtMs,
+        Date.now() + MAX_LEASE_MS
+      );
       tokenCache.set(cacheKey, {
         installationId,
         token: accessTokenResponse.token,
@@ -665,6 +692,7 @@ function createGitHubAppBroker(manifest, credentials) {
         headerTransforms: apiDomains.map((domain) => ({
           domain,
           headers: {
+            ...apiHeaders ?? {},
             Authorization: `Bearer ${accessTokenResponse.token}`
           }
         })),
@@ -692,6 +720,70 @@ var CredentialUnavailableError = class extends Error {
   }
 };
 
+// src/chat/plugins/oauth-request.ts
+var DEFAULT_TOKEN_CONTENT_TYPE = "application/x-www-form-urlencoded";
+function requireNonEmptyTokenField(data, field) {
+  const value = data[field];
+  if (typeof value !== "string" || !value.trim()) {
+    throw new Error(`OAuth token response missing ${field}`);
+  }
+  return value;
+}
+function contentTypeToBody(contentType, payload) {
+  const mediaType = contentType.split(";", 1)[0]?.trim().toLowerCase();
+  if (!mediaType || mediaType === DEFAULT_TOKEN_CONTENT_TYPE) {
+    return new URLSearchParams(payload);
+  }
+  if (mediaType === "application/json" || mediaType.endsWith("+json")) {
+    return JSON.stringify(payload);
+  }
+  throw new Error(`Unsupported OAuth token Content-Type: ${contentType}`);
+}
+function buildOAuthTokenRequest(input) {
+  const headers = new Headers({ Accept: "application/json" });
+  for (const [name, value] of Object.entries(input.tokenExtraHeaders ?? {})) {
+    headers.set(name, value);
+  }
+  if (!headers.has("Content-Type")) {
+    headers.set("Content-Type", DEFAULT_TOKEN_CONTENT_TYPE);
+  }
+  const payload = { ...input.payload };
+  if (input.tokenAuthMethod === "basic") {
+    headers.set(
+      "Authorization",
+      `Basic ${Buffer.from(`${input.clientId}:${input.clientSecret}`).toString("base64")}`
+    );
+  } else {
+    payload.client_id = input.clientId;
+    payload.client_secret = input.clientSecret;
+  }
+  const contentType = headers.get("Content-Type") ?? DEFAULT_TOKEN_CONTENT_TYPE;
+  const serializedHeaders = {};
+  headers.forEach((value, key) => {
+    serializedHeaders[key] = value;
+  });
+  return {
+    headers: serializedHeaders,
+    body: contentTypeToBody(contentType, payload)
+  };
+}
+function parseOAuthTokenResponse(data) {
+  const accessToken = requireNonEmptyTokenField(data, "access_token");
+  const refreshToken = requireNonEmptyTokenField(data, "refresh_token");
+  const expiresIn = data.expires_in;
+  if (expiresIn === void 0) {
+    return { accessToken, refreshToken };
+  }
+  if (typeof expiresIn !== "number" || !Number.isFinite(expiresIn) || expiresIn <= 0) {
+    throw new Error("OAuth token response returned invalid expires_in");
+  }
+  return {
+    accessToken,
+    refreshToken,
+    expiresAt: Date.now() + expiresIn * 1e3
+  };
+}
+
 // src/chat/plugins/oauth-bearer-broker.ts
 var MAX_LEASE_MS2 = 60 * 60 * 1e3;
 var REFRESH_BUFFER_MS = 5 * 60 * 1e3;
@@ -699,35 +791,38 @@ async function refreshAccessToken(refreshToken, oauth) {
   const clientId = process.env[oauth.clientIdEnv]?.trim();
   const clientSecret = process.env[oauth.clientSecretEnv]?.trim();
   if (!clientId || !clientSecret) {
-    throw new Error(`Missing ${oauth.clientIdEnv} or ${oauth.clientSecretEnv} for token refresh`);
+    throw new Error(
+      `Missing ${oauth.clientIdEnv} or ${oauth.clientSecretEnv} for token refresh`
+    );
   }
+  const request = buildOAuthTokenRequest({
+    clientId,
+    clientSecret,
+    payload: {
+      grant_type: "refresh_token",
+      refresh_token: refreshToken
+    },
+    tokenAuthMethod: oauth.tokenAuthMethod,
+    tokenExtraHeaders: oauth.tokenExtraHeaders
+  });
   const response = await fetch(oauth.tokenEndpoint, {
     method: "POST",
-    headers: { "Content-Type": "application/x-www-form-urlencoded" },
-    body: new URLSearchParams({
-      grant_type: "refresh_token",
-      refresh_token: refreshToken,
-      client_id: clientId,
-      client_secret: clientSecret
-    })
+    headers: request.headers,
+    body: request.body
   });
   if (!response.ok) {
     throw new Error(`Token refresh failed: ${response.status}`);
   }
   const data = await response.json();
-  if (!data.access_token || !data.refresh_token || typeof data.expires_in !== "number") {
-    throw new Error("Token refresh returned malformed response");
-  }
-  return {
-    accessToken: data.access_token,
-    refreshToken: data.refresh_token,
-    expiresIn: data.expires_in
-  };
+  return parseOAuthTokenResponse(data);
+}
+function getLeaseExpiry(expiresAt) {
+  return expiresAt ? Math.min(expiresAt, Date.now() + MAX_LEASE_MS2) : Date.now() + MAX_LEASE_MS2;
 }
 function createOAuthBearerBroker(manifest, credentials, deps) {
   const provider = manifest.name;
   const supportedCapabilities = new Set(manifest.capabilities);
-  const { apiDomains, authTokenEnv } = credentials;
+  const { apiDomains, apiHeaders, authTokenEnv } = credentials;
   const authTokenPlaceholder = resolveAuthTokenPlaceholder(credentials);
   function buildLease(token, capability, expiresAtMs, reason) {
     return {
@@ -737,7 +832,7 @@ function createOAuthBearerBroker(manifest, credentials, deps) {
       env: { [authTokenEnv]: authTokenPlaceholder },
       headerTransforms: apiDomains.map((domain) => ({
         domain,
-        headers: { Authorization: `Bearer ${token}` }
+        headers: { ...apiHeaders ?? {}, Authorization: `Bearer ${token}` }
       })),
       expiresAt: new Date(expiresAtMs).toISOString(),
       metadata: { reason }
@@ -746,27 +841,58 @@ function createOAuthBearerBroker(manifest, credentials, deps) {
   return {
     async issue(input) {
       if (!supportedCapabilities.has(input.capability)) {
-        throw new Error(`Unsupported ${provider} capability: ${input.capability}`);
+        throw new Error(
+          `Unsupported ${provider} capability: ${input.capability}`
+        );
+      }
+      const envToken = process.env[authTokenEnv]?.trim();
+      const oauth = manifest.oauth;
+      if (!oauth) {
+        if (envToken) {
+          return buildLease(
+            envToken,
+            input.capability,
+            Date.now() + MAX_LEASE_MS2,
+            input.reason
+          );
+        }
+        throw new CredentialUnavailableError(
+          provider,
+          `No ${provider} credentials available.`
+        );
       }
-      if (input.requesterId && deps.userTokenStore) {
-        const stored = await deps.userTokenStore.get(input.requesterId, provider);
+      if (input.requesterId) {
+        const stored = await deps.userTokenStore.get(
+          input.requesterId,
+          provider
+        );
         if (stored) {
           const now = Date.now();
-          if (stored.expiresAt - now < REFRESH_BUFFER_MS && stored.refreshToken && manifest.oauth) {
+          if (stored.expiresAt !== void 0 && stored.expiresAt - now < REFRESH_BUFFER_MS) {
             try {
-              const refreshed = await refreshAccessToken(stored.refreshToken, manifest.oauth);
-              const expiresAt = Date.now() + refreshed.expiresIn * 1e3;
-              await deps.userTokenStore.set(input.requesterId, provider, {
-                accessToken: refreshed.accessToken,
-                refreshToken: refreshed.refreshToken,
-                expiresAt
-              });
-              const leaseExpiry = Math.min(expiresAt, Date.now() + MAX_LEASE_MS2);
-              return buildLease(refreshed.accessToken, input.capability, leaseExpiry, input.reason);
+              const refreshed = await refreshAccessToken(
+                stored.refreshToken,
+                oauth
+              );
+              await deps.userTokenStore.set(
+                input.requesterId,
+                provider,
+                refreshed
+              );
+              return buildLease(
+                refreshed.accessToken,
+                input.capability,
+                getLeaseExpiry(refreshed.expiresAt),
+                input.reason
+              );
             } catch {
               if (stored.expiresAt > Date.now()) {
-                const leaseExpiry = Math.min(stored.expiresAt, Date.now() + MAX_LEASE_MS2);
-                return buildLease(stored.accessToken, input.capability, leaseExpiry, input.reason);
+                return buildLease(
+                  stored.accessToken,
+                  input.capability,
+                  getLeaseExpiry(stored.expiresAt),
+                  input.reason
+                );
               }
               throw new CredentialUnavailableError(
                 provider,
@@ -774,9 +900,13 @@ function createOAuthBearerBroker(manifest, credentials, deps) {
               );
             }
           }
-          if (stored.expiresAt > Date.now()) {
-            const leaseExpiry = Math.min(stored.expiresAt, Date.now() + MAX_LEASE_MS2);
-            return buildLease(stored.accessToken, input.capability, leaseExpiry, input.reason);
+          if (stored.expiresAt === void 0 || stored.expiresAt > Date.now()) {
+            return buildLease(
+              stored.accessToken,
+              input.capability,
+              getLeaseExpiry(stored.expiresAt),
+              input.reason
+            );
           }
           throw new CredentialUnavailableError(
             provider,
@@ -788,10 +918,13 @@ function createOAuthBearerBroker(manifest, credentials, deps) {
           `No ${provider} credentials available.`
         );
       }
-      const envToken = process.env[authTokenEnv]?.trim();
       if (envToken) {
-        const expiresAtMs = Date.now() + MAX_LEASE_MS2;
-        return buildLease(envToken, input.capability, expiresAtMs, input.reason);
+        return buildLease(
+          envToken,
+          input.capability,
+          getLeaseExpiry(),
+          input.reason
+        );
       }
       throw new CredentialUnavailableError(
         provider,
@@ -801,98 +934,6 @@ function createOAuthBearerBroker(manifest, credentials, deps) {
   };
 }
 
-// src/chat/plugins/package-discovery.ts
-import { readFileSync, statSync } from "fs";
-import path2 from "path";
-function isDirectory(targetPath) {
-  try {
-    return statSync(targetPath).isDirectory();
-  } catch {
-    return false;
-  }
-}
-function isFile(targetPath) {
-  try {
-    return statSync(targetPath).isFile();
-  } catch {
-    return false;
-  }
-}
-function readRootPackageJson(cwd) {
-  const rootPackageJsonPath = path2.join(cwd, "package.json");
-  try {
-    const raw = readFileSync(rootPackageJsonPath, "utf8");
-    return JSON.parse(raw);
-  } catch {
-    return null;
-  }
-}
-function uniqueSorted(values) {
-  return [...new Set(values)].sort((left, right) => left.localeCompare(right));
-}
-function readInstalledDependencyNames(cwd) {
-  const rootPackageJson = readRootPackageJson(cwd);
-  if (!rootPackageJson) {
-    return [];
-  }
-  return uniqueSorted([
-    ...Object.keys(rootPackageJson.dependencies ?? {}),
-    ...Object.keys(rootPackageJson.optionalDependencies ?? {})
-  ]);
-}
-function packageInstallDir(cwd, packageName) {
-  return path2.join(cwd, "node_modules", ...packageName.split("/"));
-}
-function discoverInstalledJuniorContentPackages(cwd = process.cwd()) {
-  const dependencies = readInstalledDependencyNames(cwd);
-  const discovered = [];
-  for (const dependency of dependencies) {
-    const dir = packageInstallDir(cwd, dependency);
-    if (!isDirectory(dir)) {
-      continue;
-    }
-    const hasRootPluginManifest = isFile(path2.join(dir, "plugin.yaml"));
-    const hasPluginsDir = isDirectory(path2.join(dir, "plugins"));
-    const hasSkillsDir = isDirectory(path2.join(dir, "skills"));
-    if (!hasRootPluginManifest && !hasPluginsDir && !hasSkillsDir) {
-      continue;
-    }
-    discovered.push({
-      name: dependency,
-      dir,
-      hasRootPluginManifest,
-      hasPluginsDir,
-      hasSkillsDir
-    });
-  }
-  return discovered;
-}
-function discoverInstalledPluginPackageContent(cwd = process.cwd()) {
-  const manifestRoots = [];
-  const skillRoots2 = [];
-  const tracingIncludes = [];
-  for (const pkg of discoverInstalledJuniorContentPackages(cwd)) {
-    const base = `./node_modules/${pkg.name}`;
-    if (pkg.hasRootPluginManifest) {
-      manifestRoots.push(pkg.dir);
-      tracingIncludes.push(`${base}/plugin.yaml`);
-    }
-    if (pkg.hasPluginsDir) {
-      manifestRoots.push(path2.join(pkg.dir, "plugins"));
-      tracingIncludes.push(`${base}/plugins/**/*`);
-    }
-    if (pkg.hasSkillsDir) {
-      skillRoots2.push(path2.join(pkg.dir, "skills"));
-      tracingIncludes.push(`${base}/skills/**/*`);
-    }
-  }
-  return {
-    manifestRoots: uniqueSorted(manifestRoots),
-    skillRoots: uniqueSorted(skillRoots2),
-    tracingIncludes: uniqueSorted(tracingIncludes)
-  };
-}
-
 // src/chat/plugins/registry.ts
 var PLUGIN_NAME_RE = /^[a-z][a-z0-9-]*$/;
 var SHORT_CAPABILITY_RE = /^[a-z0-9]+(\.[a-z0-9-]+)*$/;
@@ -900,6 +941,15 @@ var SHORT_CONFIG_KEY_RE = /^[a-z0-9]+(\.[a-z0-9-]+)*$/;
 var AUTH_TOKEN_ENV_RE = /^[A-Z][A-Z0-9_]*$/;
 var API_DOMAIN_RE = /^(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/;
 var RUNTIME_POSTINSTALL_CMD_RE = /^[A-Za-z0-9._/-]+$/;
+var RESERVED_AUTHORIZE_PARAM_KEYS = /* @__PURE__ */ new Set([
+  "client_id",
+  "scope",
+  "state",
+  "redirect_uri",
+  "response_type"
+]);
+var FORBIDDEN_API_HEADER_NAMES = /* @__PURE__ */ new Set(["authorization"]);
+var FORBIDDEN_TOKEN_HEADER_NAMES = /* @__PURE__ */ new Set(["authorization"]);
 function toRecord(value, errorMessage) {
   if (!value || typeof value !== "object" || Array.isArray(value)) {
     throw new Error(errorMessage);
@@ -914,14 +964,24 @@ function requireStringField(record, field, errorMessage) {
   return value.trim();
 }
 function requireEnvVarField(record, field, pluginName) {
-  const value = requireStringField(record, field, `Plugin ${pluginName} ${field} must be a non-empty string`);
+  const value = requireStringField(
+    record,
+    field,
+    `Plugin ${pluginName} ${field} must be a non-empty string`
+  );
   if (!AUTH_TOKEN_ENV_RE.test(value)) {
-    throw new Error(`Plugin ${pluginName} ${field} must be an uppercase env var name`);
+    throw new Error(
+      `Plugin ${pluginName} ${field} must be an uppercase env var name`
+    );
   }
   return value;
 }
 function requireHttpsUrlField(record, field, pluginName) {
-  const value = requireStringField(record, field, `Plugin ${pluginName} oauth.${field} must be a non-empty string`);
+  const value = requireStringField(
+    record,
+    field,
+    `Plugin ${pluginName} oauth.${field} must be a non-empty string`
+  );
   let parsed;
   try {
     parsed = new URL(value);
@@ -936,26 +996,79 @@ function requireHttpsUrlField(record, field, pluginName) {
 function normalizeApiDomain(rawDomain, name) {
   const domain = typeof rawDomain === "string" ? rawDomain.trim().toLowerCase() : "";
   if (!domain) {
-    throw new Error(`Plugin ${name} credentials.api-domains entries must be non-empty strings`);
+    throw new Error(
+      `Plugin ${name} credentials.api-domains entries must be non-empty strings`
+    );
   }
   if (!API_DOMAIN_RE.test(domain)) {
-    throw new Error(`Plugin ${name} credentials.api-domains entries must be valid domain names`);
+    throw new Error(
+      `Plugin ${name} credentials.api-domains entries must be valid domain names`
+    );
   }
   return domain;
 }
+function parseStringMap(data, errorLabel, options = {}) {
+  if (data === void 0) {
+    return void 0;
+  }
+  const record = toRecord(
+    data,
+    `${errorLabel} must be an object when provided`
+  );
+  const entries = Object.entries(record);
+  if (entries.length === 0) {
+    return void 0;
+  }
+  const result = {};
+  const seen = /* @__PURE__ */ new Set();
+  for (const [rawKey, rawValue] of entries) {
+    const key = rawKey.trim();
+    if (!key) {
+      throw new Error(`${errorLabel} keys must be non-empty strings`);
+    }
+    if (typeof rawValue !== "string" || !rawValue.trim()) {
+      throw new Error(`${errorLabel}.${key} must be a non-empty string`);
+    }
+    const normalizedKey = key.toLowerCase();
+    if (options.reservedKeys?.has(normalizedKey)) {
+      throw new Error(`${errorLabel}.${key} is reserved by the runtime`);
+    }
+    if (options.forbiddenKeys?.has(normalizedKey)) {
+      throw new Error(`${errorLabel}.${key} is not allowed`);
+    }
+    if (seen.has(normalizedKey)) {
+      throw new Error(`${errorLabel}.${key} is duplicated`);
+    }
+    seen.add(normalizedKey);
+    result[key] = rawValue.trim();
+  }
+  return Object.keys(result).length > 0 ? result : void 0;
+}
 function parseBaseCredentialFields(data, name) {
   const rawDomains = data["api-domains"];
   if (!Array.isArray(rawDomains) || rawDomains.length === 0) {
-    throw new Error(`Plugin ${name} credentials.api-domains must be a non-empty array of strings`);
+    throw new Error(
+      `Plugin ${name} credentials.api-domains must be a non-empty array of strings`
+    );
   }
-  const apiDomains = rawDomains.map((rawDomain) => normalizeApiDomain(rawDomain, name));
+  const apiDomains = rawDomains.map(
+    (rawDomain) => normalizeApiDomain(rawDomain, name)
+  );
+  const apiHeaders = parseStringMap(
+    data["api-headers"],
+    `Plugin ${name} credentials.api-headers`,
+    { forbiddenKeys: FORBIDDEN_API_HEADER_NAMES }
+  );
   const authTokenEnv = requireEnvVarField(data, "auth-token-env", name);
   const authTokenPlaceholderRaw = data["auth-token-placeholder"];
   if (authTokenPlaceholderRaw !== void 0 && (typeof authTokenPlaceholderRaw !== "string" || !authTokenPlaceholderRaw.trim())) {
-    throw new Error(`Plugin ${name} credentials.auth-token-placeholder must be a non-empty string when provided`);
+    throw new Error(
+      `Plugin ${name} credentials.auth-token-placeholder must be a non-empty string when provided`
+    );
   }
   return {
     apiDomains,
+    ...apiHeaders ? { apiHeaders } : {},
     authTokenEnv,
     ...typeof authTokenPlaceholderRaw === "string" ? { authTokenPlaceholder: authTokenPlaceholderRaw.trim() } : {}
   };
@@ -970,8 +1083,18 @@ function parseCredentials(data, name) {
     const base = parseBaseCredentialFields(data, name);
     const appIdEnv = requireEnvVarField(data, "app-id-env", name);
     const privateKeyEnv = requireEnvVarField(data, "private-key-env", name);
-    const installationIdEnv = requireEnvVarField(data, "installation-id-env", name);
-    return { type: "github-app", ...base, appIdEnv, privateKeyEnv, installationIdEnv };
+    const installationIdEnv = requireEnvVarField(
+      data,
+      "installation-id-env",
+      name
+    );
+    return {
+      type: "github-app",
+      ...base,
+      appIdEnv,
+      privateKeyEnv,
+      installationIdEnv
+    };
   }
   throw new Error(`Plugin ${name} has unsupported credentials.type: "${type}"`);
 }
@@ -986,7 +1109,9 @@ function parseRuntimeDependencies(data, name) {
   const seen = /* @__PURE__ */ new Set();
   for (const entry of data) {
     if (!entry || typeof entry !== "object" || Array.isArray(entry)) {
-      throw new Error(`Plugin ${name} runtime-dependencies entries must be objects`);
+      throw new Error(
+        `Plugin ${name} runtime-dependencies entries must be objects`
+      );
     }
     const record = entry;
     const type = record.type;
@@ -995,20 +1120,28 @@ function parseRuntimeDependencies(data, name) {
     const version = record.version;
     const sha256 = record.sha256;
     if (typeof type !== "string" || type !== "npm" && type !== "system") {
-      throw new Error(`Plugin ${name} runtime dependency type must be "npm" or "system"`);
+      throw new Error(
+        `Plugin ${name} runtime dependency type must be "npm" or "system"`
+      );
     }
     const normalizedPackage = typeof packageName === "string" ? packageName.trim() : "";
     const normalizedUrl = typeof packageUrl === "string" ? packageUrl.trim() : "";
     if (type === "npm") {
       if (!normalizedPackage) {
-        throw new Error(`Plugin ${name} runtime dependency package must be a non-empty string`);
+        throw new Error(
+          `Plugin ${name} runtime dependency package must be a non-empty string`
+        );
       }
       if (packageUrl !== void 0 || sha256 !== void 0) {
-        throw new Error(`Plugin ${name} npm runtime dependencies must only include package/version fields`);
+        throw new Error(
+          `Plugin ${name} npm runtime dependencies must only include package/version fields`
+        );
       }
       const normalizedVersion = typeof version === "string" ? version.trim() : "latest";
       if (!normalizedVersion) {
-        throw new Error(`Plugin ${name} runtime dependency version must be a non-empty string when provided`);
+        throw new Error(
+          `Plugin ${name} runtime dependency version must be a non-empty string when provided`
+        );
       }
       const dedupeKey2 = `${type}:${normalizedPackage}:${normalizedVersion}`;
       if (seen.has(dedupeKey2)) {
@@ -1023,17 +1156,25 @@ function parseRuntimeDependencies(data, name) {
       continue;
     }
     if (version !== void 0) {
-      throw new Error(`Plugin ${name} system runtime dependencies must not include a version`);
+      throw new Error(
+        `Plugin ${name} system runtime dependencies must not include a version`
+      );
     }
     if (normalizedPackage && normalizedUrl) {
-      throw new Error(`Plugin ${name} system runtime dependencies must specify either package or url, not both`);
+      throw new Error(
+        `Plugin ${name} system runtime dependencies must specify either package or url, not both`
+      );
     }
     if (!normalizedPackage && !normalizedUrl) {
-      throw new Error(`Plugin ${name} system runtime dependencies must specify package or url`);
+      throw new Error(
+        `Plugin ${name} system runtime dependencies must specify package or url`
+      );
     }
     if (normalizedPackage) {
       if (sha256 !== void 0) {
-        throw new Error(`Plugin ${name} system runtime dependency package entries must not include sha256`);
+        throw new Error(
+          `Plugin ${name} system runtime dependency package entries must not include sha256`
+        );
       }
       const dedupeKey2 = `${type}:package:${normalizedPackage}`;
       if (seen.has(dedupeKey2)) {
@@ -1047,11 +1188,15 @@ function parseRuntimeDependencies(data, name) {
       continue;
     }
     if (!/^https:\/\//i.test(normalizedUrl)) {
-      throw new Error(`Plugin ${name} system runtime dependency url must be an https URL`);
+      throw new Error(
+        `Plugin ${name} system runtime dependency url must be an https URL`
+      );
     }
     const normalizedSha256 = typeof sha256 === "string" ? sha256.trim().toLowerCase() : "";
     if (!/^[a-f0-9]{64}$/.test(normalizedSha256)) {
-      throw new Error(`Plugin ${name} system runtime dependency url entries must include a valid sha256`);
+      throw new Error(
+        `Plugin ${name} system runtime dependency url entries must include a valid sha256`
+      );
     }
     const dedupeKey = `${type}:url:${normalizedUrl}:${normalizedSha256}`;
     if (seen.has(dedupeKey)) {
@@ -1076,12 +1221,16 @@ function parseRuntimePostinstall(data, name) {
   const parsed = [];
   for (const entry of data) {
     if (!entry || typeof entry !== "object" || Array.isArray(entry)) {
-      throw new Error(`Plugin ${name} runtime-postinstall entries must be objects`);
+      throw new Error(
+        `Plugin ${name} runtime-postinstall entries must be objects`
+      );
     }
     const record = entry;
     const cmd = typeof record.cmd === "string" ? record.cmd.trim() : "";
     if (!cmd) {
-      throw new Error(`Plugin ${name} runtime-postinstall cmd must be a non-empty string`);
+      throw new Error(
+        `Plugin ${name} runtime-postinstall cmd must be a non-empty string`
+      );
     }
     if (!RUNTIME_POSTINSTALL_CMD_RE.test(cmd)) {
       throw new Error(
@@ -1090,11 +1239,15 @@ function parseRuntimePostinstall(data, name) {
     }
     const argsRaw = record.args;
     if (argsRaw !== void 0 && (!Array.isArray(argsRaw) || !argsRaw.every((arg) => typeof arg === "string"))) {
-      throw new Error(`Plugin ${name} runtime-postinstall args must be an array of strings when provided`);
+      throw new Error(
+        `Plugin ${name} runtime-postinstall args must be an array of strings when provided`
+      );
     }
     const sudoRaw = record.sudo;
     if (sudoRaw !== void 0 && typeof sudoRaw !== "boolean") {
-      throw new Error(`Plugin ${name} runtime-postinstall sudo must be a boolean when provided`);
+      throw new Error(
+        `Plugin ${name} runtime-postinstall sudo must be a boolean when provided`
+      );
     }
     const normalizedArgs = Array.isArray(argsRaw) ? argsRaw.map((arg) => arg.trim()).filter((arg) => arg.length > 0) : void 0;
     parsed.push({
@@ -1106,7 +1259,10 @@ function parseRuntimePostinstall(data, name) {
   return parsed.length > 0 ? parsed : void 0;
 }
 function parseManifest(raw, dir) {
-  const data = toRecord(parseYaml(raw), `Invalid plugin manifest in ${dir}: expected an object`);
+  const data = toRecord(
+    parseYaml(raw),
+    `Invalid plugin manifest in ${dir}: expected an object`
+  );
   const rawName = data.name;
   if (typeof rawName !== "string" || !PLUGIN_NAME_RE.test(rawName)) {
     throw new Error(`Invalid plugin name in ${dir}: "${rawName}"`);
@@ -1119,7 +1275,9 @@ function parseManifest(raw, dir) {
   const description = rawDescription;
   const rawCapabilities = data.capabilities;
   if (rawCapabilities !== void 0 && !Array.isArray(rawCapabilities)) {
-    throw new Error(`Plugin ${name} capabilities must be an array when provided`);
+    throw new Error(
+      `Plugin ${name} capabilities must be an array when provided`
+    );
   }
   const capabilities = [];
   for (const cap of rawCapabilities ?? []) {
@@ -1130,7 +1288,9 @@ function parseManifest(raw, dir) {
   }
   const rawConfigKeys = data["config-keys"];
   if (rawConfigKeys !== void 0 && !Array.isArray(rawConfigKeys)) {
-    throw new Error(`Plugin ${name} config-keys must be an array when provided`);
+    throw new Error(
+      `Plugin ${name} config-keys must be an array when provided`
+    );
   }
   const configKeys = [];
   for (const key of rawConfigKeys ?? []) {
@@ -1141,11 +1301,20 @@ function parseManifest(raw, dir) {
   }
   const credentialsRaw = data.credentials;
   if (credentialsRaw !== void 0) {
-    toRecord(credentialsRaw, `Plugin ${name} credentials must be an object when provided`);
+    toRecord(
+      credentialsRaw,
+      `Plugin ${name} credentials must be an object when provided`
+    );
   }
   const credentials = credentialsRaw ? parseCredentials(credentialsRaw, name) : void 0;
-  const runtimeDependencies = parseRuntimeDependencies(data["runtime-dependencies"], name);
-  const runtimePostinstall = parseRuntimePostinstall(data["runtime-postinstall"], name);
+  const runtimeDependencies = parseRuntimeDependencies(
+    data["runtime-dependencies"],
+    name
+  );
+  const runtimePostinstall = parseRuntimePostinstall(
+    data["runtime-postinstall"],
+    name
+  );
   const manifest = {
     name,
     description,
@@ -1161,14 +1330,54 @@ function parseManifest(raw, dir) {
       throw new Error(`Plugin ${name} oauth requires credentials`);
     }
     if (credentials.type !== "oauth-bearer") {
-      throw new Error(`Plugin ${name} oauth requires credentials.type "oauth-bearer"`);
+      throw new Error(
+        `Plugin ${name} oauth requires credentials.type "oauth-bearer"`
+      );
+    }
+    const authorizeParams = parseStringMap(
+      oauthRaw["authorize-params"],
+      `Plugin ${name} oauth.authorize-params`,
+      { reservedKeys: RESERVED_AUTHORIZE_PARAM_KEYS }
+    );
+    const tokenExtraHeaders = parseStringMap(
+      oauthRaw["token-extra-headers"],
+      `Plugin ${name} oauth.token-extra-headers`,
+      { forbiddenKeys: FORBIDDEN_TOKEN_HEADER_NAMES }
+    );
+    const tokenAuthMethodRaw = oauthRaw["token-auth-method"];
+    let tokenAuthMethod;
+    if (tokenAuthMethodRaw !== void 0) {
+      const parsedTokenAuthMethod = requireStringField(
+        oauthRaw,
+        "token-auth-method",
+        `Plugin ${name} oauth.token-auth-method must be a non-empty string`
+      );
+      if (parsedTokenAuthMethod !== "body" && parsedTokenAuthMethod !== "basic") {
+        throw new Error(
+          `Plugin ${name} oauth.token-auth-method must be "body" or "basic"`
+        );
+      }
+      tokenAuthMethod = parsedTokenAuthMethod;
     }
     manifest.oauth = {
       clientIdEnv: requireEnvVarField(oauthRaw, "client-id-env", name),
       clientSecretEnv: requireEnvVarField(oauthRaw, "client-secret-env", name),
-      authorizeEndpoint: requireHttpsUrlField(oauthRaw, "authorize-endpoint", name),
+      authorizeEndpoint: requireHttpsUrlField(
+        oauthRaw,
+        "authorize-endpoint",
+        name
+      ),
       tokenEndpoint: requireHttpsUrlField(oauthRaw, "token-endpoint", name),
-      scope: requireStringField(oauthRaw, "scope", `Plugin ${name} oauth.scope must be a non-empty string`)
+      ...oauthRaw.scope !== void 0 ? {
+        scope: requireStringField(
+          oauthRaw,
+          "scope",
+          `Plugin ${name} oauth.scope must be a non-empty string`
+        )
+      } : {},
+      ...authorizeParams ? { authorizeParams } : {},
+      ...tokenAuthMethod ? { tokenAuthMethod } : {},
+      ...tokenExtraHeaders ? { tokenExtraHeaders } : {}
     };
   }
   const targetRaw = data.target ? toRecord(data.target, `Plugin ${name} target must be an object`) : void 0;
@@ -1178,14 +1387,20 @@ function parseManifest(raw, dir) {
     }
     const rawConfigKey = targetRaw["config-key"];
     if (typeof rawConfigKey !== "string" || !rawConfigKey.trim()) {
-      throw new Error(`Plugin ${name} target.config-key must be a non-empty string`);
+      throw new Error(
+        `Plugin ${name} target.config-key must be a non-empty string`
+      );
     }
     if (!SHORT_CONFIG_KEY_RE.test(rawConfigKey)) {
-      throw new Error(`Plugin ${name} target.config-key "${rawConfigKey}" is invalid`);
+      throw new Error(
+        `Plugin ${name} target.config-key "${rawConfigKey}" is invalid`
+      );
     }
     const qualifiedKey = `${name}.${rawConfigKey}`;
     if (!configKeys.includes(qualifiedKey)) {
-      throw new Error(`Plugin ${name} target.config-key "${rawConfigKey}" must be listed in config-keys`);
+      throw new Error(
+        `Plugin ${name} target.config-key "${rawConfigKey}" must be listed in config-keys`
+      );
     }
     manifest.target = { type: "repo", configKey: qualifiedKey };
   }
@@ -1204,13 +1419,15 @@ function registerPluginManifest(raw, pluginDir) {
   }
   for (const cap of manifest.capabilities) {
     if (capabilityToPlugin.has(cap)) {
-      throw new Error(`Duplicate capability "${cap}" in plugin "${manifest.name}"`);
+      throw new Error(
+        `Duplicate capability "${cap}" in plugin "${manifest.name}"`
+      );
     }
   }
   const definition = {
     manifest,
     dir: pluginDir,
-    skillsDir: path3.join(pluginDir, "skills")
+    skillsDir: path2.join(pluginDir, "skills")
   };
   pluginDefinitions.push(definition);
   pluginsByName.set(manifest.name, definition);
@@ -1231,24 +1448,29 @@ function loadPlugins() {
     let entries;
     let rootStat;
     try {
-      rootStat = statSync2(pluginsRoot);
+      rootStat = statSync(pluginsRoot);
     } catch (error) {
-      logWarn("plugin_root_read_failed", {}, {
-        "file.directory": pluginsRoot,
-        "error.message": error instanceof Error ? error.message : String(error)
-      }, "Failed to read plugin root");
+      logWarn(
+        "plugin_root_read_failed",
+        {},
+        {
+          "file.directory": pluginsRoot,
+          "error.message": error instanceof Error ? error.message : String(error)
+        },
+        "Failed to read plugin root"
+      );
       continue;
     }
     if (rootStat.isDirectory()) {
-      const manifestPath = path3.join(pluginsRoot, "plugin.yaml");
+      const manifestPath = path2.join(pluginsRoot, "plugin.yaml");
       let hasRootManifest = false;
       try {
-        hasRootManifest = statSync2(manifestPath).isFile();
+        hasRootManifest = statSync(manifestPath).isFile();
       } catch {
         hasRootManifest = false;
       }
       if (hasRootManifest) {
-        const rawRootManifest = readFileSync2(manifestPath, "utf8");
+        const rawRootManifest = readFileSync(manifestPath, "utf8");
         registerPluginManifest(rawRootManifest, pluginsRoot);
         continue;
       }
@@ -1256,24 +1478,29 @@ function loadPlugins() {
     try {
       entries = readdirSync(pluginsRoot);
     } catch (error) {
-      logWarn("plugin_root_read_failed", {}, {
-        "file.directory": pluginsRoot,
-        "error.message": error instanceof Error ? error.message : String(error)
-      }, "Failed to read plugin root");
+      logWarn(
+        "plugin_root_read_failed",
+        {},
+        {
+          "file.directory": pluginsRoot,
+          "error.message": error instanceof Error ? error.message : String(error)
+        },
+        "Failed to read plugin root"
+      );
       continue;
     }
     for (const entry of entries.sort()) {
-      const pluginDir = path3.join(pluginsRoot, entry);
+      const pluginDir = path2.join(pluginsRoot, entry);
       try {
-        const stat = statSync2(pluginDir);
+        const stat = statSync(pluginDir);
         if (!stat.isDirectory()) continue;
       } catch {
         continue;
       }
-      const manifestPath = path3.join(pluginDir, "plugin.yaml");
+      const manifestPath = path2.join(pluginDir, "plugin.yaml");
       let raw;
       try {
-        raw = readFileSync2(manifestPath, "utf8");
+        raw = readFileSync(manifestPath, "utf8");
       } catch {
         continue;
       }
@@ -1295,8 +1522,12 @@ function loadPlugins() {
     "Loaded plugins"
   );
 }
+function ensurePluginsLoaded() {
+  loadPlugins();
+}
 loadPlugins();
 function getPluginCapabilityProviders() {
+  ensurePluginsLoaded();
   return pluginDefinitions.map((plugin) => ({
     provider: plugin.manifest.name,
     capabilities: [...plugin.manifest.capabilities],
@@ -1305,9 +1536,11 @@ function getPluginCapabilityProviders() {
   }));
 }
 function getPluginProviders() {
+  ensurePluginsLoaded();
   return [...pluginDefinitions];
 }
 function getPluginRuntimeDependencies() {
+  ensurePluginsLoaded();
   const seen = /* @__PURE__ */ new Set();
   const deps = [];
   for (const plugin of pluginDefinitions) {
@@ -1336,6 +1569,7 @@ function getPluginRuntimeDependencies() {
   });
 }
 function getPluginRuntimePostinstall() {
+  ensurePluginsLoaded();
   const commands = [];
   for (const plugin of pluginDefinitions) {
     for (const command of plugin.manifest.runtimePostinstall ?? []) {
@@ -1349,6 +1583,7 @@ function getPluginRuntimePostinstall() {
   return commands;
 }
 function getPluginOAuthConfig(provider) {
+  ensurePluginsLoaded();
   const plugin = pluginsByName.get(provider);
   if (!plugin?.manifest.oauth) return void 0;
   const oauth = plugin.manifest.oauth;
@@ -1357,17 +1592,28 @@ function getPluginOAuthConfig(provider) {
     clientSecretEnv: oauth.clientSecretEnv,
     authorizeEndpoint: oauth.authorizeEndpoint,
     tokenEndpoint: oauth.tokenEndpoint,
-    scope: oauth.scope,
+    ...oauth.scope ? { scope: oauth.scope } : {},
+    ...oauth.authorizeParams ? { authorizeParams: { ...oauth.authorizeParams } } : {},
+    ...oauth.tokenAuthMethod ? { tokenAuthMethod: oauth.tokenAuthMethod } : {},
+    ...oauth.tokenExtraHeaders ? { tokenExtraHeaders: { ...oauth.tokenExtraHeaders } } : {},
     callbackPath: `/api/oauth/callback/${plugin.manifest.name}`
   };
 }
 function getPluginSkillRoots() {
-  return [.../* @__PURE__ */ new Set([...pluginDefinitions.map((plugin) => plugin.skillsDir), ...packageSkillRoots])];
+  ensurePluginsLoaded();
+  return [
+    .../* @__PURE__ */ new Set([
+      ...pluginDefinitions.map((plugin) => plugin.skillsDir),
+      ...packageSkillRoots
+    ])
+  ];
 }
 function isPluginProvider(provider) {
+  ensurePluginsLoaded();
   return pluginsByName.has(provider);
 }
 function createPluginBroker(provider, deps) {
+  ensurePluginsLoaded();
   const plugin = pluginsByName.get(provider);
   if (!plugin) {
     throw new Error(`Unknown plugin provider: "${provider}"`);
@@ -1467,6 +1713,9 @@ function buildDependencyProfile(runtime) {
     postinstall
   };
 }
+function getRuntimeDependencyProfileHash(runtime) {
+  return buildDependencyProfile(runtime)?.profileHash;
+}
 function shouldRebuildCachedSnapshot(profile, cached) {
   if (!profile.hasFloatingVersions) {
     return false;
@@ -1497,7 +1746,11 @@ async function getCachedSnapshot(profileHash) {
 async function setCachedSnapshot(entry) {
   const state = getStateAdapter();
   await state.connect();
-  await state.set(profileCacheKey(entry.profileHash), JSON.stringify(entry), SNAPSHOT_CACHE_TTL_MS);
+  await state.set(
+    profileCacheKey(entry.profileHash),
+    JSON.stringify(entry),
+    SNAPSHOT_CACHE_TTL_MS
+  );
 }
 async function withSnapshotSpan(name, op, attributes, callback) {
   return await withSpan(name, op, {}, callback, attributes);
@@ -1532,7 +1785,11 @@ async function installGhCliViaDnf(sandbox) {
   }
   const dnf5Repo = await tryRun(sandbox, {
     cmd: "dnf",
-    args: ["config-manager", "addrepo", "--from-repofile=https://cli.github.com/packages/rpm/gh-cli.repo"],
+    args: [
+      "config-manager",
+      "addrepo",
+      "--from-repofile=https://cli.github.com/packages/rpm/gh-cli.repo"
+    ],
     sudo: true
   });
   if (!dnf5Repo.ok) {
@@ -1549,7 +1806,11 @@ async function installGhCliViaDnf(sandbox) {
       sandbox,
       {
         cmd: "dnf",
-        args: ["config-manager", "--add-repo", "https://cli.github.com/packages/rpm/gh-cli.repo"],
+        args: [
+          "config-manager",
+          "--add-repo",
+          "https://cli.github.com/packages/rpm/gh-cli.repo"
+        ],
         sudo: true
       },
       "dnf config-manager --add-repo gh-cli.repo"
@@ -1580,8 +1841,12 @@ function runtimeDependencyFilePath(url, sha256) {
   return `/tmp/junior-runtime-${sha256.slice(0, 12)}-${sanitizedBasename}`;
 }
 async function installRuntimeDependencies(sandbox, deps) {
-  const systemDeps = deps.filter((dep) => dep.type === "system");
-  const npmPackages = deps.filter((dep) => dep.type === "npm").map((dep) => `${dep.package}@${dep.version}`);
+  const systemDeps = deps.filter(
+    (dep) => dep.type === "system"
+  );
+  const npmPackages = deps.filter(
+    (dep) => dep.type === "npm"
+  ).map((dep) => `${dep.package}@${dep.version}`);
   if (systemDeps.length > 0) {
     await withSnapshotSpan(
       "sandbox.snapshot.install_system",
@@ -1608,7 +1873,9 @@ async function installRuntimeDependencies(sandbox, deps) {
             const checksumStdout = (await checksumResult.stdout()).trim();
             const checksumStderr = (await checksumResult.stderr()).trim();
             if (checksumResult.exitCode !== 0) {
-              throw new Error(`sha256sum failed: ${checksumStderr || checksumStdout || "command failed"}`);
+              throw new Error(
+                `sha256sum failed: ${checksumStderr || checksumStdout || "command failed"}`
+              );
             }
             const actualChecksum = checksumStdout.split(/\s+/)[0]?.toLowerCase();
             if (!actualChecksum) {
@@ -1685,7 +1952,10 @@ async function runRuntimePostinstall(sandbox, commands) {
     },
     async () => {
       for (const command of commands) {
-        const invocation = [JSON.stringify(command.cmd), ...(command.args ?? []).map((arg) => JSON.stringify(arg))].join(" ");
+        const invocation = [
+          JSON.stringify(command.cmd),
+          ...(command.args ?? []).map((arg) => JSON.stringify(arg))
+        ].join(" ");
         const pathPrefix = `${SANDBOX_WORKSPACE_ROOT}/.junior/bin:$PATH`;
         await runOrThrow(
           sandbox,
@@ -1840,7 +2110,9 @@ async function resolveRuntimeDependencySnapshot(params) {
         };
       }
       const cached = await getCachedSnapshot(profile.profileHash);
-      const cachedNeedsRebuild = Boolean(cached?.snapshotId && shouldRebuildCachedSnapshot(profile, cached));
+      const cachedNeedsRebuild = Boolean(
+        cached?.snapshotId && shouldRebuildCachedSnapshot(profile, cached)
+      );
       if (!params.forceRebuild && cached?.snapshotId && !cachedNeedsRebuild) {
         await params.onProgress?.("cache_hit");
         return {
@@ -1866,34 +2138,50 @@ async function resolveRuntimeDependencySnapshot(params) {
         }
         return !shouldRebuildCachedSnapshot(profile, candidate);
       };
-      const lockResult = await withBuildLock(profile.profileHash, async () => {
-        const latest = await getCachedSnapshot(profile.profileHash);
-        if (latest?.snapshotId && canUseCachedSnapshot(latest)) {
-          await params.onProgress?.("cache_hit");
-          return { snapshotId: latest.snapshotId, source: "callback_cache" };
-        }
-        await params.onProgress?.("building_snapshot");
-        const nextSnapshotId = await createDependencySnapshot(profile, params.runtime, params.timeoutMs);
-        await setCachedSnapshot({
-          profileHash: profile.profileHash,
-          snapshotId: nextSnapshotId,
-          runtime: params.runtime,
-          createdAtMs: Date.now(),
-          dependencyCount: profile.dependencyCount
-        });
-        await params.onProgress?.("build_complete");
-        return { snapshotId: nextSnapshotId, source: "built" };
-      }, canUseCachedSnapshot, {
-        onWaitingForLock: async () => {
-          await params.onProgress?.("waiting_for_lock");
+      const lockResult = await withBuildLock(
+        profile.profileHash,
+        async () => {
+          const latest = await getCachedSnapshot(profile.profileHash);
+          if (latest?.snapshotId && canUseCachedSnapshot(latest)) {
+            await params.onProgress?.("cache_hit");
+            return {
+              snapshotId: latest.snapshotId,
+              source: "callback_cache"
+            };
+          }
+          await params.onProgress?.("building_snapshot");
+          const nextSnapshotId = await createDependencySnapshot(
+            profile,
+            params.runtime,
+            params.timeoutMs
+          );
+          await setCachedSnapshot({
+            profileHash: profile.profileHash,
+            snapshotId: nextSnapshotId,
+            runtime: params.runtime,
+            createdAtMs: Date.now(),
+            dependencyCount: profile.dependencyCount
+          });
+          await params.onProgress?.("build_complete");
+          return { snapshotId: nextSnapshotId, source: "built" };
+        },
+        canUseCachedSnapshot,
+        {
+          onWaitingForLock: async () => {
+            await params.onProgress?.("waiting_for_lock");
+          }
         }
-      });
+      );
       return {
         snapshotId: lockResult.snapshotId,
         profileHash: profile.profileHash,
         dependencyCount: profile.dependencyCount,
         cacheHit: lockResult.source !== "built",
-        resolveOutcome: toResolveOutcome(Boolean(params.forceRebuild), lockResult.source, lockResult.waitedForLock),
+        resolveOutcome: toResolveOutcome(
+          Boolean(params.forceRebuild),
+          lockResult.source,
+          lockResult.waitedForLock
+        ),
         ...rebuildReason ? { rebuildReason } : {}
       };
     }
@@ -1910,6 +2198,8 @@ export {
   soulPathCandidates,
   resolveAuthTokenPlaceholder,
   CredentialUnavailableError,
+  buildOAuthTokenRequest,
+  parseOAuthTokenResponse,
   getPluginCapabilityProviders,
   getPluginProviders,
   getPluginOAuthConfig,
@@ -1935,6 +2225,7 @@ export {
   SANDBOX_WORKSPACE_ROOT,
   SANDBOX_SKILLS_ROOT,
   sandboxSkillDir,
+  getRuntimeDependencyProfileHash,
   resolveRuntimeDependencySnapshot,
   isSnapshotMissingError
 };